Privacy Policy

Last updated: 2026-11-15

1. Data controller

Riccardo Patalocchi, operator of LuterTrainer (lutertrainer.com). Contact for any request about your data: [email protected].

2. Data we process

Account: email address, username, optional display name and password. The password is never stored in clear text: only a salted hash is kept (ASP.NET Core Identity). If you enable two-factor authentication, the authenticator key is stored as well.
Preferences: language, whether the weekly email report is enabled.
Hevy API key: stored encrypted, as described in section 4.
Workout data synced from Hevy: workouts, exercises, sets, notes, planned routines and exercise templates, with the last sync time.
Hevy webhook token (if you enable it): stored only as a hash (SHA-256), never in clear text.
Technical logs: internal user identifier (a random code, not your name or email), outcome and errors of syncs and webhooks, method, path and duration of each request. The logs do not contain the API key, tokens, email addresses or IP addresses, and are deleted after 7 days.
IP address: used in memory only, to limit login attempts and rapid repeated requests; it is not stored in the database or in the application logs.

3. Purposes and legal bases

Providing the service you requested: account management, syncing with Hevy, volume and progression analysis (Art. 6(1)(b) GDPR).
Sending the weekly email report, which you can turn off in Settings (Art. 6(1)(b) GDPR).
Service security and abuse prevention, for example login attempt limiting (Art. 6(1)(f) GDPR).

We do not profile users, sell data or show advertising.

4. How we handle and encrypt your Hevy API key

The API key is a secret that allows reading your data on Hevy. We protect it with double-key encryption (envelope encryption):

You paste the key into the site after logging in. It travels over HTTPS only and is checked with a test call to Hevy.
For each key the server generates a random 256-bit data encryption key (DEK), used only for that key.
The API key is encrypted with the DEK using AES-256-GCM (96-bit nonce and 128-bit authentication tag).
The DEK is itself encrypted (AES-256-GCM) with a 256-bit key encryption key (KEK).
The database only contains: the encrypted API key, nonce, authentication tag, the encrypted DEK and the KEK version number. Neither the plaintext key nor the plaintext DEK is ever written to the database.
The KEK is kept separately from the database, in a file mounted on the server: it is not in the database nor in the application image. The KEK version allows it to be replaced over time.
The user identifier is bound to both encryption layers (additional authenticated data): a row copied to another user cannot be decrypted.
During a sync the server decrypts the DEK and then the API key in memory only, calls the Hevy API (api.hevyapp.com) and then zeroes the in-memory buffers.

A copy of the database alone, such as a backup, is not enough to recover your key without the KEK. The key is never shown again on the site after saving. Changing device has no effect, because the key stays on the server. If Hevy rejects the key, syncing is suspended until you enter a new one; you can delete it at any time from the Hevy key page.

5. Recipients

Hevy: receives your API key with every sync request and is an independent controller of the data it holds; its own privacy notice applies.
Resend (SMTP server): emails are sent through the Resend service, which receives your email address and the content of emails sent (account confirmation, password reset, weekly report) and acts as a service provider; its own privacy notice applies.
Cloudflare: the site is reached through Cloudflare (DNS, abuse protection and a tunnel to the server). Cloudflare sees traffic in transit, including your IP address, and acts as a service provider; its own privacy notice applies.
Hosting infrastructure: data is stored on servers operated by the controller.

The application uses no analytics services or third-party scripts.

6. Retention and deletion

Data is kept while your account is active. From Account → Personal data → Delete you can delete the account: the encrypted API key, workouts, routines and sync state are deleted as well. Technical logs are deleted after 7 days. Database backups may keep the data for a limited time after deletion, until they are rotated.

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 GDPR). You can download your account data and your training data (PDF, Markdown or JSON) from Account → Personal data; for other data, or to exercise a right, write to [email protected]. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante: garanteprivacy.it).

8. Security

The site is served over HTTPS, uses security headers and a restrictive Content Security Policy, limits the rate of login attempts and downloads, requires passwords of at least 12 characters and temporarily locks the account for 15 minutes after repeated failed logins. The Hevy API key is protected as described in section 4.

9. Cookies

We only use technical cookies: see the Cookie Policy.