Privacy Policy

As of: 2 November 2026

Translation – the German version is binding.

1. Controller

BaseRaise Solution GmbH i. G. (in formation)
Reifersbrunner Straße 6a
86415 Mering
Germany
Email: legal@trackraise.com

This privacy policy applies to the TrackRaise app (the website https://trackraise.app and the apps for iPhone and Android) and the fitness portal https://trackraise.com. Sections 2 to 7 mainly concern the app, section 8 the portal, section 9 the waitlist before the start.

2. What data we process

  • Account data: name, email address, password (only as a secure hash), sign-in method (email, Google or Apple), language.
  • Date of birth: required when signing up, to make sure you are at least 16 years old; it is also used to calculate your age for the analyses.
  • Profile and goals: voluntary details such as gender, weight, target weight, step and calorie goals.
  • Details from “Your TrackRaise start”: your main training goals, your experience, the muscle areas that matter to you, how often and how long you want to train, how you want to use TrackRaise (training suggestions, your own plans or both). You can change them in your profile at any time.
  • Marked exercises and plan suggestions: which exercises you marked as favourites or “Don’t suggest”, which plan suggestions you were shown and whether you accepted, later changed or declined them, with the time.
  • News by email: only with your consent, your email address and your consent with its time, to tell you about new TrackRaise features.
  • Training statistics by email: only with your consent, your email address and your consent with its time, to send you a regular summary of your week, month and year. The summary is based on your training data, steps, weight values and goals.
  • Training data: training plans, logged workouts with weights, repetitions, duration and calories, notes.
  • Connections with other users: only if you use them, your invite links (only a check value is stored, not the link itself, with time, expiry and who used it), whom you are connected with and since when, and whether you share workouts and achievements with your connections.
  • Health data from Apple Health (iPhone) or Health Connect (Android): only with your explicit consent, see the separate “Consent to health data”. We use data from Health Connect solely for the TrackRaise features described there: we do not pass it on, do not use it for advertising and not to make creditworthiness, insurance or similar decisions.
  • Usage data: times of visits to the web and the app and events such as “workout logged” or “plan created”, where you came from when signing up (referring website, campaign parameters) and your voluntary answer on how you heard about TrackRaise.
  • Consents: time, IP address, browser identifier and document version of every consent and withdrawal, including those for news and training statistics by email.
  • Server logs: IP address, time and requested address of every request, for security and troubleshooting.

3. Purposes and legal bases

  • Providing TrackRaise and your account: contract, Art. 6 (1) (b) GDPR.
  • Health data from Apple Health or Health Connect: explicit consent, Art. 9 (2) (a) GDPR.
  • Checking the minimum age of 16 based on the date of birth: contract and legitimate interest, Art. 6 (1) (b) and (f) GDPR. No account is created for anyone under 16; details already entered are deleted.
  • Details from “Your TrackRaise start”, to tailor training suggestions, progressions and analyses to you: contract, Art. 6 (1) (b) GDPR. The details are voluntary; without them suggestions stay general.
  • Automatic analysis of your logged workouts for suggestions (contract, Art. 6 (1) (b) GDPR): from your workouts of the past weeks we determine how often, how long and on which days you train, which exercises you do often, how your performance develops and how often you train which muscle groups. This happens only on our server, without AI and without passing anything to third parties; the values are recalculated when needed and not stored separately. You see the results in your plan suggestion. They have no legal or similarly significant effect on you (no automated decision within the meaning of Art. 22 GDPR): you decide yourself whether to accept a suggestion.
  • Plan suggestions shown and what became of them, to improve the quality of suggestions: legitimate interest, Art. 6 (1) (f) GDPR. In the statistics we only evaluate totals.
  • Notices about new features by email: consent, Art. 6 (1) (a) GDPR and Section 7 (2) No. 2 UWG. Consent is voluntary and not needed to use TrackRaise; you can withdraw it at any time in your profile or via the unsubscribe link in each of these emails.
  • Training statistics by email: consent, Art. 6 (1) (a) GDPR. Consent is voluntary and not needed to use TrackRaise; you can withdraw it at any time in your profile or via the unsubscribe link in each of these emails.
  • Usage statistics to improve TrackRaise, security and preventing abuse: legitimate interest, Art. 6 (1) (f) GDPR.
  • Proof of consent: legal obligation, Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR.
  • Connections with other users and sharing with them: contract, Art. 6 (1) (b) GDPR. A connection only comes about when you confirm an invite or someone confirms yours; it can be ended at any time. Only what you switch on yourself is shared (default: nothing): with “Share workouts” the name, date, duration, exercises and number of sets of your workouts logged in the app, with “Share achievements” your records, milestones and streaks from them. Never shared are weights, data from Apple Health or Health Connect (steps, calories, synced workouts), your body weight and your step goals.

4. Recipients

  • Hosting and sending emails: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, as processor. The servers are located in Germany.
  • Signing in with Google or Apple: if you use it, Google or Apple learns that you signed in; we receive your name and email address. Data may be transferred to the USA; both providers are certified under the EU-US Data Privacy Framework.
  • Your connections: users you are connected with see your name and what you share with them (section 3).
  • We do not pass on data for advertising or sell data. We do not use advertising or analytics services of third parties.

5. Cookies and storage on your device

TrackRaise sets a technically necessary session cookie for signing in. If you open an invite link before you are signed in or can use TrackRaise, a cookie remembers the invite for up to 7 days so that it is shown to you afterwards. Drafts of running workouts, workouts saved offline and cached pages for offline use are also stored on your device. This is required for the features you asked for (Section 25 (2) No. 2 TDDDG).

6. Storage period

We keep your data as long as your account exists. If you unsubscribe from news or training statistics by email, we stop sending them; the time of your choice is kept as proof. After a deletion we remove your data unless statutory retention obligations apply. We keep proof of consents for up to three years after the account ends. Server logs are deleted after 14 days; error logs of the applications are limited in size and overwritten continuously.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw a consent at any time with effect for the future: the consent to health data, to training suggestions by email and to news by email directly in your profile. Contact legal@trackraise.com for this. You can also complain to a data protection supervisory authority, for example the one responsible for where you live.

8. Fitness portal trackraise.com

You can read the portal without an account. It sets no cookies and loads no content from third parties (not even fonts); everything comes from our server in Germany.

Visiting the pages: with every request our server processes the technically necessary details (IP address, time, requested address, browser identifier) to deliver the page and protect it from abuse. The legal basis is our legitimate interest in secure operation, Art. 6 (1) (f) GDPR. Server logs are deleted after 14 days.

Audience measurement: we measure reach with Umami, which we run ourselves on our server; the data does not leave it. Umami sets no cookies and neither stores nor reads anything on your device. It records the page visited (without search terms), the referring website, browser, operating system, device type, screen size, language and the country, region and city derived from the IP address. In addition, events such as a click on “To the app”, a search (only the number of results, not the search term) or reading an article to the end. The IP address itself is not stored. To count visits, Umami forms an identifier from the IP address, browser identifier and a random value that changes daily; visits on different days cannot be linked, and we cannot identify you. If “Do Not Track” is switched on in your browser, we do not count you.

The legal basis is our legitimate interest in understanding and improving the use of the portal in a data-minimising way, Art. 6 (1) (f) GDPR. As nothing is stored on or read from your device, no consent under Section 25 TDDDG is needed. We keep the values for at most 12 months and delete older ones automatically. You can object to the measurement at any time, for example by switching on “Do Not Track” or by contacting legal@trackraise.com. Umami is not used in the TrackRaise app.

Editorial team: for members of the editorial team we store an account of their own (name, email address, password only as a secure hash, role, language, time of the last sign-in) and who created which version of an article and which image. When signing in, the portal sets a technically necessary session cookie (Section 25 (2) No. 2 TDDDG). On request, a member of the editorial team can exclude their browser from the audience measurement; an entry is then stored in that browser's storage. For accesses to the article API we log every request (time, action, result). The legal basis is the cooperation with the editorial team, Art. 6 (1) (b) GDPR, and our legitimate interest in security and traceability, Art. 6 (1) (f) GDPR. We delete the data when the cooperation ends, unless articles still need to be attributed to a person.

Contact: if you write to legal@trackraise.com, we process your message and contact details to answer it (Art. 6 (1) (b) or (f) GDPR) and delete them once the matter is settled and no retention obligation applies.

9. Waitlist

As long as TrackRaise has not started yet, you can join a waitlist on https://trackraise.app. For this we store your email address and language. We send you an email with a link; only once you confirm it are you on the list (double opt-in). We store the time and IP address of this confirmation as proof of your consent. As soon as TrackRaise starts, we write to you once and then delete your address; if you do not confirm it, we delete it after 7 days. The legal basis is your consent, Art. 6 (1) (a) GDPR. You can withdraw it at any time via the link in our emails or by writing to legal@trackraise.com; we then delete your address immediately. Like all TrackRaise emails, these are sent through our hosting provider (section 4).

10. Changes

We adapt this policy when TrackRaise or the law changes. We inform you about significant changes in TrackRaise.