Privacy policy
Updated 30 October 2026
Who is responsible?
Jaksa! Jaksa! is operated by Simon Lumikello, an independent developer in Finland, who is the data controller. For privacy requests or questions, email us.
In plain language: your training log starts private. We ask separately before using AI or making your profile visible. You can download your data, change your choices and delete your account.
What we collect and why
- Account: Google supplies your name, email, account identifier and photo when you choose Google sign-in. Supabase stores account and authentication information. We use this to sign you in, maintain your account and respond to requests. The GDPR basis is providing the service you request (Article 6(1)(b)). Your Google account name and email are not published by the app.
- Training log: exercises, descriptions and notes, plans, targets, weights, repetitions, durations, workout dates and how hard or easy an exercise felt. We use this for your log and progress charts. We ask for your consent before processing it (Article 6(1)(a)).
- Age confirmation and choices: we record that you confirmed meeting the age limit, the notice version and consent timestamps. We do not ask where you live, your age or your birthday. This records your choices and helps demonstrate consent (Articles 6(1)(c) and 7(1)).
- Optional publication: with your explicit consent we show your username, visible name, chosen photo and published plans. Public profiles appear in People; unlisted profiles can be opened by anyone with their link. Published content may be indexed, copied or saved by others. Choosing Private and saving withdraws profile publication consent. Individual plan links must also be revoked in the plan's sharing settings. Publication is based on consent (Article 6(1)(a)).
- Optional AI (available to some users): this feature is off by default during rollout. If enabled for your account, immediately before you start a report, we show the selected model and ask for explicit consent. Vercel AI Gateway and the model provider receive a summary of workout history, exercise and plan names, notes, targets, results and ratings, which we use to generate your report. We do not add account identity to the prompt, but text you enter can identify you. Reports are saved privately. We request routing only to the displayed model's provider with no prompt training; requests fail if the Gateway cannot satisfy these requirements. The provider may keep requests for a limited time under its own terms, for example to detect abuse. The basis is Article 6(1)(a). AI gives suggestions and can be wrong; it does not make decisions with legal or similarly significant effects about you.
- Security and operations: hosting and authentication services may process IP addresses, browser details, request times, URLs and security logs to deliver and protect the service. Linked AI usage records contain model, request identifiers, timing, token counts and costs, not the training prompt or report. Necessary security processing is based on legitimate interests in preventing abuse and keeping the service reliable (Article 6(1)(f)); you can object.
- Usage statistics: Vercel Web Analytics counts page views to show which parts of the app are used. Before anything is sent, the page address is reduced to its route pattern: user names, plan, workout and exercise identifiers and share links are replaced with placeholders such as /users/[username], and query strings are removed. Vercel also receives the referring site, country, browser, operating system and device type. It sets no cookies and recognizes visitors only by a request hash that resets daily, so we cannot link statistics to your account. The basis is our legitimate interest in improving the app (Article 6(1)(f)); you can object, and blocking the analytics script in your browser does not affect the app.
Account information is needed for sign-in. Training consent is needed for a personal log. You can browse public pages without an account. AI and publication are optional and declining them does not prevent private logging. We do not sell personal data or use it for advertising.
Who receives data and international processing
Supabase provides the database and authentication; the project's primary database region is Stockholm, Sweden (eu-north-1). Vercel hosts the app and provides AI Gateway and Web Analytics. Google provides the sign-in service you choose and hosts emails sent to the privacy contact. If you request AI, the selected provider is identified by the model shown before you consent; Gateway routing is restricted to that provider. Authorized operator access is limited to operating, securing, supporting and moderating the service.
An EEA database region does not mean all processing stays in the EEA. These providers and their subprocessors may process data in other countries, including the United States. Their data-processing agreements describe subprocessors and transfer safeguards, including Standard Contractual Clauses where applicable. You can request information about the safeguards relevant to your data from the privacy contact. AI consent does not replace the requirement for lawful transfer safeguards.
Cookies and your device
The app uses Supabase sign-in cookies to maintain and refresh your session, a locale cookie for your chosen language, and local storage for your chosen appearance. Sign-in storage lasts until sign-out or its configured session expiry; language and appearance choices remain until you change or clear them. These support the features you request. Vercel Web Analytics stores nothing on your device, and we do not load advertising trackers. Fonts are served by the app after build time.
Retention, withdrawal and deletion
Your account, training log, saved reports and consent choices stay while you keep your account, so your history remains available. You can delete individual records or reports. In Profile → Account and data controls, you can withdraw AI consent, download a JSON export, or withdraw training consent and erase the account. Erasure removes your live account, training records, profile, links, reports, consent choices and linked AI usage records immediately. Sessions are revoked. If self-service is unavailable, email the privacy contact.
Withdrawal does not affect processing that was lawful before withdrawal. AI requests already sent cannot be recalled; withdrawal stops future requests and removes pending reports. Completed reports remain until you delete them or your account. Making a profile private does not revoke separate unlisted plan links. Revoke those in each plan's sharing settings.
Provider security logs and backups have separate expiry periods under the provider's service settings and agreements. Live deletion does not instantly remove isolated backup copies. Contact us for the applicable periods and any legally required retention. If a backup is restored, erasure requests must be reapplied before the restored data is used. Copies independently made by other users, downloaded files and search-engine caches are outside the app's live deletion mechanism; contact us for help with removal requests involving personal data.
Your rights
You can request access, correction, erasure, restriction of processing and, where applicable, data portability. You can object to processing based on legitimate interests and withdraw consent at any time. Export and account erasure remain available even if you decline training consent. Edit your training data and profile in the app, or contact us for changes you cannot make yourself.
Email us to make a request. We normally respond within one month. If an extension of up to two further months is permitted because a request is complex or numerous, we explain it within the first month. We may ask for proportionate identity verification to protect your data; do not send identity documents unless we have explained why they are necessary.
You can complain to the Finnish Data Protection Ombudsman or your local data-protection authority.
Young users
Independent sign-up currently requires age 13 in Finland and age 16 elsewhere, and any higher age required locally. Some countries allow consent below 16, but the app currently uses this more cautious threshold outside Finland. Younger children cannot sign up on their own while a verified parent or guardian process is unavailable. After your first sign-in, you confirm whether you meet the limit that applies to you; we do not ask for your age. If you do not, we delete the new account and the details Google shared straight away. An account that already holds training data is signed out instead. If a younger child already has an account, contact us to arrange access, export or erasure and address the account's consent status.
Keep your profile private unless you understand that strangers can see and copy what you publish. Do not put your school, address, contact details in a public profile or plan.
Changes and questions
We update this notice when processing changes. A notice does not itself give consent: new or materially different optional processing requires a fresh choice. Contact the operator for questions, privacy requests or reports of illegal public content.