Privacy policy

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Roman Agarkov
Berliner Allee 223
13088 Berlin, Germany
Email: support@norva.fit
Phone: +49 1567 9831591

Norva doesn’t have a data protection officer; the law doesn’t require one for Norva at present. For anything about your data, write to support@norva.fit.

Visiting norva.fit

norva.fit is hosted by Cloudflare, Inc. When you open a page, Cloudflare receives your IP address, the time, the address of the page and of the page that linked to it, and your browser and operating system. It uses them to deliver the page and to block attacks. We keep no access logs of our own.

Legal basis: our legitimate interest in a website that works and stays safe (Art. 6(1)(f) GDPR).

The website sets no cookies and stores nothing on your device. Its fonts and images come from norva.fit itself, not from Google or anyone else.

Visitor statistics

To see which pages and links bring people to Norva, we use PostHog on norva.fit, on its EU servers in Frankfurt, in its cookieless mode. It records the pages you open and the links and buttons you press. It sets no cookies and stores nothing on your device. To count visitors without an identifier, PostHog’s servers turn your IP address and browser into a one-way code with a key that changes every day, so a visit can’t be linked to you, to your next visit or to an account in the app.

You can object at any time.

Legal basis: our legitimate interest in knowing what works on our website (Art. 6(1)(f)).

Your account

You create an account at app.norva.fit or in the mobile app.

Signing in

Supabase, Inc. runs sign-in for us, on servers in Frankfurt. It holds your email address, your password (as a hash) and your sign-in sessions, and sends the emails with your verification and password-reset codes. Your password goes straight to Supabase; our server never sees it. It doesn’t fingerprint your device or show you a CAPTCHA.

If you sign in with Google or Apple, they confirm who you are and give us your name and email address. Apple can give us a private relay address instead of your real one. Google and Apple do this under their own privacy policies.

Your profile

• Your name and the sports you train (CrossFit, HYROX).
• Your date of birth, to check that you’re old enough for Norva. Nobody else sees it.
• Your gender, if you give it. You can choose “Prefer not to say”.
• Your units (metric or imperial) and your weekly training goal.
• Your profile photo, if you add one.

To create an account you need an email address (or Google or Apple sign-in), your first name, your date of birth and the sport you train. Everything else is optional; without those four we can’t open an account.

Your photo is stored in Cloudflare R2 and served from a public address that can’t be guessed: anyone who has the address can open it. Your coach, the people you coach and the members of your groups see it next to your name.

Each time the app talks to our server, it sends your device’s time zone, so Norva knows what “today” is for you and when a day counts as missed. It tells us roughly which part of the world you’re in, nothing more precise.

Our server and database run at Render Services, Inc.

Legal basis: providing the service you signed up for (Art. 6(1)(b)).

Training, body and health data

Your workouts, scores and notes, personal records and body-weight log are your training data. Some of it can say something about your health: your body weight, for example, or what you write about how a session felt. The GDPR treats health data as a special category (Art. 9).

We keep and use this data only with your explicit consent (Art. 9(2)(a)), which you give when you start using Norva. You can withdraw it at any time in Settings; that doesn’t affect anything done before. Withdrawing it deletes your account, since Norva can’t keep your training without it.

Your body weight and your gender, if you gave them, are saved with each score and record you log, so a result keeps the body weight and category it was set at. We never use training or health data for advertising.

Coaching and groups

When you accept a coach’s invite, that coach can see, for as long as they coach you:

• your name, photo and sports;
• the workouts they give you, with your scores and notes, and whether each day was done, skipped or missed;
• your lift records, which their percentages are based on;
• your HYROX results, including simulations you logged on your own.

Your coach doesn’t see your email address, date of birth, gender or body-weight log, or workouts you plan yourself or get from another coach. In a group, members see each other’s names and photos, not each other’s results.

Your coach adds to your data too: the workouts they write for you, and their comments on your training.

Either of you can end coaching at any time. The coach then loses access to all of the above and to your conversation. Unscored workouts they gave you for today or later are removed; everything you’ve done stays in your diary, and you can still read the conversation.

While data is in Norva, we are responsible for it. If a coach copies an athlete’s data out of Norva, into their own notes for example, the coach is responsible for that copy.

Legal basis: providing the coaching you and your coach use (Art. 6(1)(b)); for health data, your consent (Art. 9(2)(a)).

Conversations

A coach and an athlete share one private conversation, and comments under a workout belong to it. Stream.io, Inc. runs conversations for us. It stores your messages and reactions, the photos and videos you send, and your name and photo to show next to them. The mobile app compresses photos and videos on your phone before sending them.

Only the two of you can read a conversation in Norva. When coaching ends, the athlete keeps it to read and the coach loses it. If either of you deletes your account, the conversation is deleted for both.

A word filter flags messages with common English swear words so that a person can look at them; it doesn’t block or change anything. Messages you report go to a person too. We read messages only in these two cases, or when you ask us to.

Legal basis: Art. 6(1)(b); for health details you choose to write, your consent (Art. 9(2)(a)).

Paste from notes

Coaches can paste an athlete’s week from their notes into Norva on the web. The text goes to Anthropic, PBC (USA), whose language model turns it into draft workouts. Anthropic receives the pasted text and Norva’s list of exercises, and nothing else about you or your athlete. It doesn’t train its models on this text, and deletes it within 30 days, unless it flags the text for misuse (then up to 2 years) or the law requires otherwise.

Paste only the training. Leave out health details, contact details and anything else about your athletes that the workout doesn’t need.

Legal basis: providing the feature you asked for (Art. 6(1)(b)). Transfer: Standard Contractual Clauses.

Feature requests

Feature requests in the web app and the mobile app open a board run by UserJot, a product of LogSnag LLC (USA). When you open it, UserJot receives your account’s internal ID and your email address, not your name or photo, along with your IP address and details about your browser or phone. It keeps what you do on the board: the ideas you post, your votes and your comments.

The board is public: anyone can read its ideas and comments, shown without your name or email. UserJot emails you when an idea you posted, voted for or commented on changes status, or when someone replies. Deleting your Norva account doesn’t reach UserJot. To have your email removed there, write tosupport@norva.fit.

Legal basis: providing the feature you open (Art. 6(1)(b)). Transfer: Standard Contractual Clauses.

Notifications and email

Supabase sends your account emails through Resend: verification and password-reset codes. We don’t send newsletters or marketing email.

In the mobile app, if you allow notifications, your phone gives the app a token for them. We store it with your account and pass it to Stream for message notifications; Apple’s push service delivers them. A notification says only “New message” or “Your coach published new workouts”, with no names and no message text. [Production Stream app uses the Norva push template] Signing out on that phone removes the token, and you can switch notifications off in iOS Settings. The web app sends no notifications.

Legal basis: Art. 6(1)(b).

App updates

When the mobile app starts, it asks Expo’s update service (650 Industries, Inc., USA) whether a newer version of the app’s code exists, and downloads it if one does. Expo receives your IP address, your phone’s platform, the app’s version and update, and a random identifier for this installation.

Legal basis: our legitimate interest in shipping fixes quickly (Art. 6(1)(f)). Transfer: EU–US Data Privacy Framework.

Exercise videos

The movement demos in Norva are videos on YouTube. When a screen shows one, the web app and the mobile app load its preview image from YouTube, a service of Google Ireland Limited, so Google receives your IP address and details about your browser or phone. When you play a video, YouTube’s player loads from YouTube, which can set its own cookies and uses your data under Google’s privacy policy.

Legal basis: our legitimate interest in showing how a movement is done (Art. 6(1)(f)); for YouTube’s cookies, your consent when you start a video (§ 25(1) TDDDG). Transfer: EU–US Data Privacy Framework.

Analytics, logs and error reports

In the web app and the mobile app we use PostHog, on its EU servers in Frankfurt, to see which features are used and to find and fix errors. PostHog receives events (a screen opened, a button pressed), information about your device or browser, error reports and app logs. They’re linked to your account’s internal ID, not to your name or email. In the web app, the label of a button you tap is sent with the event, and a few labels contain names, such as your own name and email on the Account page, or an athlete’s name in their coach’s list. PostHog doesn’t store your IP address with events; it may use it to look up your approximate location before discarding it. Session replay is off: PostHog doesn’t record your screen.

Our server also sends PostHog its own errors, how much text each Paste from notes used, and two events about a coach’s activity (a week published, an athlete’s score logged), without the athlete’s identity.

• Usage analytics: our legitimate interest in knowing which features are used, to make Norva better (Art. 6(1)(f)). PostHog stores nothing on your device for them. You can switch them off in Settings; error reports keep coming.
• Error reports, app logs and the server’s events: our legitimate interest in an app that works (Art. 6(1)(f)).

When you delete your account, PostHog deletes your profile within minutes and its events within about a week.

Transfer: PostHog, Inc. is a US company; its data processing agreement includes the Standard Contractual Clauses.

Storage on your device

• norva.fit stores nothing.
• app.norva.fit keeps your sign-in session and a few settings in your browser’s storage: your theme, how you last signed in, and the layout choices you make. These are needed to run the app the way you set it up (§ 25(2) no. 2 TDDDG). If you play an exercise video, YouTube’s player can set its own cookies. If you open Feature requests, UserJot keeps its session for the board there too. PostHog stores nothing in your browser.
• The mobile app keeps your sign-in on the phone, along with your settings, a copy of recent data so it opens without a connection, and scores you logged offline until they’re sent. It asks for your camera, photos and microphone only when you choose to take or send a photo or video, and never for your location. If you play an exercise video, YouTube’s player can set its own cookies in the app; if you open Feature requests, UserJot keeps its session for the board.

Support

When you write to support@norva.fit, Cloudflare Email Routing forwards your email to our mailbox at Gmail (Google). We reply from support@norva.fit through Resend (USA). We use what you send only to help you, and keep support emails for 2 years.

If you send us a program to move it into Norva, we use it only for that and delete your email and its files within 30 days. Leave out your athletes’ health and contact details.

Legal basis: Art. 6(1)(b) when it’s about your account; otherwise our legitimate interest in answering you (Art. 6(1)(f)).

Payments

None. Norva is free while it’s in beta and asks for no payment details. We’ll update this policy before any paid plan starts.

Who receives data

Besides the people you share with in Norva, these providers process data for us. Authorities receive data only where the law requires it.

Cloudflare, Inc.

Hosting, profile photos, support email forwarding

Render Services, Inc.

Our server and database

Supabase, Inc.

Sign-in and account emails

Stream.io, Inc.

Conversations

Anthropic, PBC

Paste from notes

LogSnag LLC (UserJot)

Feature requests

PostHog, Inc.

Analytics and error reports, website statistics

650 Industries, Inc. (Expo)

App updates

Apple

Push notifications, Sign in with Apple

Google

Sign in with Google, exercise videos on YouTube, our support mailbox (Gmail)

Resend

Account emails, replies to support email

Transfers outside the EU

Several of these providers are US companies, so some of your data can reach the USA. Where a provider is certified under the EU–US Data Privacy Framework (DPF), the European Commission’s adequacy decision of 10 July 2023 covers the transfer (Art. 45 GDPR). Otherwise, and as a fallback, the transfer rests on the EU Standard Contractual Clauses (SCCs) in the provider’s data processing terms (Art. 46). Write to us for a copy.

How long we keep data

Your rights

You can ask us at any time:

• for a copy of your data and how we use it (Art. 15), also in a machine-readable format to take elsewhere (Art. 20);
• to correct it (Art. 16); most of it you can edit yourself in the app;
• to delete it (Art. 17); you can delete your whole account yourself;
• to restrict how we use it (Art. 18).

You can object to anything we do on the basis of legitimate interest (Art. 21), and withdraw any consent at any time, for the future (Art. 7(3)).

Write to support@norva.fit from the email address on your account, so we know it’s you. We answer within one month (Art. 12(3)).

You can also complain to a data protection authority (Art. 77). Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin; you can also turn to the one where you live or work.

Age

Norva is for people aged 16 and older. We ask for your date of birth when you sign up and don’t create accounts for anyone younger; if we find an account that belongs to someone under 16, we delete it.

What we don’t do

• We don’t show ads, and we don’t sell or rent your data.
• We don’t track you across other companies’ apps or websites.
• We don’t use your training or health data for marketing.
• We don’t make decisions about you based solely on automated processing (Art. 22).

Security

• Every connection to Norva is encrypted.
• Your password goes to Supabase and never reaches our server.
• Only the people who run Norva can reach its systems. [Who can reach the systems; 2FA on every provider]
• If a breach puts your data at risk, we report it to the authority within 72 hours and, where the law requires it, tell you without delay.

Changes to this policy

When this policy changes, we update the date at the top. If a change affects data you’ve already given us, we tell you in the app or by email before it takes effect.