Privacy policy

• Controller — Manuel Chana, a private individual resident in Spain.
• Contact — manuelchana1988@gmail.com
• Service — krateion.mchana.es (app) and krateion.es (public site).
• Hosting — a personal server physically located in Spain. No cloud provider stores your data: the PostgreSQL database runs on that machine and is not reachable from the internet.

Only what you create by using the app. Nothing is inferred from other sites.

• Account — email address, username, display name, avatar, language and interface preferences. If you sign in with a password, we store an Argon2id hash of it — never the password itself.
• Training — routines, exercises, sessions, sets, reps, weight, RPE, tempo, rest, per-set heart rate, free-text notes, personal records, goals, mesocycles, badges and achievements.
• Body and health — body weight, body fat and muscle percentage, eleven body circumferences, height, sex, date of birth (optional, used to compute maximum heart rate and basal metabolic rate), activity level, and recovery logs: hours and quality of sleep, energy, resting heart rate, muscle soreness and stress level.
• Progress photos — the images you upload, with their view (front, side, back) and date. They are served only to you: any other signed-in user asking for them gets a 404.
• Imported activity — if you connect Health Connect, Apple Health, Polar or Withings: daily steps, distance, calories, heart-rate samples, external workout sessions and, from the watches, a nightly sleep summary (phases, interruptions, score) and heart-rate variability. The original record is stored verbatim so nothing is lost in translation.
• Social and gyms — friendships, blocks, likes, notifications, feed activity (which expires after 24 hours), gym membership, invitations and challenges.
• Integration credentials — the tokens of whatever you connect. The AI provider key and the MacroKalo key are encrypted with AES-256-GCM; the Strava token is stored in plain text in the database — an honest limitation we would rather state than hide.
• Push tokens — the notification identifier of each device or browser you allow notifications on, plus a personal, non-guessable topic for the self-hosted ntfy channel.
• Technical logs — a security audit log with the date, action, IP address and browser of sensitive events (sign-in, failed sign-in, password change, data export, account deletion); and a client error log with platform, browser, app version, route and stack trace, which does not store your IP address.

We never ask for your location, contacts, calendar, SMS, call log or microphone, and the app requests none of those permissions.

• Running your account and showing your history — performance of a contract (GDPR Art. 6.1.b).
• Health, body and imported activity data — your explicit consent (Art. 9.2.a), given by turning each feature on. These are special-category data and are treated as such: they are never used for anything other than showing you your own progress.
• Transactional email (verification, password reset, gym invitations) — performance of a contract.
• Push notifications — your consent, withdrawable at any time from the app settings or from your device.
• Security audit log and rate limiting — legitimate interest in keeping accounts from being broken into (Art. 6.1.f).
• Error logs — legitimate interest in fixing crashes we would otherwise never hear about.

All health integrations are off by default and each one is switched on by you, one at a time.

• Health Connect (Android) — reads steps, distance, heart rate, exercise sessions and calories (active and total). Read-only: Krateion never writes to Health Connect.
• Apple Health (iPhone) — reads steps, distance, heart rate, workouts and calories. Read-only, declared as such in the app itself.
• Polar and Withings (cloud watches) — if you connect one, Krateion asks their servers — with the permission you granted, and only for reading — for your workouts, steps, active calories, nightly sleep with its phases and, where the provider offers it, heart-rate variability. You can disconnect at any time, and doing so deletes the stored tokens.
• MacroKalo — an app by the same author, also self-hosted in Spain. If you link it, body weight, body fat, muscle and height travel between the two using a personal key that you can revoke.
• AI routine generator — if — and only if — you configure it with your own API key, the data of the wizard (sex, age, weight, height, body fat, experience, goal, available days, injuries and the notes you write) is sent to the provider you chose: OpenAI, Anthropic, Google Gemini or an Ollama server of your own. Krateion has no key of its own and pays for no AI: without your key the generator falls back to an internal algorithm and nothing leaves the server.

Health data is never used for advertising, profiling or research, is never sold, and never leaves the Spanish server except in the AI case described above, which you trigger yourself.

We do not sell, rent or trade personal data. These are every outbound connection the server makes, and what travels in each one:

• Google (sign-in only) — if you choose to sign in with Google, Google handles the authentication and returns your email, name and picture. We never receive your Google password and request access to no other Google service.
• Resend / SMTP — the recipient address and the body of transactional email. No newsletters, ever.
• ntfy — a notification server also self-hosted in Spain by the same author. It receives the title, the text and the link of each notification, addressed to your personal topic.
• Browser push (Web Push) — if you allow notifications in a browser, the encrypted notification travels through the push service of that browser vendor (Google, Mozilla or Apple, depending on the browser).
• Apple (APNs) and Google (FCM) — the delivery channels for notifications on iPhone and Android when they are enabled. They receive the title, text and link — never your training data.
• Strava, Polar and Withings — only the ones you connect. Krateion reads your activity with the permission you grant and writes nothing of yours on their side. Disconnecting deletes the tokens we hold.
• The AI provider you pick — only if you configure it, as described in section 4.
• Cloudflare — carries the encrypted traffic between you and the server (Cloudflare Tunnel). It is a transport carrier, not a recipient of the data.

There are no analytics or advertising SDKs of any kind — no Google Analytics, no Firebase Analytics, no Crashlytics, no Sentry, no PostHog, no advertising ID, no tracking pixels. This is verifiable: the source code is published.

Everything below is opt-in and reversible from Profile → Settings.

• Feed — your activity is visible to friends by default. You can set it to Private (nothing is published at all) or Public (visible to any signed-in user). Posts disappear after 24 hours, and switching back to Private also hides what was already there.
• Leaderboard — only among friends you accepted. It shows your name, handle, avatar and the ranking metric — never your raw numbers.
• Someone else’s profile — signed-in users only. Sharing a gym shows just your name, handle, avatar and achievement count; the full profile requires friendship.
• Gym screens — the wall-mounted screen of a gym shows records and rankings of its members, but only of those who explicitly turned on visibility for that gym.
• Session share links — when you share a session, the link shows the sets and the numbers but deliberately omits who you are: no name, no username, no email. You can revoke the link.
• Spotter mode — generates a temporary link so someone can follow your session live. It expires (two hours by default) and a new one invalidates the previous one.

Progress photos are never shared by any of these features.

While your account is active, your training history is kept indefinitely — that history is the whole point of the service.

Being precise about deletion, because it matters: the in-app delete button closes the account immediately — nobody can sign in, your open sessions stop working, notifications are disconnected and your profile vanishes from the feed, the leaderboard, gym screens and search — and schedules the physical erasure of everything else for 30 days later, automatically and without you having to ask for anything. A nightly process carries it out, and a watchdog checks that the process is still running and that no deadline passes unmet. Those 30 days are also your cooling-off window: sign in again before they run out and the account comes back intact. If you would rather it were erased sooner, write to manuelchana1988@gmail.com from your registered address.

• Encrypted backups — rotate on their own: 14 daily, 4 weekly and 6 monthly, so the last copy containing your data ages out within six months.
• Security audit log — is kept for 12 months and then deleted automatically. The IP address and browser go earlier, at 90 days, leaving the action and the date. If you delete your account, your audit log goes with it: it used to survive, and it was the place where your IP stayed forever.
• App error logs and AI generation logs — are kept for 90 days and then deleted automatically. The AI ones hold the text sent to the provider, so there is no sense in them living longer.
• Data on third-party platforms — whatever you connected (Strava, Polar, Withings, your AI provider) is outside our reach: ask each of them separately.

Under the GDPR you may, at any time:

• Access everything we hold about you.
• Rectify anything inaccurate, from the app itself or by email.
• Erase your data — see section 7 for exactly how.
• Export your data from the app, without asking anyone. You get a ZIP with the complete dump in JSON, the same data as CSV for a spreadsheet, and your progress photos. It excludes your password hash and your integration tokens, which are secrets and not personal data about you.
• Object to or restrict a specific processing activity.
• Withdraw a consent you gave, without affecting what came before.
• Lodge a complaint with the Spanish data protection authority (AEPD, www.aepd.es) or the one where you live.

Write to manuelchana1988@gmail.com. We answer within the 30 days the GDPR allows.

• Passwords — hashed with Argon2id. They are never stored or logged in the clear.
• Session — a signed cookie named __Host-krateion.session, HttpOnly, Secure and SameSite=Lax, valid for 30 days.
• Transport — HTTPS everywhere, with a content security policy that blocks scripts from any other origin.
• Sign-in — rate limited by IP address, with a response that does not reveal whether an account exists.
• Database — reachable only from the server itself, never exposed to the internet. Encrypted backups.
• Vulnerabilities — if you find one, please report it privately to manuelchana1988@gmail.com before disclosing it.

Krateion is not aimed at children under 14. We do not verify age when you register, so if you are a parent or guardian and believe a child has created an account, write to manuelchana1988@gmail.com and it will be closed and erased.

The version in force is always the one at this address, with its date at the top. Material changes are announced in the app on your next sign-in. For anything about this policy, write to manuelchana1988@gmail.com.