Privacy policy

The controller of your personal data is Diogo Filipe Teixeira Figueiredo, a private individual established in Portugal (NIF 281468389), who runs Loog ("Loog", "we", "us").

For any question about this policy or your personal data, write to support@loog.app. We have not appointed a data protection officer, because the law does not require one for a service of this kind and size; the controller handles every request personally.

This policy applies to the Loog website and web app at loog.app, including the pages you see before signing in. It does not cover third-party services you reach through Loog, such as Google sign-in or YouTube, which have their own privacy policies.

• Account data, received from Google when you sign in: your name, email address, whether Google has verified it, the address of your profile picture and a Google account identifier. We never receive your Google password.
• Training data you enter: programs, workouts, custom exercises, sessions, sets, loads, repetitions, effort ratings (RIR), notes and dates.
• Language preference: the language you choose for Loog, or the one your browser asked for when you created your account, saved to your account.
• Body weight entries, if you choose to log them. Because body weight may reveal information about your health, we treat it as a special category of data (see section 5).
• Security and session data: the IP address and browser details (user agent) linked to each signed-in session, and session tokens.
• Messages you send us through the contact form: your name, email address and message.
• Technical logs kept by our hosting provider when your browser requests a page: IP address, date and time, requested address, browser details and response status.

• To provide Loog: create and keep your account, store and show your training data, history and statistics. Legal basis: performance of the contract formed by our terms of service (Art. 6(1)(b) GDPR).
• To store your body weight and use it to calculate loads of bodyweight exercises. Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
• To keep Loog secure: manage sign-in sessions, prevent abuse and investigate incidents. Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).
• To answer your messages. Legal basis: our legitimate interest in replying to the people who contact us, or steps you asked for before using the service (Art. 6(1)(b) and (f) GDPR).
• To tell you about important changes to Loog, these terms or this policy. Legal basis: performance of the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR).
• To comply with the law and to establish, exercise or defend legal claims. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

We do not sell your data, show advertising, send marketing emails, use analytics or tracking tools, or make decisions about you based solely on automated processing, including profiling.

Logging your body weight is optional. Loog only stores it after you tick an explicit consent box, which is never ticked in advance. You can use every other feature without it.

You can withdraw your consent at any time from Profile → Body weight → Withdraw consent. Withdrawing deletes every body weight entry immediately and stops further logging. It does not affect the lawfulness of what was done before you withdrew.

Loog only stores what it needs to work on your device:

• Session cookies set when you sign in, which keep you signed in and protect the sign-in flow. They expire when your session ends or you log out.
• Your theme choice (light, dark or system), saved in your browser's local storage.
• Your language choice, saved in a cookie (NEXT_LOCALE) for one year, so pages show in the language you picked. Until you pick one, Loog uses the language your browser asks for. When your account language changes on another device, a temporary marker in your browser's session storage makes sure the switch happens only once.

They are all strictly necessary for a service you asked for, so the law does not require consent for them (Art. 5(3) of the ePrivacy Directive and Lei n.º 41/2004). We use no analytics, advertising or third-party tracking cookies. Your profile picture is loaded directly from Google's servers, which receive your IP address when it is shown.

Only the controller has access to your data. We use the following providers, who process it on our behalf and under our instructions, bound by data processing agreements (Art. 28 GDPR):

• Vercel Inc. hosts the website and runs the app's servers.
• Neon hosts the database that stores your account and training data, in Frankfurt, Germany.
• Resend delivers the messages you send through the contact form to our mailbox, and the one-off confirmation email we send to your address when you delete your account.

Google acts as an independent controller when you sign in with your Google account; its processing is governed by the Google Privacy Policy. The "Watch how to" button on exercise pages opens a YouTube search, which is also governed by Google's policy. We do not share any of your data with YouTube.

We disclose data to public authorities only when the law requires it, and we will tell you unless the law forbids it.

Your data is stored and processed in the European Union (Frankfurt, Germany). Some of our providers are based in the United States and may access data, for example for support or security. When that happens, the transfer is covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework, for certified providers, or by the European Commission's Standard Contractual Clauses (Art. 45 and 46 GDPR). You can ask us for a copy of the safeguards in place.

• Account and training data: while your account exists. Deleting your account erases them immediately.
• Body weight: until you delete an entry, withdraw your consent or delete your account.
• Session data (IP address, browser details): until the session expires or you log out.
• Contact messages: up to 2 years after the conversation ends, unless they are needed for a legal claim.
• Technical logs: for the short period our hosting provider keeps them, at most 30 days.
• Database backups: deleted data may remain in our database provider's restore history for up to 30 days before it is overwritten. It is not used during that time.

All traffic is encrypted with HTTPS, data is encrypted at rest by our providers, sign-in relies on Google and stores no passwords, and every request is checked so you can only reach your own data. Access to production systems is limited to the controller. If a breach puts your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay, as the GDPR requires.

Under the GDPR you have the right to:

• access your data and get a copy of it (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17), which you can do yourself from Profile → Delete account;
• restrict how we process it (Art. 18);
• receive the data you gave us in a structured, machine-readable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw your consent at any time (Art. 7(3)).

To exercise any right, write to support@loog.app from the email address of your account. We answer within one month, free of charge. We may extend this by two further months for complex requests, in which case we will tell you why. We may ask for more information if we cannot confirm your identity.

You also have the right to complain to a supervisory authority, in particular in the EU country where you live or work. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

Loog is for people aged 16 or older. We do not knowingly collect data from younger people. If we learn that an account belongs to someone under 16, we will delete it and its data.

We may update this policy when Loog or the law changes. The date at the top shows the latest version. We will tell you about material changes by email or in the app before they take effect, and ask for your consent again where the law requires it.