Privacy Policy

Your data and privacy · VULKQ v3.4.1

This Privacy Policy describes how VULKQ collects, processes, and protects your personal data, and explains your rights under the European General Data Protection Regulation (GDPR).

Section 1Data Controller

EntityVULKQ
JurisdictionDenmark
Contactsupport@vulkq.com
ScopeWorkout performance & analytics data

Section 2Data We Collect

VULKQ processes the following data to provide training features, account access and support. The sign-in software also processes technical data as described below.

AccountFirebase user ID. If you choose Google or Apple sign-in, Firebase Authentication also processes the email address, display name and profile image URL supplied by that provider, when available.
ProfileOptional body weight (kg), height (cm) and gender; declared age, adult-access confirmation, training goal and experience level
WorkoutsExercise name, weight (kg), sets, reps, estimated volume
TimestampsSession start and end time
AI CoachOnly after you allow AI features: your gender, age, bodyweight, experience level, training goal, selected training days (weekdays) and equipment, and the text you type are sent to Google Gemini (Google LLC) to generate a routine. When you refine a routine, the current draft, your original request, accepted changes and selected days and equipment are sent with your new request. Prompts are not stored by VULKQ.
AvoidWe leave out exercises marked Avoid and send the shorter exercise list to Google. Google can see which exercises are missing. If too few exercises remain for your equipment, we tell you before you generate or change a program which ones the coach may still use.
LoveExercises you mark Love are placed first among the exercises the coach can choose.
External linksExercise links open an external search only when you choose them; that service applies its own privacy policy.
Exercise videosEmbedded YouTube videos contact Google and may use cookies only after you choose Watch video. Google's privacy policy applies.
Post-workout feedbackAfter a finished session, if AI features are on, the exercise names, number of sets, and top-set weight and reps from that session are sent to Google Gemini to write a short feedback note.
Form tipsWhen AI features are on and you tap Get AI form tips, the exercise name is sent to Google Gemini once. The answer is cached on your device.
Exercise preferencesExercises you mark Love or Avoid, and which exercises you have reviewed, are saved to your account in Google Firebase and synced across your devices. They are deleted when you delete your account.
Support messagesIf you send in-app feedback, the text you write, your Firebase user ID, the app version and submission time are stored so we can follow up. The feedback form does not automatically attach device diagnostics. Support messages are included when you delete your account.
Sign-in diagnosticsFirebase Authentication uses a user identifier for login. With its default data collection enabled, it also sends technical information about the device, operating system, app and development platform to help Firebase understand platform adoption. Firebase states that this technical information is not linked to a user or device identifier.
Google sign-inGoogle sign-in may process a user identifier and IP address; the IP address may be used to estimate a general location for fraud prevention. Its bundled privacy declaration also lists name, email, phone number, approximate location, user and device identifiers, other usage data and other data, for sign-in functionality and/or analytics. These are SDK declarations, not a claim that every listed field is sent on every login. VULKQ does not offer phone-number sign-in.

Children's Privacy

VULKQ is only available to adults aged 18 and over. You must provide your correct age and confirm that you are an adult. This is a self-declaration, not an identity check. Profiles that indicate an age below 18 are blocked. Contact support if you believe an underage account exists.

Special Category Data · GDPR Art. 9

Body metrics (weight, height, age, gender) and workout log data (exercise names, weights, sets, reps and estimated volume) may qualify as Special Category Personal Data (Health Data) under GDPR Art. 9. This data is processed only for the purposes described in Section 3, and is shared with Google Gemini only if you allow AI features.

Section 3Purpose of Processing

We use data to provide account access, training features and support, and to prevent abuse. The sign-in providers also declare technical analytics for their software:

Data Code

We do not sell your data or use it for advertising. The bundled sign-in SDKs declare no tracking, but do declare the analytics uses described above. Analytics and tracking are different purposes.

Section 4Data Processors & Security

Data is transmitted over TLS and stored on Google Cloud, which encrypts data at rest. Our processors are:

Provider details: Firebase data collection and Google sign-in data collection.

StorageGoogle Firebase Firestore (Google Cloud Platform)
AuthenticationFirebase Authentication (guest access and optional Google or Apple sign-in)
AI GenerationGoogle Gemini API (Google LLC), paid tier: Google does not use your prompts or responses to improve its products, but may retain requests for security, abuse prevention and legal obligations. Requests pass through our authenticated server and are allowed only for adult profiles with AI consent. We keep request counts to limit abuse; prompts and responses are not stored by VULKQ on the server.
AI ConsentYou can turn AI features on or off at any time in Profile. Turning them off blocks new AI requests. A request already sent to Google cannot be recalled; its response is hidden if consent is withdrawn before it returns.
EncryptionTLS in transit. Encrypted at rest on Google Cloud.
ComplianceFirebase and Firestore are covered by Google Cloud Data Processing Terms.
RetentionYour profile, workouts and routines are kept until you delete your account. We also retain daily AI request counts while the account exists. Logging out or deleting the app does not delete these server records. VULKQ does not automatically delete saved guest profile, workout or routine data after inactivity. Before leaving a guest account, connect Apple or Google to keep access, or delete the account from Profile. If you have already lost access, contact support; we need to verify ownership before acting on a data request.
DeletionRequest deletion in Profile. The server blocks account access and removes your profile, workouts, routines, AI request counts, support messages and sign-in account. Interrupted work is retried; the app only confirms completion after the server finishes. Minimal deletion status, timestamps, user ID and a hashed recovery receipt are retained for 30 days after completion, then removed by scheduled cleanup. This prevents old sessions from restoring data and lets the app confirm an interrupted deletion. Your device keeps its recovery receipt until local cleanup finishes.

Section 5Your Rights

As a data subject, you have the following rights under GDPR:

AccessRight to know what personal data we process about you
RectificationRight to correct inaccurate personal data
ErasureRight to delete your account, profile and workout data (Profile → Delete Account)
RestrictionRight to restrict processing of your personal data
PortabilityRight to receive your data in a structured, machine-readable format
ComplaintRight to lodge a complaint with a supervisory authority

Data Protection Contact

support@vulkq.com

Expected response time: 72 hours

You also have the right to lodge a complaint with a Data Protection Authority. In Denmark: Datatilsynet (www.datatilsynet.dk).