PosecorLegal
Privacy policy
Last updated: 15 October 2026
1. Who we are
The controller of your personal data is Posecor (“Posecor”, “we”), the owner and operator of this website. Contact for anything about your data: hello@posecor.com.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email, password hash / sign-in identifiers | Create and secure your account | Contract (6(1)(b)) |
| Wishlist and contact messages: the name (optional), email address and message you send through the Upgrade form, and the language of the page | Read your feedback, decide what to build next and tell you when more exercises open | Consent (6(1)(a)), given when you send the form; legitimate interests (6(1)(f)) for answering |
| Technical logs (IP address, browser, timestamps) | Security, abuse prevention, fixing faults | Legitimate interests (6(1)(f)) |
| Support messages sent to hello@posecor.com | Answer your requests | Contract / legitimate interests |
| Usage analytics (Google Analytics): pages viewed, referrer, browser and device, approximate location, a random identifier in a cookie. The cookie and identifier only if you accept analytics cookies; before that, only cookieless page-view pings. | Understand which pages and exercises are used and improve Posecor | Consent (6(1)(a)), withdrawable at any time |
We use analytics cookies only if you accept them, through the banner shown on your first visit and the “Cookie settings” link in the footer; we do not use advertising cookies. See the cookie policy. Posecor does not collect exercise history, health or body data. If that changes we will update this policy first and ask for explicit consent where the law requires it (Art. 9).
Posecor does not take payments at the moment, so we hold no billing or card data.
3. Who we share data with
Service providers acting on our instructions: Cloudflare (website hosting), Supabase (authentication, the database holding accounts and wishlist messages, and the emails it sends for sign-in and password reset), and Google LLC (Google Analytics), which acts as our processor for analytics. Google may also use the data for its own purposes as described in its privacy policy; we have turned off Google signals and ad personalisation. We do not sell your data.
4. International transfers
Where a provider processes data outside the EU/EEA, we rely on an adequacy decision or Standard Contractual Clauses. Google LLC is in the United States and is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing adequate protection; Google also offers Standard Contractual Clauses. Cloudflare and Supabase offer Standard Contractual Clauses in their data-processing terms.
5. How long we keep it
Account data until you delete your account. Wishlist messages until you ask us to delete them, or until we no longer need them to plan what to build, whichever comes first. Server logs for a short period, generally no more than 30 days. Google Analytics data for 14 months, then it is deleted automatically.
6. Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. You can download your data or delete your account yourself from the Account page. Otherwise email hello@posecor.com. You may also complain to your local data-protection authority, for example via the list of EU authorities.
7. Children
Posecor is not aimed at children under 16, and we do not knowingly collect their data. If you believe a child has given us data, email hello@posecor.com and we will delete it.
8. Changes
We will post updates here and notify account holders of material changes.