Privacy Policy
Effective date: July 6, 2026
*This is an English translation for convenience. The Czech version is authoritative.*
1. Who we are
The controller (or, where stated in Section 3, the processor) of personal data is HOJNY Media s.r.o., registered office Chudenická 1059/30, Hostivař, 102 00 Praha, Czech Republic, Company ID (IČO) 08801703 ("we" or "the operator"). Contact: hello@socra.fit.
We operate Socra.fit, a web application for personal trainers and their clients (the "service"), and the socra.fit website.
2. What data we process
a) Waitlist (website): name, email, language, details about your coaching practice that you volunteer (trainer type, client count, current tools), and traffic-source data (UTM parameters).
b) Service accounts: name, email, password (stored only as a secure hash), role (coach/client).
c) Training content: training plans, logged sets, weekly check-ins including body weight, measurements and progress photos, goals, and the coach's notes about a client. This data can reveal information about your physical condition; photos and weight are submitted by the client voluntarily.
d) Technical data: security and operations logs, error reports (Sentry), and anonymous product analytics (PostHog, EU).
We do not process payment data (the service is free during beta).
3. Roles: controller vs. processor
- For waitlist data, user accounts and technical data, we act as the controller.
- For client training content entered into the service by a coach or their client within their coaching relationship, the coach is the controller; we act as the processor, handling the data on the coach's instructions expressed through use of the service. Processing terms are part of our Terms of Service.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Maintaining the waitlist and sending launch updates | consent (Art. 6(1)(a) GDPR) |
| Providing the service (accounts, plans, logging, check-ins) | contract performance (Art. 6(1)(b) GDPR) |
| Progress photos and weight/measurement data | the client's explicit consent given when submitting a check-in (Art. 9(2)(a) GDPR) |
| Security, debugging, service improvement | legitimate interest (Art. 6(1)(f) GDPR) |
| Compliance with legal obligations | Art. 6(1)(c) GDPR |
5. Where and how long we keep data
Data is stored in the EU (Frankfurt am Main, Germany) with Supabase. Progress photos live in private storage accessible only to the client and their coach.
- Waitlist: until launch and at most 12 months after, or until consent is withdrawn.
- Account data and training content: for the life of the account; deleted or anonymised within 30 days of account closure unless a legal obligation requires otherwise.
- Progress photos: the client can permanently delete them in the app at any time.
- Logs and error reports: 90 days at most.
6. Recipients and processors
We use the following providers (processors):
- Supabase: database, authentication and storage (EU region, Frankfurt)
- Vercel: application hosting (functions run in the EU region; Vercel Inc., USA, transfers covered by SCCs / the EU–US Data Privacy Framework)
- PostHog (EU Cloud): product analytics
- Sentry: error reporting
- Resend: transactional email (Resend Inc., USA, SCCs / EU–US DPF)
- Cloudflare Turnstile: bot protection for forms (Cloudflare, Inc., USA, SCCs / EU–US DPF)
We send product usage metrics, such as last sign-in time and feature counts, to our email tool for service communications. We never send health data, body measurements, or check-in content.
We never sell your data or share it with third parties for their marketing.
7. Cookies and analytics
The website and app use technically necessary cookies (e.g. login sessions) and analytics cookies for anonymous traffic measurement and service usage. Form bot protection (Cloudflare Turnstile) may use technically necessary cookies or similar storage to distinguish real visitors from automated traffic. By using the website, you agree to their storage; if you do not agree, you can block cookies in your browser settings or not use the website. We do not use marketing cookies at this time; if we deploy them in the future (e.g. to measure advertising campaigns), we will ask for your consent in advance and update this document.
In the app, we may use PostHog session recordings to improve the service. All text and input content is masked; recordings show only page layout and interactions, never personal data, body measurements, or message content.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, the right to object, and the right to withdraw consent (without affecting prior processing). Requests go to hello@socra.fit; we respond within 30 days as a rule.
If your request concerns training content controlled by your coach, we will forward it to them or help you resolve it directly in the app.
You may also lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.
9. Security
Data access is enforced at the database level (row-level security), transfers are encrypted (TLS), passwords are stored only as hashes, and photos live in private storage behind time-limited access links.
10. Automated decision-making
We perform no automated decision-making or profiling within the meaning of Art. 22 GDPR. The in-app "adherence" indicator is merely an informative summary of completed workouts and check-ins for the coach.
11. Changes
We may update this policy; material changes will be announced by email or in the app. The Czech version of this document prevails.