Privacy Policy

Dor Pinhas, trading as forconn.ai, a sole trader based in Israel. That trader is the data controller. Contact us about anything in this policy at dor.fitness.training@gmail.com.

We do not have a Data Protection Officer; we are not required to appoint one. Requests go to the address above and are handled by us directly.

• Account details. Your email address, your name and account identifier from Google when you sign in, and your time zone, read from your browser so dates are shown in your own time. We do not receive or store your Google password.
• Purchase records. What you bought, when, currency, amount, subscription status, and renewal dates. We never see or store your card details or billing address — those go to Paddle.com Market Ltd, who takes the payment.
• Your training. When you start a workout signed in, we save when you started and last moved, the time zone your device reported or, if it sent none, your account's (so we know the time of day it was for you), the program and day you opened it from, if any, how far you got, any change you make to the number of rounds, and whether you finished. As you move through it, each set is recorded as done, with the movement, when, and the reps or seconds the workout showed you. After a round or two and at the end of a workout we ask how hard it was. On your profile you can choose to be asked only at the end, or after every round too. We keep your choice, each answer you give or take back with the workout or round it is about, and which rounds we asked about. Your answers are shown in your own training history, and they help decide which programs and workouts we suggest first; they never lock or unlock anything. From your setup answers, your answers about how hard workouts and rounds were, and the sets you had already done in that workout when you answered, we estimate how much challenge each muscle group is ready for, and keep that estimate, for every member, to help decide which programs and workouts we suggest first — never what you can open. Start a program and we keep which program and which day of it you are on. All of this is deleted with your account. Your browser also keeps your place in a workout, on your device, so you can pick it up again.
• Your equipment and training profile. If you fill in the setup questions, we store your answers against your account — your age band (never your date of birth), your training goals, whether you train with a kettlebell, your own bodyweight or both, whether you have bars to train on (always or sometimes) and which kinds you can use, which kettlebells you own, how experienced you are with a kettlebell and with your own bodyweight, how often you train now and want to train, and how much time you have for a workout. They decide which programs and workouts the app shows you, and which first, and they are deleted with your account. A question you leave unanswered stores nothing; if you skip the whole thing, we record only that you skipped. The second set of questions adds which kettlebells you own and how each one feels to you, what you can do on a few movements, and what you'd like to focus on. There is one free-text box — anything you'd like to be able to do, in your own words: we store exactly what you type, nothing in the app uses it, your profile shows it back to you so you can change it or clear it, and it is deleted with your account like the rest. Please don't put health or medical details in it.
• Which public pages get opened. When you open one of our public pages we record the page, the referring site (its address only, never the page you were on), and any ?ref=tag we put in a link we posted — so we can tell whether anyone is actually arriving. We also record the kind of device (phone, tablet or computer), your screen size rounded down to the nearest 100 pixels, and which page on this site you came from; we do not store your browser's user-agent string. This is our own record, and it sets nothing on your device. Your dashboard, your profile, checkout and your account are excluded outright. It carries no name or email; if you are signed in it is stored against your account, and deleting your account detaches it — what is left describes a page, not a person. When you start a workout signed in, your progress — which workout and how far you got — is saved to your account so your dashboard can show it. Start a program and we keep the same kind of record — which program, and which day of it you are on. Both are deleted with your account.
• Pages you open while signed in. When you are signed in, we also record which pages of the library you open — exercises, workouts and programs — with the same details as above, against your account, and when you open the checkout, which price you opened it for. We use it to see what people look for. Deleting your account removes the link to you.
• Emails you send us. If you reply to one of our emails or write to dor.fitness.training@gmail.com, we store the message so we can answer it.
• Technical data. Standard server logs from our hosting, database and video providers. They include your IP address, approximate location (country, city and postal code), browser, the address requested, the time and technical details of the connection. Our database provider's logs also carry your account ID on requests made while you are signed in, and your email address when you sign in.

We do not ask for your weight, measurements, injuries, or medical history. We do not want them and we do not store them. The only weight we record is the kettlebell's, not yours. Please do not send us medical information by email.

For anyone in the EU or UK, these are our legal bases under the GDPR and UK GDPR:

• Performance of a contract. Running your account — free or paid — delivering the content you have access to, keeping your training record, and handling billing status.
• Legitimate interests. Keeping the service secure, preventing abuse, understanding which pages people arrive at and what they look for in the library, and answering your messages. We use the least data that achieves this.
• Legal obligation. Keeping records we are required to keep, including for tax.
• Consent. Only where we ask for it explicitly — analytics cookies, and any future marketing email unrelated to your subscription. You can withdraw consent at any time, from the cookie settings link in the footer or by emailing us, and it is as easy to withdraw as it was to give.

We do not sell your data and we do not share it for advertising. We use these providers to run the service, each bound to process data only on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — website hosting and server logs.
• Paddle.com Market Ltd — payments, invoicing, and tax. They are the seller of record and an independent controller of the payment data you give them.
• Cloudflare — domain, network security, receiving email sent to us, and delivering the videos on our home page and the exercise how-to videos. When the home page plays its video, or you open an exercise that has a how-to video, your browser loads it straight from Cloudflare, which sees your IP address, your browser and the time of the request. The video link carries nothing about your account.
• Google— sign-in, and the mailbox our emails go out from and your replies arrive in. Google tells us your email, name, and account ID; what Google does with your use of its own account is governed by Google's privacy policy.
• Google Analytics — website analytics, only if you accept analytics cookies. It tells us how many people reach the site, where they arrived from, and which pages get read. We do not send it your name, your email, or anything you type, and we do not use it for advertising. If you decline, it is never loaded at all. Data is processed by Google in the United States under Standard Contractual Clauses and Google's EU–US Data Privacy Framework certification.

We may also disclose data where the law requires it, or to establish or defend legal claims.

We are based in Israel and our providers operate internationally, so your data is transferred outside the EU and UK.

Israel holds an adequacy decision from the European Commission, which permits transfers from the EU without additional safeguards. For transfers to providers elsewhere, we rely on Standard Contractual Clauses or an equivalent approved mechanism in our agreements with them.

• Account and training history — while your account exists, and deleted with it (ask us under section 7).
• Purchase and tax records — up to seven years after the transaction, because tax law requires it. This survives account deletion; we keep only what the obligation covers.
• Emails you send us — up to two years after the conversation ends.
• Server logs— our hosting provider keeps its logs for about an hour. Our database provider's logs have no end date in practice: they can be kept for as long as our service runs on it, and are deleted within 30 days of our contract with it ending. Deleting your account does not remove them.
• Video delivery logs — Cloudflare keeps the request logs, including your IP address, only as long as it needs them to deliver the videos and keep them secure, and no longer than our contract with Cloudflare lasts.
• Analytics — 14 months in Google Analytics, then deleted automatically. Only collected if you accepted analytics cookies, and it does not carry your name or email.
• Our own record of which pages get opened — 24 months, then deleted. The link to your account is removed as soon as the account is deleted, which leaves a row that is about a page rather than a person.
• Pages you open while signed in — 24 months, then deleted; the link to your account goes when the account does.

Wherever you live, you can exercise these by emailing dor.fitness.training@gmail.com. We respond within 30 days and do not charge for it.

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your account and data deleted, except records we must keep by law, and the server and video delivery logs described in section 6.
• Portability — receive your data in a machine-readable format.
• Restriction and objection — ask us to pause or stop a particular use, including anything based on legitimate interests.
• Withdraw consent — where we relied on consent, at any time, without affecting what came before.

If you are in the EU or UK you may also complain to your national data protection authority — the ICO in the UK — and in Israel to the Privacy Protection Authority. We would rather you told us first, but you do not have to.

Strictly necessary cookies keep you signed in and protect the site. They are required for the service to work, so they are always on and there is nothing to opt out of beyond signing out or blocking cookies in your browser. We do not ask for consent for these, because the law does not require it and the site cannot run without them.

Analytics cookies are set by Google Analytics and are entirely optional. They tell us how many people reach the site, where they came from, and which pages get read — so we can tell whether any of this is reaching anyone. We ask you first: nothing analytics-related loads until you choose, and declining is one click, in the same place, styled the same way as accepting. Declining costs you nothing — every page works identically either way, and we will not ask again on every visit.

You can change your mind whenever you like from the Cookie settings link in the footer. Withdrawing is exactly as easy as consenting was, and it takes effect immediately.

We do not use advertising cookies, we do not run third-party tracking pixels, and we do not sell or share what analytics collects. If that ever changes we will ask for your consent first and update this policy.

This service is for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

Access is protected by Google sign-in — we never handle a password. Data is encrypted in transit and at rest by our providers, and access to the production database is limited to the operator of this site. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as the law requires.

The version in force is the one on this page, and the date at the top is the date it took effect.

If we start using your information for something new, we will say so here, and bring it to your attention in the app, before we start. Where the law requires your consent, we will ask for it first.

A change to how we use your information is shown to you on its own the next time you sign in, not folded into anything else.