Privacy Policy

1. Controller

Yabso

Email: privacy@yabso.app

This is the controller responsible for personal data processed via Yabso under Art. 4 No. 7 GDPR.

2. Data we collect

Account data: email address, display name, password hash (Better-Auth + bcrypt), unit-system preference.

Workout data: routines, exercises, sets, weights, repetitions, rest times, personal records, optional workout notes — all linked to your account.

Waitlist data (when registration is invite-only): the name and email address you submit to join the waitlist, kept only until you're invited and register, or the entry is automatically deleted.

Technical data: server access logs (IP, user agent, timestamp) retained for at most 14 days for abuse prevention.

We do not collect health data beyond what you voluntarily log, do not use analytics, and do not track you across sites.

3. Purposes and legal basis

Account creation and login: Art. 6 (1) (b) GDPR — performance of a contract.

Storing your workouts and showing them back to you: Art. 6 (1) (b) GDPR.

Waitlist signup and sending you a registration invite by email: Art. 6 (1) (a) GDPR — your consent, given when you check the waitlist consent box.

Security logs and rate-limiting: Art. 6 (1) (f) GDPR — legitimate interest in protecting the service.

4. Storage and processors

Your data is stored on a Postgres database hosted with Hetzner Online GmbH (Germany).

Avatar images are stored on Contabo (Germany).

We do not transfer data outside the EU/EEA unless explicitly stated.

5. Your rights

You can export all data we hold about you in Settings → Data & Privacy at any time (Art. 20 GDPR).

You can permanently delete your account and all associated data in the same screen (Art. 17 GDPR).

You also have the right to access (Art. 15), rectify (Art. 16), restrict (Art. 18), and object to (Art. 21) processing. Contact us at privacy@yabso.app.

You can lodge a complaint with a supervisory authority — for residents of Germany, the data-protection authority of your federal state.

6. Retention

Account data is kept until you delete your account.

Waitlist entries that are never invited, or invited but never complete registration, are automatically deleted after 180 days.

Server access logs are kept for at most 14 days.

Soft-deleted records (if any) are purged within 30 days.

7. Cookies and local storage

We use one HTTP-only session cookie issued by Better-Auth. It is strictly necessary for keeping you signed in and is therefore not subject to consent.

On the public landing site we set two further first-party cookies, both functional rather than analytics: `yabso-theme`, set on your first visit, stores your resolved light/dark theme so the page renders in the right theme immediately instead of flashing the wrong one; `yabso-language`, set when you pick a language, stores that choice so an unprefixed URL keeps serving it on later visits. Both last one year and carry no personal data.

We also use browser local storage to remember that you made an explicit theme choice. No tracking cookies, no third-party advertising tags.

8. Contact

For questions about this policy or to exercise your rights, contact privacy@yabso.app.