Privacy policy

1. Controller

The data controller under the GDPR is:

excelIT GmbH, Wattstr 52, 12459 Berlin, Germany. Contact: legal@excelit.de

Data protection officer (if appointed): legal@excelit.de

2. Data we process

We process personal data required to operate JBR:

• Account data: name, email, password (hashed), role, language, timezone
• Coaching data: training plans, workout logs, nutrition plans, meals, check-ins, messages, progress photos
• Health-related data (optional): steps, sleep, weight — only with your consent via Apple Health / Health Connect
• Device & usage data: push tokens, session tokens, technical logs
• Billing data (coaches): Stripe customer ID, subscription status — payment details are processed by Stripe

3. Purposes and legal bases

We process data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): providing the app and coaching features
• Consent (Art. 6(1)(a) GDPR): health sync, push notifications, AI features when enabled
• Legitimate interests (Art. 6(1)(f) GDPR): security, fraud prevention, anonymized product improvement
• Legal obligation (Art. 6(1)(c) GDPR): tax retention where applicable

4. Recipients and processors

Data may be shared with the following categories of recipients where necessary:

• Hosting & database (e.g. MongoDB Atlas, EU region where possible)
• Object storage for media (S3-compatible, EU)
• Email delivery (transactional emails)
• Stripe (coach subscription billing)
• Anthropic (AI processing for optional features — only when used)
• Your coach and their team (coaching data within the organization)

5. Retention

We retain personal data while your account is active and thereafter only as required by law.

You can delete your account anytime in settings. We then anonymize your profile and remove direct identifiers.

6. Your rights

You have the following rights under the GDPR:

• Access, rectification, erasure, restriction of processing
• Data portability: export from app Settings or on request to legal@excelit.de
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

7. Cookies & local storage

The website uses strictly necessary cookies/localStorage for sign-in (session) and theme preference.

We do not currently use marketing or analytics cookies. If that changes, we will update this notice and request consent where required.

8. Children

JBR is not directed at children under 16. Do not create an account for minors without parental consent.

9. Changes

Last updated: 2026-09-11. We may update this privacy policy. Material changes will be communicated in the app or by email.