Privacy Policy · 2trAIn

This policy explains what data 2trAIn processes, why it uses it and your rights under the GDPR and Spanish data protection law.

1. Data controller

Controller: 2trAIn, Madrid, Spain. Privacy contact: contact@2trainapp.com. No Data Protection Officer has been appointed at this stage; enquiries and requests are handled at that address.

2. Data we process

Depending on the features you use, we process:

Account: email, name, sign-in provider and identifiers.
Profile: age, sex, measurements, level, goals, availability and equipment.
Health: injuries, discomfort, limitations, fatigue and information you choose to share. These are special-category data.
Training: plans, exercises, sets, reps, weight, effort, rests, feedback and progress.
Coach conversations and product feedback.
Minimum technical data for security and operation.

3. Purposes and legal basis

We use data to manage your account, create and adapt your plan, record progress, provide chat and keep the service secure. The basis is performance of the service (Art. 6.1.b GDPR). Health data is processed only with your explicit consent (Art. 9.2.a). Fraud prevention and minimum technical metrics rely on our legitimate interests (Art. 6.1.f).

4. Health-data consent

You may withdraw consent at any time through privacy settings or by contacting us. Withdrawal does not affect earlier processing, but may prevent safe personalisation based on your injuries or limitations.

5. AI and profiling

2trAIn uses AI to generate explanations and personalise plans. Recommendations have no legal effect and you may ignore them, express your view or request human review at contact@2trainapp.com.

6. Providers and transfers

We do not sell your data. To operate the service we use hosting (Fly.io), database (Neon), transactional email (Resend) and AI (Anthropic) processors, plus Google or Apple if you choose social sign-in. Chat may send Anthropic your message and limited training context, without your name, email or internal user ID. Where data is transferred outside the EEA, applicable contractual safeguards are used.

7. Retention

We retain data while your account is active and for the time needed to handle deletion, legal obligations and backups. When you close your account, linked data is deleted or anonymised within 30 days unless the law requires retention.

8. Your rights

You may exercise access, rectification, erasure, objection, restriction, portability and automated-decision rights by emailing contact@2trainapp.com with the subject “GDPR Rights”. You may also complain to the Spanish Data Protection Agency.

9. Security

We use HTTPS, restricted access, protected credentials and technical controls against unauthorised access, loss or alteration. No system is infallible; if we detect a breach we will act as required by law.

10. Children

The service is intended for users aged 14 and over. Younger users must not create an account without consent from a parent or legal guardian.

11. Changes and contact

We will update this policy when the service or law changes. Material changes will be announced in advance. For any questions email contact@2trainapp.com.