Privacy Policy

Last updated 7 October 2026

1. Who is responsible

Zebra Solutions DOO provides StraxFit and is the controller of your personal data. For anything about your data, write to [email protected].

2. What we collect

Your account

Your name, e-mail address and password. We store the password only in hashed form, so we can’t read it. We also keep your sign-in sessions so you stay signed in.

Your answers

Who the plan is for, age, where you train, the gear you have, how much noise you can make, the days and minutes you have, the effort you want, your goal, and the areas of your body that feel off and how often. If you add people on Plus, the same answers about them.

Your training

Your plans, the sessions and sets you log, your feedback (“too easy”, “too hard”, “it hurts”), your notes, check-ins and your answers to the monthly review.

Billing

Paddle, our reseller, collects your payment details. We receive and keep your Paddle customer and subscription references, your plan, its status and renewal date, and what was charged. We never see your full card number.

Technical data

Your IP address and browser details reach our servers with every request. We use them to keep StraxFit secure (for example, limiting repeated sign-in attempts) and to fix errors.

Messages

What you write to us when you contact us.

3. Health information

The areas that feel off, and what you note about pain in your sessions, are health information. We process it only with your explicit consent, which you give during the questions:

“I agree that StraxFit stores what I tell it about my body (areas that feel off) to build and adjust my plan.”

We use it only to choose, ease or leave out exercises in your plan. You can withdraw your consent at any time by removing that person or deleting your account in the app, or by writing to us. We then delete it. Without it we can still build a plan, but not one that takes those areas into account.

4. People you add (Plus)

On Plus, a parent can build plans for their children and a coach for the people they coach. The account holder answers the questions for them; we never ask a child for their data. If you add someone you coach, make sure they have agreed and know about this policy. They can contact us directly to see or delete what we hold about them.

5. Why we use it, and on what legal basis

• To provide StraxFit: your account, building and revising your plan, guiding your sessions, saving your progress across devices, and sending the e-mails the service needs (confirming your address, resetting your password, telling you a plan is ready). Legal basis: our contract with you.
• To use health information in your plan. Legal basis: your explicit consent.
• Monthly reviews and support. People on our team can see your account and training data when you ask for help, to check plans, and, on Plus, to review your month. Legal basis: our contract with you, and your consent for health information.
• Billing records, which we and Paddle must keep. Legal basis: our contract and our legal obligations.
• Security and fixing errors. Legal basis: our legitimate interest in keeping StraxFit safe and working.

We don’t send newsletters or marketing e-mails, and we don’t use your data for advertising.

6. The AI that writes your plan

Plans are written by an OpenAI model through OpenAI’s API. For each plan we send your answers (as listed in section 2, including the areas that feel off) and the exercises that fit them; for a monthly revision, also your logged sessions, feedback, notes and review answers. We don’t send your name or e-mail address.

Under OpenAI’s API terms, this data isn’t used to train OpenAI’s models. OpenAI may keep it for up to 30 days to detect abuse, and we delete the stored response at OpenAI as soon as your plan is saved.

The plan is created automatically and then checked against our rules. It doesn’t make decisions about you with legal or similarly significant effects, and you can always ask us to look at a plan.

7. Who helps us

These providers process data for us, only on our instructions and under data processing agreements:

• Hetzner Online GmbH (Germany): the servers that run StraxFit and hold the database.
• Cloudflare, Inc.: secure delivery of the website, protection against attacks, and storage of our exercise videos and of encrypted database backups.
• OpenAI: writing plans, as described above.
• Resend: sending our e-mails.

Paddle (Paddle.com Market Ltd, UK) sells StraxFit to you as Merchant of Record. It processes your payment and billing details as an independent controller under its own privacy notice. We share with Paddle only what a payment needs: your name, your e-mail address and an internal account reference.

We share data with authorities only when the law requires it. We don’t sell it to anyone.

8. Data outside the EU

Our database is in Germany. Some providers (Cloudflare, OpenAI and Resend) are based in the United States or may process data there. Where that happens, the transfer is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or by the Commission’s Standard Contractual Clauses.

9. How long we keep it

• Your account and training data: for as long as you have an account.
• When you remove a person, their answers, plans, notes and training history are deleted straight away.
• When you delete your account, everything above is deleted straight away. We keep only a record that an account was deleted, without your name or e-mail address.
• Encrypted backups of the database are kept for up to 30 days, so deleted data is gone from them within 30 days.
• Server logs are kept briefly and overwritten automatically.
• Invoices and payment records are kept by Paddle for as long as tax law requires.

10. Security

StraxFit is served only over encrypted connections, passwords are hashed, the servers accept traffic only through Cloudflare, administrative access is limited and protected, and backups are encrypted before they leave the server. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.

11. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Much of this you can do yourself in the app: change your answers, remove a person, or delete your account. For the rest, write to [email protected]; we’ll answer within one month.

You can also complain to the data protection authority where you live or work.

12. Cookies and storage in your browser

We use only what StraxFit needs to work, so there is no cookie banner:

• a cookie that keeps you signed in;
• storage in your browser for an unfinished session, an unfinished set of answers, notes waiting to sync when you are offline, and an open checkout;
• security cookies Cloudflare may set to tell people from bots;
• Paddle’s checkout script, which our home page loads so the checkout opens quickly, covered by Paddle’s privacy notice.

We don’t use analytics, advertising or social media trackers.

13. Children

Accounts are for adults. Children’s data reaches us only through a parent’s Plus account, as described in section 4. If you believe a child has signed up on their own, tell us and we’ll delete the account.

14. Changes to this policy

When we change this policy, we update the date at the top. If a change matters to you, we’ll e-mail you before it takes effect.

15. Contact

Zebra Solutions DOO · [email protected]