Privacy policy

Effective 20 June 2026

Kjaer Labs (CVR 46556534, Denmark) ("we", "us") runs the VL-program web app and iOS app for coaches and athletes to plan and log weightlifting sessions. Kjaer Labs is the data controller for personal data processed through these services. This page explains what data we collect, why, where it lives, and the rights you have under GDPR.

What we collect

When you create an account or use the app, we collect only what we need to run the service:

• Account basics: email address, first and last name, password (stored as a one-way hash by our auth provider), chosen UI language.
• Gym membership: which gym you belong to, your role (coach or member), any sub-groups you're part of.
• Training data: programs you create as a coach, exercises you add to your own session as a member, sets logged (weight, reps, lift/no-lift, notes).
• Optional images: profile picture and gym image if you upload them.
• Sign-in identifiers when you use "Continue with Google" or "Continue with Apple": a stable identifier from the provider, your email, and (first time only) your name.

We do not collect medical records, health diagnoses, HealthKit data, location data, contacts, microphone data, advertising identifiers, or similar sensitive personal data. We do not sell data and we do not use it for advertising.

Email communications

We send service-related emails necessary to operate your account, such as account verification, password reset, and security notifications. These emails are sent on the basis of contract (GDPR Art. 6(1)(b)) and our legitimate interest in keeping your account secure (Art. 6(1)(f)). We do not send marketing emails.

Why we collect it (legal basis)

• Contract (GDPR Art. 6(1)(b)): account basics, gym membership, training data, service emails - without these the app can't work.
• Consent (GDPR Art. 6(1)(a)): optional profile and gym images. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legitimate interest (GDPR Art. 6(1)(f)): authentication logs, basic security telemetry, and security notifications kept by us and our providers, used only to keep accounts secure.

What your coach sees

Kjaer Labs is the sole controller of personal data on VL-program. Coaches are users of the platform - they are not separate data controllers. Coaches can access athlete data within the gyms they manage for the purpose of providing coaching services through the platform.

When you join a gym, the coach (gym owner) can see, by default:

• Your name, profile picture, and the email you signed up with.
• The groups within their gym you belong to.
• The training programs you're following and every set you log: weight, reps, lift / no-lift, and any per-day notes you write.
• Aggregated stats based on the above - your total volume, your PRs, your weekly graphs.

Your coach cannot see data from any other gym you used to belong to, members of other gyms, or your account password.

You can turn off the aggregated stats view at any time from Profile → "Share my stats with my coach". The coach can still see individual sets you log in their gym's programming - without that, they can't actually program for you - but the stats screen will show them a "private" placeholder for your account.

Where your data lives (sub-processors)

• Supabase (EU region) - database, authentication, file storage.
• Vercel - web hosting and edge functions.
• Resend - transactional email (account confirmation, password reset, email-change confirmation).
• Apple and Google - only if you use "Continue with Apple/Google"; the provider returns a sign-in token to us.

Some of these processors (Vercel, Resend) are based in the United States. Where data is transferred outside the EU/EEA, it is protected by Standard Contractual Clauses as part of those providers' published terms. You may request a copy of the applicable safeguards by contacting us.

How long we keep it

• While your account remains active: we retain your data so that your training history remains available.
• After you delete your account: account and training data are removed within 30 days. Limited authentication logs may be retained by Supabase for up to 90 days as required for security and abuse prevention.
• Backups: encrypted backups roll over within 30 days.

Your rights

Under GDPR you have the right to:

• Access and portability: download a JSON copy of your data any time from Profile → "Privacy & data" → Download my data. For requests we can't fulfil from the app, email privacy@kjaerlabs.com and we'll respond within 30 days.
• Correction: edit your name, email, or password from the profile screen. Other corrections - email us.
• Deletion ("right to be forgotten"): users can permanently delete their account directly within the app without contacting support - Profile → "Privacy & data" → Delete account. You can also email us if you prefer.
• Withdraw consent: where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Optional profile and gym images can be removed from the profile screen.
• Object / restrict processing: email us and we'll act on the request within 30 days.
• Complain to a supervisory authority: in Denmark, that's Datatilsynet.

Cookies and local storage

• Authentication cookies and similar storage used by Supabase are required to keep you signed in. Without these you cannot use the app.
• vl_lang cookie - remembers your chosen UI language. Functional, not used for tracking.
• vl.keep-awake.v1 (browser local storage) - remembers whether you've turned on "keep screen on" in your profile. Functional, not used for tracking.

We do not use third-party analytics, advertising, or tracking cookies. None of the storage above requires a consent banner under GDPR / ePrivacy because every entry is either strictly necessary to deliver the service or set only when you actively change a setting. If we ever add analytics or other non-essential storage, we will ask for your consent first.

Children

VL-program is not directed at users under 16. If we learn we've collected data from a child under 16 without parental consent, we'll delete it.

Changes to this policy

We'll update this page when the way we handle data changes materially, and bump the effective date at the top. For significant changes affecting existing users, we'll also send an email.

Contact

Questions or requests: privacy@kjaerlabs.com.