Equipa
Privacy notice
Applies from 26 October 2026
1. Who is responsible for your data
It depends on how you use Equipa:
- You train with a trainer or gym (you joined through their invite): your trainer or gym is responsible for your training and health data. Equipa stores it for your trainer or gym and only follows their instructions. We have a data processing agreement (DPA) with them.
- You use Equipa on your own (no trainer or gym): Equipa is responsible for your data.
Equipa is always responsible for your account itself (name, email and password).
Questions about your data: privacy@equipa.app.
2. What we collect and why
| Data | Why |
|---|---|
| Account: name, email, birth year, password (stored as a one-way hash, never readable) | To create your account, sign you in, and know if a parent or guardian must agree (under 14) |
| Training: your plan, your sessions, which sets you completed or skipped, and how long you trained | To show your plan, your history and your progress |
| Health: pain scale before and after a session, effort (RPE/RIR), notes | To track how training feels and help adjust your plan. Only saved if you agree |
| Consent records: which text you accepted, its version and language, a fingerprint (hash) of the exact text, the date, and a one-way hash of your IP address | To prove what you agreed to and when |
| Access records: when your data is viewed or changed, and by whom (for example each time your trainer or the Equipa team opens your training logs) | To protect your data and to prove who saw it |
We don't use your data for ads, we don't sell it, and we don't use it to make automatic decisions about you.
3. Legal basis
- Health data: your explicit consent (GDPR art. 9(2)(a)). You can withdraw it at any time.
- Your account: it is needed to provide the service you signed up for (GDPR art. 6(1)(b), contract).
- Consent records: we keep them to prove your consent, as the law requires (GDPR art. 7(1)).
4. Where your data is stored and who processes it
Your data is stored in the EU, in Frankfurt (Germany).
We use two providers (subprocessors) to run Equipa:
| Provider | What it does | Country |
|---|---|---|
| Vercel | Runs the app | USA, servers in Frankfurt |
| Neon | Stores the database | USA, servers in Frankfurt |
Both are US companies. Any transfer of data to them is covered by their data processing agreements: the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).
5. How long we keep your data
- While your account is active, we keep your account and the training data you chose to save.
- If you withdraw consent for health data, your saved health data is deleted. You can export it first.
- If you stop training with a trainer or gym, they lose access straight away.
- If you delete your account, you are signed out at once, and everything is permanently deleted after 30 days. In those 30 days you can still ask for an export.
- Consent records are kept after your account is deleted, without your name or email, to prove what was agreed. (For how long is still to be decided.)
- Inactive accounts: after 24 months without use we will warn you, and then delete the account. (Planned, not active yet.)
- Access records are kept for 2 years. (Planned, not active yet.)
6. Your rights
You can ask to:
- See the data we hold about you (access)
- Correct it if it's wrong
- Delete it
- Get a copy in a file you can take elsewhere (export)
- Object to how we use it
- Withdraw consent at any time, without affecting what was done before
To use a right, write to privacy@equipa.app. We answer within one month. If you train with a trainer or gym, they are responsible for your training data, and we help them answer you.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.
7. Children under 14
If you are under 14, a parent or legal guardian must agree before we save your health data. We ask your birth year before the consent screen. Your parent or guardian gives their name and their relationship to you, and can use all the rights above on your behalf.
8. If you start training with a trainer or gym later
If you used Equipa on your own and then join a trainer or gym:
- The data you saved before joining stays with Equipa as the one responsible for it.
- From the day you join, your trainer or gym is responsible for your new training data.
- Your trainer only sees your earlier sessions if you agree on the consent screen.
- We show you the new consent texts when you join, so you can decide again.
9. Changes to this notice
This notice applies from 26 October 2026. If we change it in a way that matters, we tell you in the app before the change applies.