Privacy Policy

Who is responsible for your information

The data controller is Idan Hakak, Osek Patur (tax-exempt trader), number 328488077. We determine the purposes and means of processing the personal information you provide to us.

Contact: idanidtrainer@gmail.com

Information we collect and why

The information we process is grouped into categories, each with its own purpose and legal basis:

• Account and profile information (name, email, age, weight, height, gender) — to create your account, provide the service and tailor plans. Basis: performance of our contract with you.
• Workout plans and exercise progress — to save your history, display charts and let you resume where you left off. Basis: performance of contract and legitimate interests.
• Technical information (IP address, browser type, device identifier) — for account security, fraud prevention and service improvement. Basis: legitimate interests and legal obligations.
• Support correspondence — to handle your requests and improve the service. Basis: performance of contract and legitimate interests.

Which privacy laws may apply

Israel's Privacy Protection Law, including Amendment 13 effective from August 2025, applies to the owner's activities in Israel and databases under the owner's control. It requires clear notice, lawful and defined purposes, security, and responses to access and correction rights.

The GDPR may apply when the service is offered to people in the European Union or monitors their behaviour there. Because the site is open globally, we apply transparency, data minimisation and user-rights principles to requests from Europe.

The CCPA applies only to businesses meeting its statutory thresholds. The owner does not currently state that those thresholds are met; nevertheless, California access, correction and deletion requests will be handled under this policy, and personal information will not be sold or shared for behavioural advertising without an explicit choice.

Legal basis for processing

We process personal information only where we have a valid legal basis: performance of our contract with you (operating your account, membership and service); legitimate interests (security, fraud prevention, service improvement and support); your consent where required; and legal obligations that apply to us (accounting, tax and regulatory reporting).

Who your information is shared with

We do not sell personal information. Your information is shared with third parties only in the limited circumstances described below, and only to the extent necessary:

• Infrastructure providers: hosting, database and authentication services (including Google when you choose social sign-in).
• Paddle.com — our reseller (Merchant of Record) — receives and processes purchase, payment, subscription management, invoicing and tax compliance details. Paddle acts as an independent third party under its own privacy policy and terms.
• YouTube — exercise videos use privacy-enhanced embeds. The player loads only after you open a video, at which point YouTube may receive technical data under its own privacy terms.
• Professional advisers (accountants, lawyers) and competent authorities, where required by law.

Data retention

Account and training information is kept while your account is active. After account closure, we delete or anonymise the information within 12 months unless we are required to keep it for legal purposes.

Membership and payment records are kept as required by law (for example tax and accounting obligations) for up to 7 years, and are deleted or anonymised when no longer needed.

Security

We apply appropriate technical and organisational measures to protect your personal information, including: encrypted transport using TLS, secure sign-in, role-based access controls, database-level data isolation, and secure backup routines.

No security system is perfect. If we become aware of a breach that may affect your information, we will notify you in accordance with applicable law.

International transfers

Some of our service providers, including Paddle, may process information in countries outside Israel. When information is transferred outside Israel, we take reasonable steps to ensure it is protected, including appropriate data transfer agreements or adequacy findings.

Your rights

You have the right to access the personal information we hold about you, to correct it, to request deletion or restriction of processing, to receive a copy of the information, and to object to processing based on legitimate interests. We will respond to requests within a reasonable time, usually within one month.

For access, correction or deletion requests, contact idanidtrainer@gmail.com.

Cookies and local storage

Idan iD uses storage required for sign-in, security, language, settings, plans and progress. Analytics or advertising tools are not currently loaded; if added, they will run only after an explicit choice through the privacy notice.

If you choose Google sign-in, Google processes the sign-in request under its own privacy terms.

Changes to this policy

This page will be updated when the service, its providers or its data practices change. Material changes will be posted here and take effect upon posting.