Privacy Notice

JH-Kickboxing (“we”, “us”) provides the Iron strength-training app and acts as the data controller for the personal data described below. This notice explains what we collect, why, who we share it with and how long we keep it.

1. Data we collect

• Account information — email address, login credentials (stored hashed by our authentication provider), account creation date, and roles such as administrator.
• Profile data — display name, and the training details you choose to enter: gender, age, height, current and target weight, training level and goal.
• Workout history — exercises, sets, weights, reps, RPE, notes, session dates and durations, programmes, custom exercises, personal records and achievements.
• Bodyweight data — the bodyweight entries and dates you log.
• Preferences — units, language, theme and feature toggles such as the AI training assistant.
• Product analytics and error reports — limited in-app events (for example “workout started”) and error messages, linked to your account, used to find and fix problems.
• Campaign reach — when you open the poster or flyer page, we store which printed code you scanned, the day, and a random value stored in your browser that only serves to avoid counting the same visit twice. It rotates, is not linked to your identity, and contains no advertising or tracking data. If you create an account, we also store which printed code your account came from.
• Payment and subscription identifiers — the identifiers our payment provider returns: customer ID, subscription ID, plan, status, trial end and renewal dates.

We do not collect or store your card number, CVC or bank details. Card data is collected and processed entirely by our payment provider.

2. Why we use it, and on what legal basis

• Providing the Service — account creation, storing and syncing your workouts, generating progression suggestions, running subscriptions. Legal basis: performance of our contract with you.
• Security and fraud prevention — protecting accounts and preventing abuse. Legal basis: legitimate interests.
• Product improvement and support — analytics, error reports, responding to feedback and support requests. Legal basis: legitimate interests.
• Legal and tax obligations — keeping records we are required to keep. Legal basis: legal obligation.
• Optional messages — where we ask for it, consent, which you can withdraw at any time.

3. Who we share data with

• Hosting and backend providers — who run the database, authentication and application infrastructure on our behalf, as processors.
• Paddle.com — our Merchant of Record for the sale of Iron Pro, which handles checkout, subscription management, payments, invoicing and tax compliance, and acts as its own controller for that data.
• Professional advisers — legal or accounting advisers where necessary.
• Authorities — where required by law.
• A personal trainer you accepted — if, and only if, you accepted a trainer invitation in Iron, that trainer can see the training data covered by the permissions you accepted, and can log workouts for you where you allowed it. They never see your billing details. You can withdraw this at any time from Profile → Trainer, which ends their access immediately.

We do not sell your personal data, and we do not use it to train third-party AI models.

4. International transfers

Our providers may process data outside your country, including outside the EEA/UK. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. Retention

We keep your account and training data for as long as your account exists. If you delete your account, we delete or anonymise your personal data, except where we must retain records (for example billing records for tax purposes). Analytics and error events are kept only as long as useful for diagnostics.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent. If you are in the EEA or UK you may also complain to your supervisory authority. We respond to requests within one month. Contact haageswerk@gmail.com. You can also delete individual exercise data, bodyweight logs or all of your training data from within Iron’s Profile screen.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level database access rules that isolate each account, hashed credentials and restricted administrative access.

8. Cookies and local storage

Iron uses only essential cookies and browser storage: keeping you signed in, remembering your preferences, and holding workout data locally so the app works offline. Our checkout provider sets its own cookies necessary to process payments. We do not use advertising cookies.

9. Younger users (12 and over)

Iron is available from age 12. Iron is not for children under 12, and we do not knowingly create accounts for them. If you are 12–15, a parent or legal guardian has to approve your account before you can train. At signup we ask you to choose an age range (12–15 or 16 and over) and, if you are 12–15, for your parent’s or legal guardian’s email address. We email them a one-time approval link and your account stays locked until they open it and approve. We record only that age range, the guardian’s email address, whether and when approval was requested and given, and a one-time link that expires — we do not ask for your date of birth, and we do not ask your guardian for a name, address or identity documents.

In simple terms: we collect your email address, what you log in Iron (workouts, bodyweight, preferences) and basic error and usage information, so the app can save your training, sync it between your devices and suggest your next sets. We do not sell your data or use it for advertising. You can delete individual data or your whole account at any time from the Profile screen; a parent or legal guardian can ask us to delete an account for a user under 16 by emailing haageswerk@gmail.com.

10. Changes

We may update this notice; material changes will be announced in the app or by email before they take effect.