Privacy Policy for GoStrong
Last updated: October 2026
-
Controller
The controller responsible for the processing of personal data in connection with the GoStrong app is:
Peakbrain e.U.
Owner: Manfred Schmid
Kaposigasse 86/5
1220 Vienna
Austria
Email: contact@gostrong-health.com
-
General Information
Protecting your personal data is important to us.
GoStrong processes personal data only where necessary to operate the app, provide its functions, perform contractual obligations, comply with legal obligations, or on the basis of your consent.
This Privacy Policy explains which personal data may be processed when using GoStrong, the purposes of such processing, the applicable legal bases, and the rights available to you.
The relevant legal framework includes, in particular, the EU General Data Protection Regulation (GDPR).
-
Registration and User Account
Certain functions of GoStrong may require the creation of a user account.
The following data may be processed in this context:
• Name
• Email address
• Authentication and login data
• Technical user identifier
• Account status information
Where such processing is necessary to provide your account and the GoStrong service, the legal basis is Article 6(1)(b) GDPR, performance of a contract or steps taken prior to entering into a contract.
Passwords are not stored in plain text and are protected using appropriate technical measures.
-
Sign in with Apple
GoStrong supports Sign in with Apple.
Apple may provide GoStrong with the information required for the authentication process and information released by the user. This may include an Apple-provided user identifier and an email address.
Apple may process personal data independently in connection with Sign in with Apple. Such processing is governed by Apple’s own privacy policies.
GoStrong does not receive payment card or banking details through Sign in with Apple.
-
Profile and Training Data
To create and adapt training content, GoStrong processes information provided by users in connection with their use of the app.
This may include:
• Age
• Gender
• Height
• Weight
• Training level
• Sports
• Training goals
• Training preferences
• Completed workouts
• Training history
• Training volume
• Preferred workout duration, intensity or focus
• Free-text input
These data are used to provide the functions of GoStrong and to tailor training content to the user’s requirements.
Processing is generally based on Article 6(1)(b) GDPR where necessary to provide the functions requested by the user.
GoStrong is not a medical application and is not intended to provide medical diagnosis or medical treatment.
If users voluntarily enter information in free-text fields that may contain health-related or other sensitive personal data, such information is processed only in connection with the functionality requested by the user.
Users should not provide medical information that is not necessary for the use of GoStrong.
-
AI-Assisted Generation of Training Content
GoStrong uses services provided by OpenAI to generate certain training content.
No personal data relating to the user is transmitted to OpenAI.
Before an AI request is made, GoStrong creates an abstract Workout Specification within its own systems.
A Workout Specification may include information such as:
• Workout duration
• Training level
• Workout focus
• Intensity
• Type of workout
• Weighting of particular muscle groups
• Workout structure
• Other technical workout requirements
The Workout Specification describes the requested workout and does not identify a particular individual.
In particular, GoStrong does not transmit the following information to OpenAI:
• Name
• Email address
• User identifier
• Contact details
• Authentication information
• Other directly identifying information
The same Workout Specification may apply to multiple users.
If a suitable workout already exists in GoStrong for a particular Workout Specification, that existing workout may be reused.
Only where no suitable workout exists may the abstract Workout Specification be sent to OpenAI in order to generate a new workout.
A workout created in this way is therefore not necessarily linked exclusively to a particular user and may also be made available to other users with comparable training requirements.
If this technical architecture changes in the future and personal data are transmitted to an AI service, this Privacy Policy will be updated accordingly.
-
Hosting and Technical Infrastructure
GoStrong uses infrastructure provided in particular by:
• OVH, with server locations in France
• Amazon Web Services (AWS), including server locations in Frankfurt, Germany
Databases used for GoStrong are hosted within the European Union.
These providers may act as processors in connection with hosting and technical infrastructure services.
Processing is carried out in order to provide a stable, secure and efficient service.
Where necessary for the performance of the service, the legal basis is Article 6(1)(b) GDPR.
Where processing serves system security and operational reliability, the legal basis is our legitimate interest under Article 6(1)(f) GDPR.
-
Technical Server and Log Data
When GoStrong is accessed, technically necessary information may be processed, including:
• IP address
• Date and time of access
• Technical request information
• Server and error logs
• Operating system and app version
• Technical device information where required for operation or troubleshooting
These data may be used for:
• Technical delivery of the app
• System security
• Error analysis
• Prevention of misuse and attacks
The legal basis is our legitimate interest in operating a secure and reliable service pursuant to Article 6(1)(f) GDPR.
-
Analytics, Advertising Tracking and Profiling
GoStrong currently does not use external analytics or crash-reporting services such as Google Analytics, Firebase Analytics or Sentry.
GoStrong currently also does not use:
• Advertising tracking
• IDFA-based advertising
• Cross-app tracking
• Advertising tracking pixels within the app
GoStrong currently does not conduct automated profiling for advertising purposes.
If such services are introduced in the future, this Privacy Policy will be updated before their use and, where required, consent will be obtained.
-
Subscriptions and Payments through Apple
Paid subscriptions in the iOS app are processed through Apple In-App Purchase.
Payment processing itself is carried out by Apple.
GoStrong generally does not receive full payment information such as credit card or bank account details.
GoStrong may receive information relating to subscription status, including:
• Whether a subscription is active
• Which product or subscription was purchased
• Subscription term or renewal status
• Technical transaction or purchase identifiers
This information is used to determine which paid features are available to a user.
The legal basis is Article 6(1)(b) GDPR, performance of the contract.
Apple processes payment and App Store information under its own responsibility and in accordance with its own privacy policies.
-
Newsletter
Where users expressly consent to receiving a newsletter or similar marketing communications, GoStrong may use the email address provided to send information about GoStrong, new features, training products or other relevant content.
The legal basis is your consent under Article 6(1)(a) GDPR.
Consent may be withdrawn at any time with effect for the future, for example through an unsubscribe link contained in the newsletter or by emailing:
Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
Subscription to the newsletter is voluntary and is not required in order to use GoStrong.
If an external newsletter service provider is used in the future, this section will be updated accordingly.
-
No Sale of Personal Data
GoStrong does not sell personal data.
Personal data are disclosed to third parties only where:
• Required to provide the service
• A processor is used
• You have consented
• Disclosure is required by law
• Disclosure is necessary for the establishment, exercise or defence of legal claims
-
Retention Period
Personal data are retained only for as long as required for the respective purpose.
Data associated with an active user account are retained for as long as the account exists and the data are required to provide GoStrong.
Data may be retained for longer where statutory retention periods or other legal obligations apply.
Where the purpose and legal basis for processing no longer apply and no statutory retention obligation exists, personal data will be deleted or irreversibly anonymised.
-
Account Deletion
Users can delete their user account from within the app.
When an account is deleted, personal account data and personal profile and training data will be deleted or irreversibly anonymised.
In particular, the user’s email address will be removed or anonymised so that it can no longer be associated with an identifiable individual.
Data may be retained after account deletion only where required by law or where the information has been fully and irreversibly anonymised.
Anonymised information that no longer relates to an identified or identifiable individual may continue to be used for statistical, technical or product-related purposes.
-
Data Security
GoStrong uses appropriate technical and organisational measures to protect personal data against:
• Loss
• Unauthorised access
• Alteration
• Disclosure
• Misuse
Security measures are adapted as appropriate to technological developments and the risks associated with the relevant processing.
-
Your Rights
Subject to the requirements of the GDPR, you may have the following rights:
• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to certain processing
• Right to withdraw consent at any time with effect for the future
Requests may be sent to:
-
Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
The competent Austrian authority is:
Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
-
Changes to this Privacy Policy
GoStrong may update this Privacy Policy where its functions, technical systems, service providers or legal requirements change.
The version published at the time of use applies.