Privacy Policy
This policy explains what personal data is processed when you use the Kraftsam app for iPhone, iPad and Apple Watch and the website kraftsam.73apps.com, why, and what rights you have. In short: Kraftsam has no accounts, no ads and no tracking. Your plans and trainings stay on your devices and in your own iCloud, where we cannot see them. Data passes through our services only when you have a training card read, and when you buy Kraftsam.
1. Controller
The controller responsible for processing your data is:
73 Apps UG (haftungsbeschränkt)Bahnstr. 10
50996 Köln
Germany
Represented by: Bastian Bauwens
Email: hello@73apps.com
Phone: +49 221 71598774
For any question about your data, write to us at the email address above.
2. This website
The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, your browser sends technical data such as your IP address, the date and time, the page requested, the referring page and your browser type. This data is processed to deliver the page and to protect it against misuse, and is kept only for a short time in the host’s logs. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).
The website sets no cookies, uses no analytics or tracking tools, and loads no external fonts or scripts.
3. Your plans and trainings
Kraftsam has no accounts and no sign-in. What you create in the app (your plans, exercises, weights, machine settings and trainings with their times) is stored on your device.
If iCloud is switched on for Kraftsam on your device, Apple also stores this data in the private database of your own iCloud account (Apple CloudKit), so that it is the same on your iPhone, your iPad and a new iPhone. This database belongs to your Apple Account: we have no access to it and never receive this data. Apple processes it under your agreement with Apple and Apple’s privacy policy.
Your settings and the counts of your free trainings and card scans are also kept in iCloud’s key-value store and in the Keychain on your device, so that they stay the same after a new installation and on your other devices. These counts contain nothing else about you.
Without iCloud, everything stays on the device. You can see, change and delete your data in the app at any time.
4. Apple Health
Only if you switch on “Save workouts to Health” (Settings › Data and Backup) and allow it in the dialog of iOS, Kraftsam writes each finished training to Apple Health as a strength training workout with its start and end time. A training on the Apple Watch also adds the heart rate and calories that the Watch measures during its workout session.
Kraftsam reads no health data. Health data never leaves your device through Kraftsam; we receive none of it. You can withdraw the permission at any time in the Health app under your profile › Apps › Kraftsam.
5. Apple Watch and iPhone
Your plans, weights and settings go from the iPhone to the Apple Watch, and trainings from the Watch back to the iPhone. They are sent directly between your devices with Apple’s WatchConnectivity, not through us.
6. Backups and the import from KBuddy
Backups: with “Save backup” (Settings › Data and Backup) Kraftsam writes your plans, exercises, trainings and settings into a file (JSON) and saves it where you choose in the Files app, for example in iCloud Drive. You decide where the file goes and who gets it. “Restore backup” reads such a file on your device.
Import from KBuddy: “Import from KBuddy” reads a KBuddy backup file that you pick, on your device only. Nothing from it is sent anywhere.
7. Reading a training card
With “Scan Training Card” you can photograph your Kieser training card, and Kraftsam turns it into a plan. This is optional. The photo is sent to be read only after you have agreed to it in the app, before your first scan.
What is sent: the photo of the card, reduced to at most 2048 pixels on its long side and without the photo’s metadata (such as its location or time). The card can show your name, your training plan and handwriting. With it, the app sends a random installation ID, which it keeps on your device and which is not linked to you or synced, and an App Check token (below).
How it is read: the photo goes over an encrypted connection (HTTPS) to Kraftsam’s server function on Google Firebase (Google Cloud Functions) in Frankfurt, Germany (region europe-west3). The function passes it to the API of OpenAI, L.L.C., USA, which reads the exercises and their settings from it, and sends the result back to the app. You then check every line before a plan is made.
What is kept: our server stores neither the photo nor the result. According to OpenAI’s terms for its API, OpenAI does not use the data to train its models, and keeps it for up to 30 days to detect abuse, then deletes it. In Google Cloud Firestore we store only counts of scans per day: one for all installations together and one per random installation ID, to keep within the daily limits. Google Cloud keeps logs of the requests, including the IP address, for up to 30 days.
Proof that it is the app: Firebase App Check by Google, with Apple’s App Attest, confirms to our server that a request comes from the real Kraftsam app on a real Apple device. For this, your device creates a key with Apple, and the app sends a token that our server checks. The token contains nothing about you.
If our server cannot be reached, your iPhone reads the card itself, on the device. Then nothing is sent.
Legal basis: your consent (Art. 6(1)(a) GDPR), and, to the extent the card counts as health data, your explicit consent (Art. 9(2)(a) GDPR). Keeping the installation ID on your device is strictly necessary for the scan you ask for (§ 25(2) no. 2 TDDDG). You can withdraw your consent at any time in Settings › Privacy by switching off “Read Training Cards with AI”; the next scan then asks again. Withdrawing does not affect processing that took place before. Without your consent you can still make every plan by hand.
OpenAI processes the photo in the USA. The transfer is based on the EU-US Data Privacy Framework and the EU standard contractual clauses (see section 12).
8. Camera and photos
Kraftsam uses the camera only to photograph a training card, and only once you open the camera for it. If you pick a photo you took earlier, the photo picker of iOS runs outside the app: Kraftsam gets only the photo you pick, not your other photos. You can withdraw access to the camera at any time in the Settings app of your iPhone or iPad.
9. Purchases
Your first 5 trainings are free. Purchases of Kraftsam (a subscription or a one-time purchase) are handled entirely by Apple through the App Store. We receive no payment data. Apple’s privacy policy applies to the payment.
To check whether Kraftsam is unlocked on your devices, we use RevenueCat (RevenueCat, Inc., USA). RevenueCat receives an anonymous app user ID, without your name or email address, and the App Store’s data on your purchase (product, dates, status), together with technical data the app sends with it, such as the app version, the device type and the App Store’s country. It never receives your plans or trainings. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).
10. Contacting us
If you email us, we process your message and your email address to answer you (Art. 6(1)(b) or (f) GDPR). Mail to our address is forwarded to our inbox by Cloudflare Email Routing (Cloudflare, Inc., USA). We delete the conversation when it is no longer needed, unless we are required by law to keep it.
11. Service providers
We use the following processors. Each is bound by a data processing agreement under Art. 28 GDPR:
- Google Ireland Limited (Firebase: Cloud Functions, Cloud Firestore, App Check, Cloud Logging), Ireland, with Google LLC, USA, as sub-processor: reading a training card;
- OpenAI, L.L.C., USA: reading a training card, only after your consent;
- RevenueCat, Inc., USA: checking purchases;
- Cloudflare, Inc., USA: hosting this website and forwarding email.
Apple provides iCloud, Apple Health, the App Store and App Attest under your own agreement with Apple. We do not pass your data to anyone else unless we are required to by law.
12. Transfers outside the EU
Google, OpenAI, RevenueCat and Cloudflare may process data in the United States. Transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it, and in addition on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
13. Retention and deletion
- Plans and trainings stay on your device and in your iCloud until you delete them in the app. Deleting the app removes the data on that device; data in iCloud can be deleted in the iCloud settings of your device, under the storage used by Kraftsam.
- Photos of training cards are not stored by us. OpenAI deletes them after at most 30 days. Google Cloud’s request logs are deleted after at most 30 days.
- Scan counts for all installations together are kept as statistics without any personal reference. The counts per installation ID are deleted after 30 days.
- Purchase data at RevenueCat is kept for as long as it is needed to provide your purchase, and for the periods required by law.
- Emails are deleted when they are no longer needed, unless the law requires us to keep them.
14. Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR),
- have incorrect data corrected (Art. 16 GDPR),
- have your data deleted (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- receive your data in a common, machine-readable format (Art. 20 GDPR),
- withdraw your consent at any time with effect for the future (Art. 7(3) GDPR),
- object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR).
To use these rights, write to hello@73apps.com. As Kraftsam has no accounts, we often cannot tell which data belongs to you (Art. 11 GDPR). Your plans and trainings you can see, export and delete yourself in the app.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)Kavalleriestraße 2–4
40213 Düsseldorf
Germany
www.ldi.nrw.de
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. You are not required to provide personal data: Kraftsam works without it, and reading a training card is optional.
15. Security
All connections between the app and our server are encrypted (TLS). Our server answers only the real app (App Check), and the scan counts in the database can be read only by our server, not by the app or anyone else. Your data in iCloud is protected by Apple.
16. Changes
We will update this policy when Kraftsam or the law changes. The current version is always available on this page.