Privacy Policy

Bikkel ("Bikkel", "we", "us", "our") is a training logbook available on the web and on mobile. The service is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] ([JURISDICTION]). [LEGAL ENTITY NAME] is the data controller responsible for your personal data.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the choices and rights you have. It applies to the Bikkel website and application at bikkel.app.

For any privacy question or request, contact us at privacy@bikkel.app. Where we are required to appoint a Data Protection Officer or an EU / UK representative, their contact details are: [DPO / EU-UK REPRESENTATIVE CONTACT].

We aim to collect only what we need to run the logbook. Your data falls into a few categories, and comes either directly from you or automatically from your device:

• Account data (from you) — your name, email address, and either a securely hashed password or a passkey credential, or a Google account identifier if you sign in with Google. This is handled by our authentication layer (Better Auth).
• Training data (from you) — the routines, exercises, sets, reps, weights, notes and progress you record in your logbook. This is the content you create and it belongs to you.
• Billing data (from you and from Polar) — if you upgrade to a paid plan, your subscription status, plan and payment history. Payments are processed by Polar (our merchant of record); we do not see or store your full card number.
• Uploaded files (from you) — any images or files you upload (for example exercise media), stored on Cloudflare R2 object storage.
• Technical and session data (from your device) — information your browser or device sends automatically, such as IP address, user agent, and a session cookie used to keep you signed in and to operate and secure the service.

We use your personal data to:

• Create and secure your account and keep you signed in.
• Store, sync and display your training log across your devices.
• Process subscriptions, payments and renewals for paid plans.
• Send transactional email — email verification, sign-in and password resets, and billing notices — via the Cloudflare Email Service. We do not send marketing email without your consent.
• Maintain, debug, secure and improve the service, and protect it against abuse.
• Comply with our legal obligations, such as keeping billing and tax records.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your training log to serve you advertising. We do not carry out automated decision-making that produces legal or similarly significant effects on you.

Where the GDPR (or UK GDPR) applies, we rely on the following legal bases, depending on the purpose:

• Performance of a contract — to create your account, provide the logbook, and deliver and bill paid plans you sign up for.
• Legitimate interests — to secure, debug, operate and improve the service and prevent abuse, balanced against your rights.
• Consent — where we ask for it, for example before any non-essential cookies or marketing email; you can withdraw consent at any time.
• Legal obligation — to keep records we are legally required to retain, such as billing and tax records.

Bikkel uses a small number of strictly necessary cookies — most importantly a session cookie that keeps you signed in and protects your account. These are essential to provide the service and cannot be switched off through the app.

We do not currently use third-party advertising or analytics trackers. If that changes, we will update this policy and our Cookie Policy and, where required, ask for your consent first. For more detail, see our Cookie Policy at bikkel.app/cookie-policy.

We share limited data with the processors that make Bikkel work. Each acts on our instructions and under a data processing agreement:

• Polar — subscription billing and payment processing, as our merchant of record.
• Cloudflare — hosting, database, object storage (R2) for uploaded files, and transactional email delivery.
• Google — only if you choose to sign in with your Google account.

We do not currently run third-party advertising or analytics trackers. If that changes, we will update this policy and, where required, ask for your consent.

Some of our service providers may process data outside your country, including outside the European Economic Area (for example in the United States). Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, so that your data continues to receive an equivalent level of protection.

We keep personal data only for as long as we need it:

• Account and training data — kept for as long as your account is active. If you delete your account, we delete or anonymise it within [RETENTION PERIOD, e.g. 30 days], except where we must keep it longer to meet a legal obligation.
• Billing records — kept for as long as required by applicable tax and accounting law (typically [RETENTION PERIOD, e.g. 7 years]).
• Technical and security logs — kept for a short period ([RETENTION PERIOD, e.g. up to 12 months]) to operate and protect the service.

Depending on where you live, you may have the right to access, correct, export (portability), or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time.

You can access, correct, export and delete much of your data directly from your account settings. For anything else, email privacy@bikkel.app and we will respond within the time required by law — normally within 30 days. We will not discriminate against you for exercising your rights. You also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you specific rights over your personal information. In the past 12 months we have collected the categories of personal information described in "Data we collect" above (identifiers, account credentials, commercial/billing information, internet or network activity, and the content you create).

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CPRA. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" mechanism; if this ever changes, we will provide one.

You have the right to know what personal information we collect and how we use it, to request access to or deletion of it, to correct inaccurate information, and to not be discriminated against for exercising these rights. To exercise any of these rights, email privacy@bikkel.app. We will verify your request using the information associated with your account, and you may use an authorised agent where the law allows.

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, passkey support, and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the relevant authorities where required in the event of a personal data breach.

Bikkel is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us data, contact privacy@bikkel.app and we will remove it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, notify you in the app or by email before the changes take effect.

For any privacy question or to exercise your rights, contact the data controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], email privacy@bikkel.app. Where appointed, our Data Protection Officer / EU-UK representative can be reached at [DPO / EU-UK REPRESENTATIVE CONTACT].