Privacy

The controller for the personal data described here is the publisher of DoYouEvenLift, named in the legal notice.

Controller

Nicolas Laforet

SIREN

847 871 977

Address

5 rue des Bouvreuils67800 BischheimFrance

Email

hello@doyouevenlift.app

DoYouEvenLift is run by one person and has no data protection officer. Write to hello@doyouevenlift.app about anything in this notice.

Account data. Your email address, your display name, and either a password we store only as a hash or the identifier Google sends us when you sign in with Google. Your username, and the history of your username changes. We need this to give you an account and to keep it yours. Legal basis: performance of our contract with you. The username history also lets us answer impersonation reports. Legal basis for that use: our legitimate interest in preventing abuse.

Your Lifter profile. Display name, avatar, bio, location and social links. You choose what goes there and you can empty any of it. Legal basis: performance of our contract.

Your lifting data. Your Records, with the weight, the reps, the date and any Proof link, and your Bodyweight entries. This is the point of the product. Legal basis: performance of our contract.

Settings and cosmetics. Your unit, your visibility, your hidden Lifts, your plate set, your Theme, your Variations, and the optional standards category used only to compute DOTS and Tier. Legal basis: performance of our contract.

Purchases and entitlements. Your Stripe customer identifier, the Checkout session identifier, the amount, the date, and the Entitlement the payment granted. We never receive your card number. Legal basis: performance of our contract, and our legal obligation to keep accounting records.

Technical data. The IP address and the browser user agent recorded with each session, the request logs our host keeps, and the counters our rate limiter keeps. Legal basis: our legitimate interest in keeping the service secure and available.

Error reports. When something breaks, a report goes to Sentry with the error, the page and the account identifier. Legal basis: our legitimate interest in finding and fixing faults.

Product analytics. PostHog counts how the site is used. It runs without cookies and does not track you across other sites. Legal basis: our legitimate interest in understanding how the product is used.

Emails we send. Resend sends your verification, sign-in and password reset emails and keeps a delivery record of them. Legal basis: performance of our contract.

We do not sell your data, we do not run advertising, and we do not profile you.

Your Page carries your username, display name, avatar, bio, location, social links, your shown Lifts with their PRs, Tiers and Proof badges, and your Total and DOTS when they exist. Your email address is never shown. Your standards category is never shown.

• Public Page. Anyone can open it and search engines may index it.
• Unlisted Page. It loads for anyone who has the URL, and we ask search engines not to index it.
• Private Page. Visitors see a stub naming your username and nothing else.

The Card and Story images generated from a public or unlisted Page are served at a public URL so chat apps and social networks can show a preview. A link someone already posted stays posted. Changing your visibility later does not remove it from their timeline or from their cache.

• Vercel. Hosting and serverless functions. United States company, our functions run in the Frankfurt region.
• Neon. The Postgres database. United States company, our database is in the Frankfurt region.
• Resend. Transactional email. United States company, our emails go through the Ireland region.
• Stripe. Payments, receipts and the customer record behind them. Stripe Payments Europe in Ireland, with Stripe Inc. in the United States.
• PostHog. Product analytics, on its European Union cloud.
• Sentry. Error monitoring, with the data stored in the European Union.
• Google. Sign-in with Google, and only if you choose it. Google tells us your Google account identifier, your email address, your name and your profile picture.

Each of them acts on our instructions under a data processing agreement, except Google, which is its own controller for your Google account. Nobody joins this list without this page being updated at the same time.

Vercel, Neon, Resend, Stripe and Google are United States companies or have United States parents. Where data reaches the United States, the transfer rests on the EU-US Data Privacy Framework when the company is certified under it, and on the European Commission's Standard Contractual Clauses otherwise.

Where a region is named above, the data is stored in the European Union even though the company is American. Ask us at hello@doyouevenlift.app for a copy of the safeguards.

• Account, profile, lifting and settings data. Until you delete your account. We run no inactivity purge.
• Purchase records. 10 years, as French accounting law requires. When you delete your account, the record stays as an accounting row with no link to you.
• Sessions, with their IP address and user agent. Until the session expires, which is 7 days after it was last renewed.
• Rate limiting counters. Minutes to an hour, then they are gone.
• Error reports and analytics. The default retention of Sentry and of PostHog.
• Email delivery records. Resend's own retention.

We set one cookie. It is named better-auth.session_token, and __Secure-better-auth.session_token in production. It holds your session token, it lasts 7 days, and it is renewed while you stay signed in.

That cookie is strictly necessary to keep you signed in, so we do not ask for consent and there is no cookie banner. We set no advertising cookie, no analytics cookie and no third-party cookie. Our analytics runs without cookies.

Stripe sets its own cookies on its checkout page, which is Stripe's site and not ours.

Under the GDPR you can ask for access to your data, for it to be corrected or erased, for a portable copy, for processing to be restricted, and you can object to processing we base on our legitimate interest or withdraw your consent where we rely on it.

• Access and portability. Export my data in your account settings gives you everything we store about you, as JSON, straight away.
• Correction. Your profile settings.
• Erasure. Delete account in your account settings. It is immediate.

For anything else, write to hello@doyouevenlift.app. We answer within one month. If the request is complex we may take two months more, and we tell you why before the first month is up.

If you think we handle your data wrongly, you can complain to the CNIL, the French data protection authority, at 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr. You can also complain to the authority of the country where you live.

The service is for people aged 16 and over. We do not knowingly collect data about anyone younger. If we learn that an account belongs to someone under 16, we delete it and its data. Tell us at hello@doyouevenlift.app if you believe that is the case.

Traffic runs over HTTPS. Passwords are stored as hashes and never in clear. The database and the functions run in the European Union. Access to production is limited to the publisher. No system is perfectly secure, and if a breach puts your data at risk we tell you and the CNIL.

We update this notice when what we do changes, in particular when a processor is added or removed. The date at the top of this page is the date of the last change, and we email you when a change matters to you.

hello@doyouevenlift.app reaches the publisher directly, for this notice, for your rights, for support and for reports.

This notice exists in French and in English. The French version is the authoritative one and prevails if the two differ. Read it at /fr/privacy.