Privacy Policy

Last updated: September 6, 2026

1. Controller

Norman Holz
Henry-Budge Str. 11d
22297 Hamburg, Germany
Email: ansage.coach@normanholz.de

2. Overview

We take your privacy seriously. This privacy policy explains what data is processed when you use the Ansage.coach service, when you visit this website, and when you purchase Ansage.coach. Section 3 describes the service itself in detail.

3. Data Privacy — the Ansage.coach Service

3.1 What data is processed, and at which stage

You use Ansage.coach by sending workouts to our Telegram bot as a voice message or as text. Each message passes through the following stages:

• Message gateway — your incoming Telegram message is received and routed onward.
• Transcription — voice messages are transcribed to text. The audio file is processed in memory only and discarded immediately after transcription. It is never written to disk or to logs.
• Coaching backend — the transcribed or original text is received and passed to an external large language model, which classifies the message as a workout description, a request for a new workout, or unrelated/spam content. For workout-related messages, the model returns structured output (exercises, weights, sets and reps). The backend then applies deterministic logic to calculate progressive overload percentages, including deload phases. The language model is used for inference only; your data is not used to train or fine-tune models.
• Response delivery — the backend sends its answer back to the message gateway, which calls the Telegram Bot API to deliver it to you.

The raw text of your messages is not stored long-term. Only the structured workout output is persisted, as your workout history, in the backend database. Raw message text is additionally sent to Langfuse in pseudonymized form, as described in section 3.7.

3.2 Data residency

All processing takes place within the EU: the message gateway (Cloudflare Workers, EU region), the transcription service (RunPod, EU region), the coaching backend (a self-managed server at Strato, EU region), the language model used for classification and extraction (IONOS Cloud, EU region, open-weights models only), and the evaluation and prompt-optimization service (Langfuse, EU region).

3.3 Sub-processors

• Cloudflare (Workers, EU) — message gateway, routing messages between Telegram and our backend. A data processing agreement is pending and has not yet been signed.
• RunPod (EU) — transcription of voice messages to text; audio is ephemeral and not stored. A data processing agreement is pending and has not yet been signed.
• IONOS Cloud (EU) — language model classification and extraction of structured workout data, inference only. A data processing agreement is signed.
• Langfuse (EU) — receives pseudonymized message text for prompt optimization and evaluation. The status of the data processing agreement is currently being confirmed.
• Telegram — the client you use to send voice or text input and to receive our responses. Telegram is not engaged by us as a processor; your use of Telegram is governed by Telegram's own terms and privacy policy.

The coaching backend runs on a server we manage ourselves, so no data processing agreement applies to it.

3.4 Retention

• Raw message text — not stored long-term in the backend. See section 3.7 for the pseudonymized copy sent to Langfuse.
• Voice recordings — processed in memory only during transcription and discarded immediately afterwards.
• Structured workout data, paid tier — linked to a persistent user profile and retained indefinitely, until you request deletion.
• Structured workout data, free tier — the free tier covers your first five logged workouts. Those workouts, together with your Telegram user, are retained for 12 months after the free tier ends, so that your history is still there if you decide to sign up for the full service. After 12 months they are deleted.
• Trial marker — you can request deletion of your data at any time, including during the 12-month period. When your data is deleted, we keep your Telegram user on record as a note that this account has already used a trial. We do this to prevent the same Telegram account from using the free tier repeatedly.

3.5 Legal basis for processing

Every user starts on the free tier. For free-tier use, the legal basis for processing is your consent (Art. 6(1)(a) GDPR), which we obtain at signup.

If you upgrade to the paid tier, which provides a persistent workout history, the legal basis for processing that retained data shifts to the performance of a contract (Art. 6(1)(b) GDPR).

The trial marker described in section 3.4 — your Telegram user, kept on record after deletion to show that this account has already used a trial — is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in preventing the same Telegram account from using the free tier repeatedly. Because this record exists for that purpose, it is retained even when you request erasure of your other data.

3.6 Why workout data is not treated as health data

Ansage.coach is positioned explicitly as a workout logging and progression-calculation tool. It does not provide health advice, and working out is at your own risk. Use of the service requires you to confirm that you are 18 or older.

We do not collect body metrics, injury history, or any medical information. The only data we store about your training consists of exercises, weights, and sets and reps. Because the data we collect is scoped in this way, and because the service does not draw health conclusions from it, we treat this data as fitness-logging data rather than as a special category of personal data under Art. 9 GDPR. This classification rests on the scoping described here: it would no longer hold if the service began collecting body, injury, or medical data.

3.7 Pseudonymized data sent to Langfuse

The raw text of your messages is sent to Langfuse for prompt optimization and evaluation. This data is pseudonymized, not anonymized. An identifier links the records back to you, so re-identification remains possible. Pseudonymized data is still personal data under the GDPR, and we treat it as such — including for the purposes of your data subject rights described below.

3.8 Your rights and how deletion works

Your rights under the GDPR are listed in section 8 of this policy and apply to the data described in this section.

Data subject requests are currently handled manually. There is no automated self-service deletion. To request full deletion — covering your structured workout history, the linkage to your Telegram ID, and the pseudonymous records held at Langfuse — email us at ansage.coach@normanholz.de.

4. Website Hosting

This website is a static site hosted on GitHub Pages, a service of GitHub, Inc. (San Francisco, USA), a subsidiary of Microsoft. When you visit the website, GitHub automatically collects and stores information in server log files that your browser transmits. This may include:

• IP address
• Browser type and version
• Operating system
• Referrer URL
• Date and time of the request

This data is processed based on our legitimate interest in ensuring the secure and efficient operation of our website (Art. 6(1)(f) GDPR). We have no access to these log files beyond what GitHub makes available to us.

Because GitHub is a US company, visiting this website may involve a transfer of your data to the United States. Microsoft Corporation, GitHub’s parent company, is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection for such transfers (Art. 45 GDPR). What GitHub collects is set out in the GitHub Privacy Statement.

All fonts used on this website are served from this website itself. No fonts, scripts, or other assets are loaded from third-party servers such as Google Fonts, so no data is transmitted to such providers when you browse.

This section concerns the website only. Processing of your workout data in the Ansage.coach service is described in section 3 and stays within the EU.

5. Payment Processing

Paid plans are billed through Paddle (Paddle.com Market Ltd) as Merchant of Record. When you subscribe, your payment and personal data — such as name, email address, and payment information — are collected and processed directly by Paddle. Paddle is the legal seller and handles payment processing, invoicing, tax collection, and refunds. We receive the data we need to activate your subscription, but we do not have access to your full payment details.

The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Checkout is not open yet, so no payment data is processed at this time. How Paddle handles that data is described in the Paddle Privacy Notice.

6. No Tracking or Analytics

This website does not use any analytics tools, tracking scripts, or cookies for marketing purposes. We do not use services such as Google Analytics, Facebook Pixel, or similar tracking technologies. No behavioral data is collected, and nothing you do on this website is linked to your use of the Ansage.coach service.

7. Cookies

This website does not set any cookies. If you are redirected to our payment provider for checkout, their website may use cookies as described in their own privacy policy.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You can request information about your stored personal data.
• Right to rectification (Art. 16 GDPR) — You can request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) — You can request deletion of your data, provided there is no legal obligation to retain it.
• Right to restriction of processing (Art. 18 GDPR) — You can request that we restrict the processing of your data.
• Right to data portability (Art. 20 GDPR) — You can request your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) — You can object to the processing of your data based on legitimate interests at any time.

To exercise any of these rights, please contact us at ansage.coach@normanholz.de.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) if you believe that the processing of your personal data violates the GDPR.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal reasons. The current version is always available on this page.