Privacy Policy

1. Privacy at a Glance & Data Controller

Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other international data protection laws is:

Markus Rohling
c/o POSTFLEX PFX-452-617
Emsdettener Straße 10
48268 Greven
Germany

Phone: +49 155 10033522
Email: support@marrohstudio.com (or privacy@marrohstudio.com)

For additional company information, please consult the Legal Notice (Impressum).

Notice Regarding Data Protection Officer

Because our business is operated as a sole proprietorship (Einzelunternehmen) with fewer than 20 individuals regularly engaged in the automated processing of personal data and does not perform processing operations requiring a data protection impact assessment or commercial transmission of personal data, the designation of a formal Data Protection Officer is not legally required pursuant to Section 38 of the German Federal Data Protection Act (BDSG) and Article 37(1) GDPR. Inquiries concerning privacy and data protection are addressed directly by the owner via the contact details above.

The Core Privacy Shield: Offline-First Architecture

MaGymus was conceived and architected from the ground up according to the principles of "Privacy by Design" and "Privacy by Default" (Art. 25 GDPR). Your smartphone is the sole repository for your fitness and health information:

• Exclusively Local SQLite Storage: All workout routines, exercises, sets, weights, repetitions, RPE ratings, workout notes, body composition metrics (body weight, height, calculated BMI, WHtR, RFM, FFMI, LBM), and private progress photos are stored EXCLUSIVELY locally in an SQLite database (Drift framework) within the operating system's sandboxed application container on your device.
• No Remote Developer Cloud, No Accounts: There is no user registration, no login, no password requirement, and no cloud database hosted by the developer. Your training data, bodily measurements, and health logs are never uploaded or transmitted to developer, marketing, or profiling servers.
• Global Compliance by Design: Through this strict offline-first architecture, MaGymus achieves structural compliance with major global privacy frameworks: the EU GDPR, the Swiss revised Data Protection Act (revDSG 2023), the UK GDPR & Data Protection Act 2018, the Brazilian LGPD (Lei nº 13.709/2018), the Japanese APPI (Act on the Protection of Personal Information), the South Korean PIPA (Personal Information Protection Act), and the Taiwanese PDPA (Personal Data Protection Act).
• Strict Data Minimization: The core principles of data minimization (Art. 5(1)(c) GDPR) and storage limitation (Art. 5(1)(e) GDPR) are embedded directly into the technical implementation.

Data Collection on this Website & Interactive Web Calculators

This website (marrohstudio.com/magymus) provides product information, statutory legal notices, client-side interactive sports-science calculators, and an offline-capable Training Plan Prompt Configurator (marrohstudio.com/magymus/rechner). We utilize no tracking cookies, no web analytics services (e.g., Google Analytics), and no external advertising pixels. All static assets (typefaces, icons, style sheets, images) are served locally from our proprietary web server; no third-party CDN calls (such as Google Fonts) are established. All inputs, calculations, JSON conversions, and print/PDF renderings within the web calculators run 100% locally in your web browser (JavaScript) and are never transmitted to or stored on our web server.

Local Browser Storage (localStorage)

This website uses the localStorage feature of your web browser solely to remember your chosen language selection. This constitutes a strictly necessary, user-requested functionality pursuant to Section 25(2) No. 2 TDDDG (German Telecommunications-Telemedia Data Protection Act) and does not require cookie consent. The stored parameter remains entirely confined to your client browser.

2. Legal Bases for Data Processing

To the extent personal data is processed in connection with the app or website, processing is founded upon the following legal bases:

• Art. 6(1)(b) GDPR (Performance of a Contract): For the provision of core application functionalities and technical fulfillment of Pro subscriptions/purchases via the Apple App Store.
• Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR (Explicit Consent): For the voluntary user input and strictly local on-device processing of sensitive body and health metrics (body weight, height, age, biological sex, workout logs) acknowledged during the onboarding flow.
• Art. 6(1)(f) GDPR (Legitimate Interests): For ensuring the operational security, integrity, and denial-of-service defense of our web server infrastructure hosted at IONOS SE, as well as handling voluntary user support inquiries via email.
• Equivalent International Statutory Grounds: Including Arts. 6 and 31 revDSG (Switzerland), Arts. 7 and 11 LGPD (Brazil), UK Data Protection Act 2018, and corresponding provisions of the Japanese APPI, South Korean PIPA, and Taiwanese PDPA.

3. In-App Data Processing in Detail

Local Data Storage & Personal Responsibility for Backups

Your workout history, customized training plans, body metrics, and workout logs reside exclusively within the local SQLite database of the app on your mobile device. If you uninstall the application, the local database and all records contained therein are immediately and irrevocably erased from your device storage.

Personal Responsibility for Backups: Because we maintain no cloud replica of your workouts or bodily measurements, maintaining data backups is solely the user's responsibility. You can export your data at any time via the integrated JSON/CSV export feature. Please note that local app data may be encapsulated in your automated operating system backups (such as encrypted Apple iCloud device backups or local Mac/PC backups) unless you explicitly exclude the application in your iOS settings. We have no access to your personal operating system backups.

Biometrics & Progress Photo Vault (Face ID / Touch ID)

The app features an optional "Progress Photo Vault" allowing users to visually document their physical development in total privacy. Users may optionally secure this vault using biometric authentication (Face ID or Touch ID).

• Complete Hardware Decoupling via Apple Secure Enclave: Biometric verification is executed 100% on the hardware level by the operating system's native Apple LocalAuthentication framework.
• Zero Access to Biometric Data: MaGymus and the developer never have access to biometric raw data, facial geometry, fingerprint scans, or cryptographic templates.
• Abstract Boolean Signal: The application only receives an abstract boolean confirmation (Authentication Succeeded: Yes/No) from iOS to reveal the local photos.
• Sandboxed Image Storage: Captured photos remain exclusively inside the isolated local application sandbox directory on the device and are never transmitted to any external server.

Sensitive Health & Physiological Metrics (Art. 9 GDPR / Art. 5 revDSG / Art. 11 LGPD)

The app processes parameters such as age, biological sex, body weight, and height exclusively to calculate sports science metrics (such as Wilks Score, RFM, FFMI, Oxford BMI, and WHtR) and to calibrate the progression engine. Because these qualify as sensitive health-related data, strict standards apply: These metrics never leave your device. No cloud transmission, no server-side profiling, and no disclosure to third parties (such as insurance companies, advertising networks, or data brokers) ever takes place.

No AI Training & No Transmission to Large Language Models (No AI)

All coaching algorithms, workload metrics, and progression suggestions operate in a strictly deterministic, mathematical manner entirely on-device (On-Device Processing). We categorically guarantee that your personal fitness and health data is never fed into Artificial Intelligence (AI) algorithms, large language models (such as ChatGPT or Gemini), or third-party machine learning pipelines.

Offline Prompt Configurator & User-Initiated Use of External AI Services

The app and our website tools contain no Artificial Intelligence (AI) system within the meaning of Art. 3(1) of the EU AI Act (Regulation (EU) 2024/1689) and maintain zero API connections to external Large Language Model (LLM) providers (such as OpenAI/ChatGPT, Google Gemini, or Anthropic Claude):

• Deterministic On-Device Assembly: The Training Plan Prompt Configurator compiles text templates based purely on deterministic, rule-based logic 100% locally on your device or in your browser. A generated prompt is copied to your device's clipboard solely upon your explicit command.
• Local JSON Parsing: Importing externally created training plans in standardized JSON format takes place exclusively offline and locally inside the protected SQLite sandbox of your device.
• User-Initiated Use of External AI Services (No Joint Controllership): If you manually copy a generated prompt and paste it into a third-party AI service (such as ChatGPT, Claude, or Gemini), that text leaves MaGymus's sphere of responsibility. Subsequent data processing is governed exclusively by the privacy policy and terms of service of that respective third-party provider (there is no joint controllership pursuant to Art. 26 GDPR).
• Critical Privacy Notice: Users are expressly advised never to enter sensitive health data, pre-existing conditions, medical diagnoses (Art. 9 GDPR, Art. 5c revDSG, Art. 11 LGPD), or real personal names into prompt template free-text fields intended for external AI services.

Device Permissions

To enable specific optional functions, the application requests the following operating system permissions:

• Camera & Photo Library: Used solely to capture or import photos into your Progress Photo Vault. All files stay within the local sandbox.
• Notifications: When granted, rest timer notifications are scheduled 100% locally on your device ("Local Notifications"). We operate no external cloud push infrastructure (such as remote APNs campaigns or Firebase Cloud Messaging) for marketing or engagement.
• Biometrics (Face ID / Touch ID): Utilized solely for the on-device unlock of the Progress Photo Vault without accessing biometric credentials.

In-App Purchases & Subscriptions (Apple StoreKit & RevenueCat)

When upgrading to the "Pro" version, transaction fulfillment is handled via the Apple App Store:

• Apple as Merchant of Record: Transactions are concluded directly with Apple (Apple Distribution International Ltd., Ireland / Apple Inc., USA). Apple is the independent data controller for payment processing (credit card data, Apple Pay, billing addresses). The developer of MaGymus never receives or retains your financial or payment details.
• RevenueCat (Technical Receipt Validation): For technical receipt validation and subscription state synchronization, we integrate RevenueCat (RevenueCat, Inc., San Francisco, USA) acting as a technical data processor pursuant to Art. 28 GDPR. RevenueCat processes the following metadata:
  • A randomly generated, pseudonymous App User ID (decoupled from any real-world identity).
  • The cryptographic purchase receipt issued by Apple (Receipt Token).
  • Transaction metadata: Product ID, purchase timestamp, expiration date, and entitlement status.
  • Device metadata: Store country code (for tax/currency localization), operating system version, and application version.
• STRICT SEPARATION: Under no circumstances are workout logs, bodily measurements, exercises, notes, or progress photos shared with RevenueCat or Apple.
• International Data Transfers: RevenueCat Inc. is headquartered in the USA. Transfers are covered under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR) and Standard Contractual Clauses (SCCs) within our Data Processing Addendum (DPA).

Platform Telemetry & Crash Diagnostics

MaGymus does not integrate third-party marketing SDKs, advertising beacons, or behavioral telemetry frameworks (such as Firebase Analytics, Adjust, or AppsFlyer). If you have opted into sharing crash and usage diagnostics with app developers in your iOS operating system settings, Apple provides developers with anonymized, aggregate crash logs and download metrics via App Store Connect.

Data Export & Content Sharing (e.g., iOS Share Sheet)

The application allows you to export your data in open JSON or CSV formats and share workout summaries or comparison cards via the native iOS Share Sheet.

Once you export or transmit content to external apps (such as WhatsApp, email clients, or Instagram), that data exits the protected environment of MaGymus. At that point, the privacy policies of the respective destination applications apply, and subsequent processing is the user's sole responsibility.

Outgoing Network Communications (Comprehensive Disclosure)

While MaGymus operates strictly offline for training data, network communication takes place under the following specific circumstances:

• Subscription & Purchase Validation: At app startup and when inspecting Pro features, secure endpoints of Apple StoreKit and RevenueCat are contacted to verify entitlement status.
• Web Page Access (Legal Terms & Web Calculators): Tapping links for Terms of Service, Privacy Policy, Legal Notice, or interactive web tools (such as marrohstudio.com/magymus/rechner) launches your device's browser to display pages hosted on marrohstudio.com.
• Customer Support: Initiating support opens your operating system's default email client with a pre-filled recipient address.
• External Social Media: Tapping links to Instagram or other external web resources directs to the platform via your web browser or native third-party app.
• App Store Rating Dialog: The optional rating prompt uses Apple's native StoreKit dialog communicating directly with Apple servers.

Protection of Minors

The application is strictly intended for use by individuals aged 16 and older. We do not knowingly process personal data from children or adolescents under the age of 16.

4. Website Hosting & Email Communications

Hosting with IONOS SE & Server Log Files

Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you access our informational web pages or this Privacy Policy, the IONOS web servers automatically log standard connection data (including IP address, access timestamp, requested URL, browser type, and operating system).

This logging is conducted on the basis of Art. 6(1)(f) GDPR (legitimate interest in the operational stability, defense against cyberattacks, and delivery of web services). A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with IONOS SE.

Direct Email Inquiries

When communicating with us via email (e.g., support requests), your email address and any submitted details are processed solely to resolve and answer your inquiry (Art. 6(1)(b) or Art. 6(1)(f) GDPR). Personal inquiry data is never disclosed to unauthorized third parties.

5. International Data Subject Rights & Regional Compliance

Because MaGymus does not maintain central user accounts or cloud databases of your workouts, you can exercise your statutory data subject rights directly, autonomously, and immediately on your own device:

• Right of Access (Art. 15 GDPR / Art. 25 revDSG / Art. 18 LGPD / Sec. 28 APPI / Art. 35 PIPA / Art. 10 PDPA): You have the right to obtain confirmation and inspect your data. All records within MaGymus are immediately visible in the UI and can be exported via the built-in JSON/CSV export tool.
• Right to Rectification (Art. 16 GDPR / Art. 24 revDSG / Art. 18 LGPD): You can edit or adjust incorrect workout logs, body metrics, or profile values directly in the application at any time.
• Right to Erasure (Art. 17 GDPR / Art. 18 LGPD / Art. 36 PIPA / Art. 11 PDPA): You can exercise your right to erasure immediately by clearing workout history in settings or uninstalling the app, which irrevocably destroys the local SQLite database and photo directory. To request erasure of server-side purchase receipt tokens at RevenueCat, contact support@marrohstudio.com referencing your anonymous App User ID (accessible in the app under Info/Support).
• Right to Data Portability (Art. 20 GDPR / Art. 18 LGPD): You may export all structured workouts and body metrics in standardized JSON or CSV formats.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR).
• Withdrawal of Consent (Art. 7(3) GDPR): Operating system permissions (Camera, Biometrics, Notifications) can be revoked at any time in your iOS Settings with effect for the future.
• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent data protection supervisory authority. The lead supervisory authority for our establishment is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany (www.ldi.nrw.de).

Specific Provisions for Switzerland (revDSG)

For data subjects in Switzerland, processing is governed by the revised Swiss Federal Act on Data Protection (revDSG, effective September 1, 2023). Pursuant to Art. 19 revDSG, we provide transparent disclosure of processing purposes, categories of data, and recipients. Because health and workout data remains exclusively local, no cross-border disclosure of sensitive data takes place. Receipt validation via RevenueCat in the USA is safeguarded pursuant to Art. 16 revDSG. Swiss residents may enforce their rights under Arts. 25–29 revDSG. Supervisory Authority: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch).

Specific Provisions for Brazil (LGPD & ANPD Compliance)

For users in Brazil, personal data processing complies with the Brazilian General Data Protection Law (LGPD – Lei nº 13.709/2018).

Direct Communication Channel (Canal de Atendimento / Resolução CD/ANPD Nº 2/2022): Pursuant to Resolution CD/ANPD No. 2/2022 of the National Data Protection Authority (ANPD) applicable to small data processing agents (Agentes de Tratamento de Pequeno Porte), we maintain a direct communication channel for Brazilian data subjects: Email support@marrohstudio.com (Subject: "LGPD Data Request"). Brazilian users may assert all rights under Art. 18 LGPD (confirmation of processing, access, correction, anonymization/blocking/deletion, portability). Supervisory Authority: Autoridade Nacional de Proteção de Dados (ANPD).

Specific Provisions for the United Kingdom (UK GDPR)

For data subjects in the United Kingdom, processing is conducted in accordance with the UK Data Protection Act 2018 and the UK GDPR. Supervisory Authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk).

Specific Provisions for the Asia-Pacific Region (Japan, South Korea, Taiwan)

• Japan (APPI - 個人情報保護法): Processing adheres to the Act on the Protection of Personal Information. Because all workout, muscle, and body metrics remain solely within client-side device memory, users retain unmediated control over their records.
• South Korea (PIPA - 개인정보 보호법): Compliant with the Personal Information Protection Act, sensitive health data is handled with maximum localized safeguards without unauthorized transfers to third-party databases.
• Taiwan (PDPA - 個人資料保護法): Processing satisfies the principles of transparency, explicit purpose limitation, and the protection of data subject rights under Art. 3 PDPA.

6. Privacy Contact

For all questions, data requests, or information regarding privacy and data protection, please contact:

Markus Rohling
c/o POSTFLEX PFX-452-617
Emsdettener Straße 10
48268 Greven, Germany
Email: support@marrohstudio.com or privacy@marrohstudio.com