This policy explains what personal data the Fyzivo app (the “app”) processes, why and for how long, who we share it with and what rights you have. The controller of your personal data is Jan Herrmann, a sole trader registered in the Czech Trade Register, ID No. 07279469, registered office Na Malé Straně 134/29, 747 17 Darkovice, Czech Republic, e-mail kineoflow@gmail.com (“we”).
What data we process
- Account data: your e-mail and password (stored only in a form from which it cannot be recovered); also your name, “About Me” text, profile photo and phone number if you provide them.
- Exercise data: which exercises you have played and completed, where you stopped in a video and which exercises are in your favourites. We use them to calculate your statistics, day streak and recommended exercises. Because these are physiotherapy exercises, they may reveal your health problems – for example when you do knee exercises. That is why we process them only with your explicit consent.
- Settings: reminders and notifications (time and days) and video orientation.
- Using the app without an account (guest): when you exercise as a guest, the server assigns you an anonymous identifier without an e-mail or name and we store your exercise data under it. If you then create an account, we move the data into it.
- Technical data: when you sign in, your IP address and the type of device or app; records of sign-ups, sign-ins and password resets (e-mail, time and type of action); if you allow notifications (push notifications), a device identifier used to deliver them (token) together with the platform and the app language.
- Communication with us: when you write to us, your e-mail and the content of your message.
- Subscription (once available): subscription status and type. Payments are processed solely by Apple or Google – we never receive payment-card details.
We do not use third-party analytics, advertising or tracking tools, and we do not sell data.
Why we process data and on what legal basis
- Your account and running the app: performance of a contract, i.e. our Terms of Use (Art. 6(1)(b) GDPR).
- Exercise data – saving your progress, statistics and exercise recommendations: your explicit consent (Art. 9(2)(a) GDPR). The app asks for it when you create an account or before you start exercising as a guest; older versions of the app did not ask yet and will ask you after you update. Without consent you can still watch the videos, your progress just is not saved.
- Notifications: your consent, which you give in your phone or app settings and can withdraw there at any time (Art. 6(1)(a) GDPR).
- Security of your account and the service (IP address, sign-in records): our legitimate interest (Art. 6(1)(f) GDPR).
- Aggregate view statistics that help us improve the content: our legitimate interest.
- Answering your questions: performance of a contract or our legitimate interest.
The app picks recommended exercises automatically based on what you exercise. This has no legal or similarly significant effect on you; we do not carry out automated decision-making within the meaning of Art. 22 GDPR.
Do you have to give us your data?
No. You can watch the videos without an account and without consent. To create an account we need your e-mail and a password, and to save your progress we need your consent; everything else in your profile is optional.
Where we store data and who we share it with
We store data on our own server at Hetzner Online GmbH in Germany, where the backups are kept as well. Apart from that, data is processed only by providers who help us run the app:
- Hetzner Online GmbH (Germany) – server and backups;
- Resend, Inc. (USA) – sending password-reset e-mails;
- Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging), USA – delivering notifications;
- Apple and Google – subscription payments, once available.
Transfers outside the EU
Resend, Apple and Google are based in the USA, so your e-mail (for password-reset e-mails) or your device token and the text of a notification may be transferred there. These transfers are safeguarded by standard contractual clauses approved by the European Commission or by the recipient’s certification under the EU-US Data Privacy Framework.
How long we keep data
- Account, exercise and settings data: for as long as your account exists. When you delete your account, we delete them immediately.
- Guest data: until you delete it or move it into an account; after 12 months of inactivity we delete it automatically.
- IP address and device type of a sign-in: until you sign out, at most 12 months after your last activity.
- Sign-in records: 90 days; immediately when you delete your account.
- Notification token: until you sign out or delete your account.
- E-mails with questions: as long as needed to deal with them.
- Database backups: deleted data disappears from them within 30 days at the latest.
- View statistics not linked to you (views without signing in and after an account is deleted): without a time limit.
Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability, the right to object to processing based on our legitimate interest, and the right to withdraw your consent at any time (processing before the withdrawal remains lawful). You can edit your profile directly in the app. To withdraw your consent to the processing of exercise data, delete your account in the app (Profile → Delete Account) or, as a guest, your data (More → Delete Guest Data); how to do it without the app is described on the account deletion page. Send any other requests to kineoflow@gmail.com. We will reply within one month at the latest.
You can also lodge a complaint with a supervisory authority – in the Czech Republic it is the Office for Personal Data Protection (uoou.gov.cz) – or with the supervisory authority in the country where you live or work.
Security
The app communicates with the server over an encrypted connection (HTTPS), we store passwords only in a form from which they cannot be recovered, and only the people who run the app have access to the data.
Children
The app is intended for people aged 16 and over. We do not knowingly collect personal data from younger children.
Changes to this policy
We update this policy when the way we process data changes. We will inform you of material changes by e-mail or in the app. The current version is always available on this page with the date of the last update.
Contact
For any privacy questions, write to us at kineoflow@gmail.com.