Privacy Policy

GDPR Compliance · VULKQ v3.4.0

This Privacy Policy describes how VULKQ collects, processes, and protects your personal data in compliance with the European General Data Protection Regulation (GDPR).

Section 1Data Controller

EntityVULKQ
JurisdictionDenmark
Contactsupport@vulkq.com
ScopeWorkout performance & analytics data

Section 2Data We Collect

VULKQ collects only the data strictly necessary to operate the app:

AccountAnonymous user ID generated by Firebase Auth. On web, optionally email if signing in with Google or Apple.
ProfileBody weight (kg), height (cm), age, gender, training goal, experience level
WorkoutsExercise name, weight (kg), sets, reps, estimated volume
TimestampsSession start and end time
AI PromptsText you type into AI Coach is sent to Google Gemini for routine generation. Prompts are not stored by VULKQ.
Support DiagnosticsIf you send in-app feedback, basic device info (device type, OS version, current app state) is attached to your message to help us debug. Sent only when you choose to submit feedback.

Children's Privacy

VULKQ is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided personal data, it will be deleted immediately.

Special Category Data · GDPR Art. 9

Workout log data — including exercise names, weights, sets, reps, and estimated volume — may qualify as Special Category Personal Data (Health Data) under GDPR Art. 9. This data is processed exclusively for the purposes described in Section 3.

Section 3Purpose of Processing

All collected data is used exclusively to deliver in-app analytics to you:

Data Code

We do not sell your data. We do not track you across other apps or websites. No advertising or analytics SDKs are integrated.

Section 4Data Processors & Security

Data is transmitted over TLS and stored encrypted at rest. Our processors are:

StorageGoogle Firebase Firestore (Google Cloud Platform)
AuthenticationFirebase Authentication (anonymous on iOS; Google/Apple sign-in on web)
AI GenerationGoogle Gemini API — sent on demand when you use AI Coach
EncryptionAES-256 at rest · TLS in transit
ComplianceGoogle Cloud ISO 27001 · GDPR Art. 28 DPA
DeletionImmediate and irrevocable upon account deletion (from Profile screen)

Section 5Your Rights

As a data subject, you have the following rights under GDPR:

AccessRight to know what personal data we process about you
RectificationRight to correct inaccurate personal data
ErasureRight to delete your account and all associated data (Profile → Delete Account)
RestrictionRight to restrict processing of your personal data
PortabilityRight to receive your data in a structured, machine-readable format
ComplaintRight to lodge a complaint with a supervisory authority

Data Protection Contact

support@vulkq.com

Expected response time: 72 hours

You also have the right to lodge a complaint with a Data Protection Authority. In Denmark: Datatilsynet (www.datatilsynet.dk).