Last updated: October 7, 2026
This policy explains which personal data we process when you use the "Based!" app and the website basedworkouts.com: for what purpose, on what legal basis, for how long and who receives it – and what rights you have.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Time Horizon Digital
Owner: Karl Kuhne
Tieckstr. 11
01099 Dresden
Germany
info@basedworkouts.com
For your account we process your email address, your password (only as a hash), your display name, your app language and whether you have confirmed your email address. We also store which version of the Terms of Use you agreed to and when.
Purpose and legal basis: account and login – Art. 6(1)(b) GDPR (contract); proof of your agreement – Art. 6(1)(f) GDPR (our legitimate interest in being able to prove the conclusion of the contract).
Retention: until your account is deleted.
We cannot create an account without an email address, password and display name. All other information in Based! is voluntary.
We process what you create in Based!: routines, training plans, custom exercises and their photos, workout logs (sets, reps, weights), notes and your height. We store this data on our server, synchronize it between your devices and back it up.
Photos of custom exercises can be retrieved without logging in via an address that cannot be guessed. Friends you share a routine with receive this address, and so does anyone for published routines (Section 5).
Notes are free text. You may voluntarily include information about your health in them, for example about injuries. We do not evaluate notes or use them for analytics.
Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the data or your account.
Your body weight is health data, because together with your height (as BMI) it allows conclusions about your health. Without your consent it stays on your device only; we do not receive it. It only reaches our server if you have given your explicit consent: during setup via a checkbox on the "Body Weight" page, or later in Settings.
With consent we synchronize your weight between your devices and back it up. The app calculates the BMI on your device. Friends and other users cannot see your weight. We do not use it for analytics or advertising and only pass it on to the service providers that run our server and our backups (Section 11). There is no connection to Apple Health.
Legal basis: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. It is voluntary; without it, weight history and BMI stay on your device.
Withdrawal: at any time with effect for the future, in the app under Settings → "Sync Body Weight" or by email. We then delete your weight entries from our server; your devices keep them. They remain in backups until those expire (Section 12).
Older entries: Entries that reached our server without consent before this rule can be deleted in the app at any time.
Legal basis: Art. 6(1)(b) GDPR; for the email addresses of invited persons and finding friends by email address, Art. 6(1)(f) GDPR (our and your legitimate interest in users being able to find and invite each other). Retention: until you delete the content, the friendship or your account.
You buy Based Pro in the App Store. Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, acts as an independent controller for this; Apple's Privacy Policy applies. We do not receive any payment or card data.
We use RevenueCat, Inc. (USA) as a processor to manage purchases. For this, the app reports your account ID to RevenueCat when you log in – even if you do not buy anything – and our server regularly checks there whether Based Pro is active for your account. RevenueCat processes your account ID, App Store receipts and purchase history (product, price, currency, country, transaction numbers), device and operating system information, your IP address for technical reasons, and when you open the purchase screen. RevenueCat does not receive names or email addresses. We ourselves only store whether Based Pro is active for your account.
After a number of workouts, the app may show Apple's rating dialog. You submit a rating directly to Apple; we do not learn whether or how you rate the app.
Legal basis: Art. 6(1)(b) GDPR. Retention: until your account is deleted; we then also delete your record at RevenueCat.
After you sign up, the app asks whether you allow usage analytics. If you consent there or later in Settings, we use PostHog to record how the app is used, in order to detect errors and improve Based!:
The data is linked to your account ID, not to your name or email address; PostHog does not store your IP address. We do not record the names of your routines, exercises and notes, your body weight, your height, or your training values such as weights, reps or workout duration. Before you decide, the app records and sends nothing to PostHog.
Legal basis: your consent (Section 25(1) of the German TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time in the app under Settings → "Share Usage Analytics"; the app then sends nothing more and deletes its analytics identifier on your device. We never use the data for advertising and never sell it.
Provider: PostHog, Inc. (USA) as processor; the data is stored in Frankfurt am Main, Germany. Retention: twelve months at most; if you delete your account, we also delete your data at PostHog.
When you visit our website and with every request the app sends to our server, we process – as technically necessary – your IP address, date and time, the requested address, the status code and information about your browser or app. Our web server stores this access data in log files. For error analysis, our server also logs requests and errors with your account ID, without your IP address. We delete both logs after 14 days.
To protect against abuse, we limit the number of requests per IP address, and per email address when resetting a password. For this, we do not store the address itself but only a hash, which we delete after 48 hours at the latest.
Legal basis: our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
Hosting: Our server is located in a Hetzner Online GmbH data center in Nuremberg; the data stays in Germany.
For emails confirming your email address, changing your email address and resetting your password, we use Resend (Plus Five Five, Inc., USA) as a processor. This involves your email address, your display name, the content of the email including the confirmation link, and sending and delivery data. If you change your email address, we also notify your previous address and mention the new one in that email. We do not track opens or clicks. We do not send newsletters.
Legal basis: Art. 6(1)(b) GDPR; for notifying your previous address, Art. 6(1)(f) GDPR (protecting your account against takeover).
The app stores your data in a database on your device so that it works offline, keeps login keys in the protected keychain and remembers your consent decisions. This is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG). When you delete your account, the app removes this data.
On basedworkouts.com we only set a cookie named locale if you actively pick a
language with the language switcher. It contains nothing but the language code, expires after one year
and is not used for tracking (Section 25(2) no. 2 TDDDG). The website does not load content from third
parties; fonts are hosted on our own server.
We do not sell data or pass it on for advertising purposes. These recipients receive data from us:
The adequacy decision on the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) is published in the Official Journal of the EU. Should it cease to apply, the transfers will rely on the Standard Contractual Clauses; we will send you a copy on request.
We keep your data for as long as your account exists, unless a shorter period is stated above. When you delete your account (in the app under Profile → My Profile → Delete account), we immediately delete your account, your training data, your body weight, your photos, friendships and invitations, and your shared and published routines from our database, as well as your record at RevenueCat and PostHog. Copies of routines and exercises, including photos, that other users took over before remain.
So that we can restore the service after data loss, we create encrypted backups every day and keep them for up to twelve months. For technical reasons your data remains in them until they expire. We only access backups to restore the service.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR), in the app under Settings or by email. For any request, an email to info@basedworkouts.com is enough.
Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Sections 2, 5, 8 and 9), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you habitually reside. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Die Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden, Germany (postal address: Postfach 11 01 32, 01330 Dresden), www.datenschutz.sachsen.de.
Based! is intended for people aged 16 and over (Terms of Use, Section 5). If we learn that someone is younger, we delete the account. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
We do not store passwords in plain text, only as a hash created with a recognized method; we cannot see your password. Data between the app, the website and our server is transmitted in encrypted form. We encrypt backups before they leave our server.
We update this privacy policy when our data processing or the legal situation changes; the date at the top shows the current version. We will inform you in advance by email or in the app about material changes, such as new recipients or purposes. If new purposes require consent, we will ask you again.