Privacy Policy (Website)
Last updated: July 14, 2026
1. Privacy at a Glance
Thank you for your interest in our websites. Protecting your personal data is very important to us. This privacy policy applies to the marketing website at phemilo.app and the public routine and training-plan pages at share.phemilo.app. A separate privacy policy applies to the Phemilo app and to creating public share links from the app.
2. Data Controller
The person responsible for data processing on this website is:
Lukas Möller, c/o POSTFLEX PFX-083-616, Emsdettener Straße 10, 48268 Greven, Germany, Email: support@phemilo.app
3. Hosting (IONOS and Cloudflare)
Our website is hosted by IONOS (IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany). We have concluded a data processing agreement (DPA) with IONOS. IONOS automatically collects technical data (server log files) such as IP address, browser type, and time of access whenever the website is visited. This is technically necessary to ensure the stability and security of the website (Legal basis: Art. 6 (1) (f) GDPR).
The public renderer at share.phemilo.app is delivered through Cloudflare Workers operated by Cloudflare, Inc. and its affiliated companies. Cloudflare may process technical connection and request data such as IP address, browser and device information, time of access, requested path, response status, and security signals to deliver and protect the service. The requested path contains the random share slug when a public routine or plan is opened. Worker invocation logs are retained for three days under our current Cloudflare Workers Free plan. Our legitimate interests are reliable delivery, abuse prevention, troubleshooting, and service security (Art. 6 (1) (f) GDPR).
4. No Public Email Signup on This Website
The current marketing website does not provide a newsletter, launch notification, or email signup form. If you contact us directly by email, we process your email address and message only to respond to your request.
5. Local Preferences and Cookieless Website Analytics
This website stores only local preferences such as theme and language selection in your browser when you choose them. These preferences are used only to display the website correctly for you.
For release and product improvement metrics, phemilo.app and share.phemilo.app may use PostHog Cloud EU in cookieless server-hash mode. PostHog acts as our analytics service provider. In this configuration, no analytics cookies are set, no local or session storage is used for analytics, no session recordings are enabled, and no persistent person profile is created. PostHog still receives the event and technical connection information necessary to process it; cookieless does not mean that no data processing occurs.
We collect only limited events such as marketing page views, section views, scroll depth, language or theme changes, public routine or plan page views, copy-link actions, open-app actions, QR-code display, and outbound App Store clicks. Share analytics may include aggregate day, exercise, and set counts, but never the share slug, exercise identifiers or names, image URLs, notes, health data, profile data, or user-authored content.
The legal basis is our legitimate interest in measuring aggregate use, evaluating releases, finding usability problems, and improving the websites without persistent visitor profiles (Art. 6 (1) (f) GDPR). You may object to this processing for reasons arising from your particular situation by contacting us. Analytics events are retained only for as long as needed for release comparisons and product-improvement analysis; we review this necessity at least annually and delete or aggregate data that is no longer required.
This website does not use advertising tracking or third-party fonts loaded from external font providers. All fonts are hosted locally.
6. Your Rights
Subject to the applicable legal requirements, you have the right to request access to, rectification or erasure of your personal data, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the alleged infringement. Please contact us at the email address above to exercise your rights.