Privacy policy

1. Who is responsible

Sergo's Fitness is run by Nikolay Georgiev, a private individual, who is the controller of your personal data. For anything about it, write to info@sergofitness.pro.

2. What we collect

• Without an account: no account data. Programs, exercises and workout mode work without signing up. Like any website, the hosting provider briefly records technical request data (IP address, browser, page opened) for security and to keep the site running.
• Account: name, email, password (stored only as a one-way hash that nobody can read), the date you joined and your role on the site.
• What you save: finished workouts, the kilograms and reps of every set, your own programs and the personal YouTube clips you add.
• Sign-in and security: while you're signed in, a session with your IP address and browser; your IP address for a short time, to limit repeated sign-in attempts.
• Emails: when you ask for a new password, your email is used to send you the link.
• If you write to us: your email and your message.
• If you edit content as a trainer or administrator, your changes are recorded with your account.

3. Why we use it

• To run your account and its features (Article 6(1)(b) of the General Data Protection Regulation, GDPR: performing a contract).
• For security and to prevent abuse, including limiting sign-in attempts (Article 6(1)(f) GDPR: legitimate interest).
• For overall statistics on how the site is used, without names (legitimate interest).

We don't show ads, sell data or build profiles of people.

4. Who processes it for us

• Vercel Inc.: hosts the site. The servers that run it are in Frankfurt, Germany.
• Neon: the database, in Frankfurt, Germany.
• Resend: sends the password emails, from European servers (Ireland).
• Cloudflare: the domain name and forwarding of emails sent to info@sergofitness.pro.
• YouTube (Google): only if you're signed in and press play on a clip. The video then loads from youtube-nocookie.com and Google's terms apply. Clip thumbnails come through our own server.

Some of these providers are US companies. Where data may leave the EU, this relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

5. Cookies and data in your browser

• Sign-in cookie: only while you're signed in, to keep you signed in for up to 60 days.
• Language cookie: remembers whether you prefer Bulgarian or English, for 1 year.
• Saved pages: your browser keeps the public pages you've opened so they work offline. Personal pages are never saved, and the copies are cleared when you sign out.

We only use necessary cookies, with no analytics or advertising cookies, so there's no consent banner.

6. How long we keep it

• Your account and everything saved in it: for as long as the account exists.
• Sign-in sessions: until you sign out, at most 60 days.
• Sign-in limit data and hosting logs: a short time.

When you delete your account, you're signed out everywhere and can't sign in to it again. The name and email are removed from the account, and the same email can be used to sign up again. A separate internal record of the deleted account (name, email, role and dates), visible only to the site's owner, is kept for 30 days for security and record-keeping, and then erased. Workouts, kilograms and programs stay linked to the emptied account, without a name or email, and are used only for statistics.

7. Your rights

You can ask to see your data, correct or erase it, restrict or object to how it's used, and receive it as a file. You can delete your account yourself at any time under Your account. For anything else, write to info@sergofitness.pro. We reply within one month.

You can also complain to the Bulgarian Commission for Personal Data Protection: cpdp.bg.

8. Age

You need to be at least 14 to create an account. If we learn that a younger child has created one, we'll delete it.

9. Changes

When this policy changes, the date at the top of the page changes too. Important changes are also announced on the site.