Privacy policy
As of October 2026. The German version is the binding one.
1. Controller
Christoph Müller
Marienstraße 30, 63069 Offenbach am Main
Email: hello@goblingains.com
2. In short
This website sets no cookies, uses no analytics or tracking and shows no ads. The app at app.goblingains.com stores what you enter as your training log, and what your watch measures if you connect Garmin. Some of it is health data; it is processed only with your explicit consent and never sold or used for advertising.
3. Visiting the website
This website and the app are delivered from the server described in section 4. No other provider is involved in delivering them.
4. The app's server
The website and the app run on a server of netcup GmbH (Karlsruhe) in a data centre in Germany. The server logs requests with IP address, time and path, to deliver the pages and keep them secure; these logs are deleted after 14 days at most. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest being secure operation.
5. Account and approval
For an account we store your name, email address, a hash of your password (not the password), the times of sign-up, confirmation and approval, and your profile settings (such as time zone, goals and training style). New accounts are approved by hand; once you confirm, I receive an email with your name and email address. The database is hosted by Neon Inc. (USA) in Frankfurt am Main. Legal basis: Art. 6(1)(b) GDPR. Your account and all training data are deleted when you ask by email.
6. Emails from the app
Confirmation, password and approval emails are sent by Resend, Inc. (USA), which processes your email address and the message. Legal basis: Art. 6(1)(b) GDPR.
7. Training and health data
We store what you enter: sessions, exercises, sets, reps, loads, times, distances, effort (RPE), notes, check-ins with mood, soreness and pain per muscle group, injuries and rest days. Pain, injuries and heart rate are health data under Art. 9 GDPR. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), otherwise Art. 6(1)(b) GDPR. You can withdraw consent at any time, with effect for the future, by asking for deletion.
If you share a session or a training cycle with another person, they see what you shared, to the extent you choose when sharing.
8. Garmin
If you choose to connect a Garmin account, the app signs in once with your Garmin credentials; the password is not stored, only an encrypted access token. Activities (sport, time, duration, distance, pace, heart rate, heart rate zones, laps) and daily values such as resting heart rate, heart rate variability, sleep, steps and VO2max are then fetched and stored. Legal basis: your explicit consent (Art. 9(2)(a) GDPR). You can disconnect in your profile.
9. AI features
Some features use a language model from Anthropic PBC (USA): reading a workout from text or a photo, load suggestions, and building sessions and training cycles. Only the part each needs is sent, such as the photo, your history for one exercise, or your goals. Under its terms Anthropic does not use this data to train its models. Legal basis: Art. 6(1)(b) GDPR, and for health data your consent under Art. 9(2)(a) GDPR.
10. Storage in your browser
When you sign in, the app keeps a sign-in token and the time of your last activity in your browser's local storage; cached data lets you keep working on a poor connection. This is technically necessary to use the app (§ 25(2) no. 2 TDDDG). The sign-in data is removed when you sign out.
11. DNS and contact
Name resolution (DNS) for this domain is provided by Cloudflare, Inc. (USA). Emails to hello@goblingains.com are processed to answer them. Legal basis: Art. 6(1)(b) or (f) GDPR.
12. Transfers outside the EU
Neon, Resend, Anthropic and Cloudflare are based in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified, otherwise on standard contractual clauses (Art. 46(2)(c) GDPR). Data processing agreements under Art. 28 GDPR are in place with all providers, including netcup.
13. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), withdrawal of consent (Art. 7(3)) and objection to processing based on Art. 6(1)(f) (Art. 21 GDPR). You may complain to a data protection authority (Art. 77 GDPR), for example the Hessian Commissioner for Data Protection and Freedom of Information. Write to hello@goblingains.com.