Privacy Policy

Your data and privacy · VULKQ v3.4.0

This Privacy Policy describes how VULKQ collects, processes, and protects your personal data, and explains your rights under the European General Data Protection Regulation (GDPR).

Section 1Data Controller

EntityVULKQ
JurisdictionDenmark
Contactsupport@vulkq.com
ScopeWorkout performance & analytics data

Section 2Data We Collect

VULKQ collects only the data strictly necessary to operate the app:

AccountAnonymous user ID generated by Firebase Auth. On web, optionally email if signing in with Google or Apple.
ProfileOptional body weight (kg), height (cm) and gender; declared age, adult-access confirmation, training goal and experience level
WorkoutsExercise name, weight (kg), sets, reps, estimated volume
TimestampsSession start and end time
AI CoachOnly after you allow AI features: your gender, age, bodyweight, experience level, training goal and the text you type are sent to Google Gemini (Google LLC) to generate a routine; when you refine a routine, the current draft is sent along with your request. Prompts are not stored by VULKQ.
Post-workout feedbackAfter a finished session, if AI features are on, the exercise names, number of sets, and top-set weight and reps from that session are sent to Google Gemini to write a short feedback note.
Form tipsWhen you open an exercise with AI features on, the exercise name is sent to Google Gemini once. The answer is cached on your device.
Support messagesIf you send in-app feedback, the text you write, your anonymous user ID and the app version are stored so we can follow up. No device diagnostics are collected. Support messages are included when you delete your account.

Children's Privacy

VULKQ is only available to adults aged 18 and over. You must provide your correct age and confirm that you are an adult. This is a self-declaration, not an identity check. Profiles that indicate an age below 18 are blocked. Contact support if you believe an underage account exists.

Special Category Data · GDPR Art. 9

Body metrics (weight, height, age, gender) and workout log data (exercise names, weights, sets, reps and estimated volume) may qualify as Special Category Personal Data (Health Data) under GDPR Art. 9. This data is processed only for the purposes described in Section 3, and is shared with Google Gemini only if you allow AI features.

Section 3Purpose of Processing

All collected data is used exclusively to deliver in-app analytics to you:

Data Code

We do not sell your data. We do not track you across other apps or websites. No advertising or analytics SDKs are integrated.

Section 4Data Processors & Security

Data is transmitted over TLS and stored on Google Cloud, which encrypts data at rest. Our processors are:

StorageGoogle Firebase Firestore (Google Cloud Platform)
AuthenticationFirebase Authentication (anonymous on iOS; Google/Apple sign-in on web)
AI GenerationGoogle Gemini API (Google LLC), paid tier: Google does not use your prompts or responses to improve its products. Requests pass through our authenticated server and are allowed only for adult profiles with AI consent. We keep request counts to limit abuse; prompts and responses are not stored by VULKQ on the server.
AI ConsentYou can turn AI features on or off at any time in Profile. Turning them off blocks new AI requests. A request already sent to Google cannot be recalled; its response is hidden if consent is withdrawn before it returns.
EncryptionTLS in transit. Encrypted at rest on Google Cloud.
ComplianceFirebase and Firestore are covered by Google Cloud Data Processing Terms.
RetentionYour profile, workouts and routines are kept until you delete your account. We also retain daily AI request counts while the account exists.
DeletionRequest deletion in Profile. The server blocks account access and removes your profile, workouts, routines, AI request counts, support messages and sign-in account. Interrupted work is retried; the app only confirms completion after the server finishes. Minimal deletion status, timestamps, user ID and a hashed recovery receipt are retained for 30 days after completion, then removed by scheduled cleanup. This prevents old sessions from restoring data and lets the app confirm an interrupted deletion. Your device keeps its recovery receipt until local cleanup finishes.

Section 5Your Rights

As a data subject, you have the following rights under GDPR:

AccessRight to know what personal data we process about you
RectificationRight to correct inaccurate personal data
ErasureRight to delete your account, profile and workout data (Profile → Delete Account)
RestrictionRight to restrict processing of your personal data
PortabilityRight to receive your data in a structured, machine-readable format
ComplaintRight to lodge a complaint with a supervisory authority

Data Protection Contact

support@vulkq.com

Expected response time: 72 hours

You also have the right to lodge a complaint with a Data Protection Authority. In Denmark: Datatilsynet (www.datatilsynet.dk).