Privacy policy

The controller of your data is Sergio Gualda Rodriguez. For any privacy matter you can write to sergio@sgualda.com.

Your account: your email address, your password (stored hashed, so that not even we can read it) and the date on which you accepted these terms.

What you tell us about yourself: your name, your age range, how much you move, what you want to achieve, which activities you like and, if you choose to give them, your sex, weight and height.

Health data: the considerations you mark (for example knee or back trouble, heart or blood pressure problems, pregnancy or postpartum), your weigh-ins and what you log each day: activities, time, effort, areas worked, steps, how you ate, how you slept and how you felt.

Reminders: if you turn them on, the time and time zone you choose and the identifier your browser gives us so we can send you notifications.

Technical data: our providers record, as any server does, the IP address and browser type of each request, so the service works and stays secure.

To provide the service you asked for: building your plan, saving your progress, syncing it across your devices and sending the reminders you turn on. The basis is the contract you accept when you create your account.

Health data is a special category and we only process it with your explicit consent, which you give when you create the account. You can withdraw it at any time by deleting that data or your account; the app keeps working without the optional data, although the plan will be less precise.

We do not use your data for advertising, we do not sell it and we do not build profiles for third parties. We make no automated decisions with legal effects on you: the plan is a recommendation that you choose to follow or not.

Only with the providers that make the service work, acting on our instructions: Supabase, which hosts the database and manages sign-in, with the data stored in the European Union (Ireland); Vercel, which serves the website; Resend, which sends the account emails; and your browser's notification service (Apple, Google or Mozilla), only if you turn on reminders.

Fonts are loaded from Fontshare's servers, which receive your IP address when that happens, as with any resource on a website.

Some of these providers are based in the United States. Where data is transferred outside the European Economic Area, the transfer relies on the safeguards provided by law, such as standard contractual clauses or the Data Privacy Framework.

For as long as you have the account. If you delete it from Profile, your account and all your data are removed from our database at that moment. Provider backups, where they exist, are deleted on their usual cycle.

You can view and correct your data in the app itself, export a full copy from Profile, and delete your account and everything in it whenever you like.

You can also ask us for access, rectification, erasure, restriction or portability of your data, or object to its processing, by writing to sergio@sgualda.com. We reply within one month at most.

If you believe we have not handled your data properly, you have the right to complain to the data protection authority in your country. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

We do not use advertising or analytics cookies. We use a single cookie, which remembers the language you chose.

The app keeps a copy of your data in your browser, so it works offline, along with your theme preference. When you sign out, that copy is removed from that device.

Data travels encrypted, and the database only lets each person read and write their own data. No system is infallible: if we detect a breach that affects you, we will tell you and notify the authority where required.

Welfitlab is for people aged 18 or over. We do not knowingly collect data from minors; if we find an account belonging to a minor, we will delete it.

If we change this policy in a meaningful way, we will let you know in the app or by email before the change takes effect.