Privacy Policy
Last updated: 2026-07-26
Data controller
Andreas Svedlund (private individual, Sweden) is the data controller for personal data processing in the jim. service. Contact us via the email at the bottom for questions or to exercise your rights.
What data do we collect?
Account data: email address, hashed password (PBKDF2 with pepper), language, theme, unit preference, optional first name and last name, optional gender (used for weight suggestions).
Training data: programs you create, logged sessions with sets/reps/weight, bodyweight logs, notes.
Technical data: IP address at login/registration/password reset (kept as security event for 90 days to detect abuse), session cookies, activity timestamps.
We do NOT collect: location, contacts, calendars, third-party trackers, ad IDs, health data from other apps.
Why do we process the data?
Deliver the features (primary purpose, legal basis: performance of contract per GDPR Art. 6.1.b).
Protect against abuse and attacks (security log, legal basis: legitimate interest per GDPR Art. 6.1.f).
Send transactional emails (password reset, invites, legal basis: legitimate interest and performance of contract).
How long is data kept?
Account data: until you delete the account. After deletion, anonymized history records (session names, day names) are kept for 30 days to protect related data belonging to other users (e.g. inviters), then everything is removed.
Active sessions: max 30 days (absolute TTL), 7 days without activity (idle TTL).
Security events: 90 days, then permanently deleted via a nightly cron.
Rate-limit counters: 1 hour after the last event.
Who else processes your data?
Cloudflare, Inc. (data processor): runs the Workers code and stores the database (Cloudflare D1). Cloudflare Workers Observability additionally collects runtime logs (request path, status, latency, region, IP address) for 3-7 days so we can debug runtime errors. Code and data may be processed on Cloudflare edge nodes in the EU, US and other regions. Cloudflare is certified under the EU-US Data Privacy Framework and provides Standard Contractual Clauses (SCCs) for transfers outside the EU/EEA. This makes the transfer lawful under GDPR Art. 46.
Mailgun Technologies, Inc. (data processor): sends transactional email. We use Mailgun EU region (api.eu.mailgun.net) so mail content and recipient address are primarily processed in the EU. Mailgun has a DPA and SCCs for residual transfers to the US parent.
We use NO third-party trackers, no Google Analytics, no ads.
Your rights under GDPR
Access (Art. 15): get a copy of your data via Settings, Export my data or GET /api/auth/export.
Rectification (Art. 16): change profile data via Settings.
Erasure (Art. 17): delete your account via Settings, Delete account. Effective immediately, irreversible after 30 days.
Portability (Art. 20): the export is JSON that can be imported into other apps.
Objection (Art. 21): you can object to processing based on legitimate interest. Write to the contact email.
Complaint: you can file a complaint with the Swedish Authority for Privacy Protection (imy.se) if you believe processing violates GDPR.
Cookies
We use ONE cookie: __Host-jj_session. It is strictly necessary to keep you signed in. No consent is required for strictly necessary cookies under the ePrivacy directive. We use NO analytics cookies, tracking pixels, or ad cookies.
Security
Passwords are hashed with PBKDF2-SHA256 + secret pepper (100,000 iterations). Sessions are HMAC-signed. The cookie has __Host-prefix, HttpOnly, Secure, SameSite=Strict. All traffic is encrypted with TLS 1.3. We log security events for 90 days and lock accounts after 10 failed login attempts.
Changes to the policy
On material changes, terms_version is bumped and you get a re-consent prompt in the app. You must accept the new version to continue using the service.
Contact
Questions? Write to [email protected].