Privacy Policy

The data controller is the owner of Omkin. For any privacy matter or to exercise your rights, write to ezbaiduda@gmail.com.

We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

• Account: email address and password. We never see your password: the authentication provider stores it encrypted (hashed).
• Profile and progress: the name you choose to display, level, XP, streaks, rest days, badges, skill trees and the app state.
• Workouts (Pro with an account only): date, type, duration, blocks completed, XP earned and the real values you log (reps, minutes, load).
• Preferences: available equipment, goals, cardio, mobility and meditation modules, and language.
• Subscription: Stripe customer and subscription identifiers, status, renewal date and billing history. We do not store your card number; Stripe collects it directly.
• Suggestion or bug messages you choose to send us, with your email if you give it.
• Minimal technical data generated when the website is served (IP address, browser, date and time) by hosting and providers for operation and security.

Omkin does not ask for health data (diagnoses, medication, etc.) or special categories of data. Please do not write them in free-text fields such as your name or suggestions.

• Providing the service (creating your account, saving and syncing your progress, generating routines): performance of a contract (Art. 6.1.b GDPR).
• Managing the Pro subscription (charges, renewals, cancellation, invoices): performance of a contract and legal commercial and tax obligations (Art. 6.1.b and 6.1.c).
• Security and fraud prevention (access control, usage limits): legitimate interest (Art. 6.1.f).
• Handling your messages and requests: legitimate interest and, where applicable, your consent when you write to us (Art. 6.1.f and 6.1.a).

We do not use your data for advertising, we do not sell it, and we do not make automated decisions with legal effects about you. The routine generator uses your training data only to propose the day’s session.

Omkin does not use advertising, analytics or tracking cookies. It does use your browser’s local storage (localStorage and sessionStorage) and a service worker for strictly necessary functions that you request: remembering your language, keeping you signed in, saving the app state so it works offline and allowing it to be installed as an app. Because they are necessary, they do not require your consent; you can delete them at any time from your browser settings (you will be signed out and, on the free plan without an account, you will lose local progress).

When you pay, Stripe may use its own cookies or similar technologies on its payment page, in line with its policy.

Only with providers that supply services to us (processors) and make it possible for us to offer you Omkin:

• Supabase — authentication and the cloud database where your account, profile and workouts are stored.
• Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates) — subscription payments and billing. It acts as an independent controller for the payment data you give it, to meet its fraud-prevention and regulatory obligations.
• Vercel — hosting and delivery of the website and API.
• Email provider (if email delivery of suggestions is enabled) — to deliver the messages you send.

We may also disclose data to authorities where there is a legal obligation.

Some providers may process data outside the European Economic Area, for example in the United States. In that case we make sure appropriate safeguards exist, such as the standard contractual clauses approved by the European Commission or the provider’s participation in the EU-US Data Privacy Framework. You can ask us for more information at ezbaiduda@gmail.com.

• Account, profile and workouts: while you keep your account. If you cancel Pro, we keep your data without access to Pro features for 90 days in case you subscribe again; after that it may be deleted.
• Billing data: for the periods required by commercial and tax law, and blocked while liabilities may arise.
• Suggestion messages: for as long as needed to handle them and improve the service.

When you ask us to delete your account, we will delete your data except what we must keep by law.

You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, by writing to ezbaiduda@gmail.com from your account email. We will reply within one month.

To delete your account and data, request it at that same address. If you have an active subscription, cancel it first from Profile → Manage subscription.

If you believe we have not handled your data properly, you have the right to complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority of your EU country of residence.

We apply reasonable technical and organizational measures: encrypted connections (HTTPS), hashed passwords, row-level security rules in the database so each user can only access their own data, and signature verification of Stripe payment notifications. No system is infallible; if a breach occurred that puts you at risk, we will notify you as required by law.

The service is not aimed at children under 14 and we do not knowingly create accounts for minors of that age. If you think a minor has given us data, write to us and we will delete it. The paid subscription is reserved for people over 18.

We may update this policy, for example when we add a new provider or feature. We will publish the current version with its date and, if the change is important, tell you in the app or by email. See also the Terms and Conditions.