docs/PRIVACY_POLICY.md
Rama main · réplica de lectura del repositorio original.
# Privacy Policy
**Effective Date:** December 2025
**Last Updated:** December 2025
**Application:** ActaLog - Workout Tracking Application
---
## 1. Introduction
ActaLog ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our workout tracking application.
Please read this Privacy Policy carefully. By using ActaLog, you agree to the collection and use of information in accordance with this policy.
---
## 2. Information We Collect
### 2.1 Information You Provide
**Account Information:**
| Data | Purpose | Required |
|------|---------|----------|
| Email address | Account identification, communications | Yes |
| Password | Authentication (stored securely hashed) | Yes |
| Name | Display name in the application | Yes |
| Birthday | Age-related features (optional) | No |
| Profile image | Personalization | No |
**Workout Data:**
- Workout logs and history
- Exercise movements and personal records
- Workout templates you create
- Performance metrics and progress data
**User-Generated Content:**
- Notes and comments on workouts
- Custom workout templates
- Custom movement definitions
### 2.2 Information Collected Automatically
**Technical Data:**
| Data | Purpose | Retention |
|------|---------|-----------|
| IP address | Security, abuse prevention | With audit logs |
| Browser/device type | Compatibility, debugging | With audit logs |
| Login timestamps | Security monitoring | With audit logs |
**Security-Related Data:**
- Failed login attempts (for account protection)
- Session information
- Account lock events
### 2.3 Information We Do NOT Collect
- Location data
- Contacts or address book
- Health data from device sensors
- Payment or financial information
- Social media profiles
- Advertising identifiers
---
## 3. How We Use Your Information
### 3.1 Primary Purposes
| Purpose | Legal Basis (GDPR) |
|---------|-------------------|
| Provide the workout tracking service | Contract performance |
| Authenticate your identity | Contract performance |
| Send account-related emails (verification, password reset) | Contract performance |
| Protect against unauthorized access | Legitimate interest |
| Maintain audit logs for security | Legitimate interest |
| Improve application functionality | Legitimate interest |
### 3.2 We Do NOT Use Your Data For
- Advertising or marketing (unless you opt-in)
- Selling to third parties
- Profiling for automated decision-making
- Training AI/ML models
- Sharing with social networks
---
## 4. Data Sharing and Disclosure
### 4.1 Third-Party Service Providers
We use minimal third-party services:
| Service | Purpose | Data Shared |
|---------|---------|-------------|
| Email provider (SMTP) | Sending verification/reset emails | Email address only |
| Hosting provider | Application infrastructure | All data (encrypted) |
### 4.2 We Do NOT Share Data With
- Advertising networks
- Analytics providers
- Data brokers
- Social media platforms
- Marketing companies
### 4.3 Legal Disclosure
We may disclose your information if required by law, such as:
- To comply with legal obligations
- To respond to lawful requests from public authorities
- To protect our rights, privacy, safety, or property
---
## 5. Data Security
### 5.1 Security Measures
We implement industry-standard security measures:
| Measure | Implementation |
|---------|----------------|
| Password hashing | bcrypt with cost factor 12 |
| Transport encryption | HTTPS/TLS required |
| SQL injection prevention | Parameterized queries only |
| Session security | JWT tokens with expiration |
| Account lockout | Automatic after failed login attempts |
| Audit logging | All security events logged |
### 5.2 Your Responsibilities
- Use a strong, unique password
- Keep your login credentials confidential
- Log out from shared devices
- Report suspicious activity immediately
---
## 6. Data Retention
### 6.1 Retention Periods
| Data Type | Retention Period |
|-----------|------------------|
| Account information | Until account deletion |
| Workout data | Until account deletion |
| Audit logs | 12 months |
| Password reset tokens | 1 hour (then deleted) |
| Email verification tokens | 24 hours (then deleted) |
| Expired session tokens | 30 days after expiry |
### 6.2 After Account Deletion
When you delete your account:
- Personal data is permanently removed
- Workout history is permanently deleted
- Audit logs may be retained in anonymized form
- Backups are purged according to backup retention schedule
---
## 7. Your Rights
### 7.1 Rights Under GDPR (EU Users)
You have the following rights:
| Right | Description | How to Exercise |
|-------|-------------|-----------------|
| **Access** | Obtain a copy of your personal data | Export feature or contact us |
| **Rectification** | Correct inaccurate data | Edit profile in app |
| **Erasure** | Delete your personal data | Contact administrator |
| **Restriction** | Limit how we process your data | Contact us |
| **Portability** | Receive data in portable format | Export feature (JSON/CSV) |
| **Objection** | Object to processing | Contact us |
| **Withdraw Consent** | Withdraw previously given consent | Contact us |
### 7.2 Rights Under CCPA (California Users)
California residents have additional rights:
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of sale (we do not sell data)
- Right to non-discrimination for exercising rights
### 7.3 Exercising Your Rights
To exercise any of these rights:
1. Use the in-app export feature for data access/portability
2. Edit your profile for rectification
3. Contact the administrator for deletion or other requests
We will respond to requests within 30 days.
---
## 8. Data Export
### 8.1 Available Exports
You can export your data at any time:
| Data | Format | Location |
|------|--------|----------|
| Workout history | JSON, CSV | Settings > Export |
| Movement library | JSON, CSV | Settings > Export |
| WOD library | JSON, CSV | Settings > Export |
### 8.2 Comprehensive Export
For a complete export of all your personal data (GDPR Article 15 request), contact the administrator.
---
## 9. Cookies and Local Storage
### 9.1 What We Use
| Technology | Purpose | Duration |
|------------|---------|----------|
| Local Storage | Authentication token | Until logout |
| Local Storage | User preferences | Persistent |
### 9.2 What We Do NOT Use
- Tracking cookies
- Third-party cookies
- Advertising cookies
- Analytics cookies
---
## 10. Children's Privacy
ActaLog is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
---
## 11. International Data Transfers
If you access ActaLog from outside the country where our servers are located, your data may be transferred internationally. We ensure appropriate safeguards are in place:
- Standard Contractual Clauses (where applicable)
- Encryption in transit and at rest
- Access controls and security measures
---
## 12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Last Updated" date. For significant changes, we will notify you via:
- Email notification
- In-app notification
- Prominent notice on the application
Your continued use of ActaLog after changes constitutes acceptance of the updated policy.
---
## 13. Data Controller
For GDPR purposes, the data controller is:
**ActaLog**
Contact: [Administrator Email]
GitHub: https://github.com/johnzastrow/actalog
---
## 14. Contact Us
For privacy-related inquiries or to exercise your rights:
**Email:** [Contact Email]
**GitHub Issues:** https://github.com/johnzastrow/actalog/issues
When contacting us, please include:
- Your account email address
- Description of your request
- Any relevant details
We aim to respond within 30 days.
---
## 15. Complaints
If you believe your privacy rights have been violated, you have the right to lodge a complaint with:
**EU Users:** Your local Data Protection Authority
**UK Users:** Information Commissioner's Office (ICO)
**US Users:** Federal Trade Commission (FTC)
---
## Summary
| What We Do | What We Don't Do |
|------------|------------------|
| Collect only necessary data | Sell your data |
| Encrypt your password | Share with advertisers |
| Allow data export | Track your browsing |
| Delete data on request | Use data for marketing |
| Log security events | Profile you for ads |
| Protect your privacy | Retain data indefinitely |
---
*This Privacy Policy is provided in Markdown format for transparency. A formatted version is available in the application.*