Privacy

Short version: free plans are generated in your browser and stay on your device. If you create an account, we store your email address, your Premium status and — so they sync between devices — your profile and latest plan, in a database in the EU. Cycle data is only stored in your account if you explicitly opt in. No ads, no analytics, no tracking.

Who we are

Overachiever (overachiever.eu) is the controller for the data described here. Contact: [email protected].

Without an account

You can use the free generator without an account. Your profile (age, bodyweight, goals, equipment, injuries), your plan, check-ins and IP-tracker logs are saved in your browser's local storage on this device only. Nothing is sent to us when you generate a free plan.

With an account

Accounts are optional and passwordless: you sign in with a link we email you. We store:

Account: your email address, an account id, when the account was created and when you last signed in, and your cycle-data choice (with the time you gave consent).
Sign-in links: a hashed copy of each one-time sign-in token (never the token itself), with its expiry. Links work once and expire after 15 minutes.
Sessions: a hashed session id with created, last-used and expiry times, so you stay signed in. The session cookie is HttpOnly, Secure and SameSite=Lax.
Premium: your Premium entitlement — the Lemon Squeezy order or license id, the email it was bought with, and when it was granted or refunded.
Synced data: your latest training profile and your latest generated plan, so they're available on all your devices.
Abuse protection: hashed counters of sign-in requests per email address and per IP address (not the address itself), to rate-limit sign-in emails.

Check-ins and IP-tracker logs are never stored in your account — they stay on your device.

Legal basis: providing the account and Premium you asked for (GDPR art. 6(1)(b)); rate limiting and security (art. 6(1)(f), legitimate interest); cycle data only with your explicit consent (art. 9(2)(a)).

Cycle data (health data)

Cycle settings — date of your last period, cycle length and hormonal contraception — are health data. They are not stored in your account unless you tick the opt-in box on your account page. Without the opt-in, cycle settings are removed before your profile is synced, and a plan built on cycle data stays on your device. You can withdraw consent at any time on the account page; we then delete the cycle data stored in your account straight away.

Where your data is stored

Account data is stored in Cloudflare D1, created with Cloudflare's EU jurisdiction, so the database is stored and processed inside the European Union. The site and its API run on Cloudflare Pages.

Processors and other services

Cloudflare (hosting, API and database): processes requests and stores account data in the EU database described above. Cloudflare may keep standard technical logs (such as IP address and requested page) for security and operations.
Resend (email): sends your sign-in emails. It receives your email address and the email content (the sign-in link). Resend is a US company; where data is processed outside the EU/EEA, the transfer relies on safeguards such as the EU Standard Contractual Clauses in its data processing agreement.
Lemon Squeezy (payments): sells Premium as merchant of record. When you buy, your name, email, payment details and billing address go to Lemon Squeezy, which handles payment, VAT, receipts and refunds under its own privacy policy. If you're signed in, the checkout is prefilled with your email and your account id so the purchase can be attached to your account. Lemon Squeezy then notifies us of the order or refund (order id, email, status), and checks license keys you redeem. We never see your card details.
Hevy (only if you push routines): the routines and your Hevy API key pass through our server to Hevy's API for that push only. We don't store or log the key. Your browser remembers it only if you tick “Remember the key on this device”. Hevy's privacy policy applies to data in Hevy.
Liftosaur (only if you open a plan in Liftosaur): the program is packed into the link and opened on liftosaur.com.

Premium features (IP mode, cycle-based plans, add-ons, check-in adjustments and app exports) are computed on our server for signed-in Premium users. The inputs are processed for that request and not stored, except your profile and plan as described under Synced data.

How long we keep it

Sign-in tokens: valid for 15 minutes and single use; removed by routine clean-up, normally within about an hour after they expire.
Sessions: 30 days after you last used the site, or until you sign out.
Rate-limit counters: at most 24 hours.
Account, Premium status, profile and plan: until you delete your account. Withdrawing cycle-data consent deletes stored cycle data immediately.
Payment records are kept by Lemon Squeezy as required by tax law, independently of your account here.

Your rights

On your account page you can export your data (a JSON file with everything stored about you) and delete your account, which permanently removes your account, sessions, synced profile and plan and the Premium link on our side. You also have the right to rectification, restriction and objection, and to complain to a data protection authority (in Denmark: Datatilsynet). Contact us at the address above.

Cookies

Only if you sign in: a session cookie (__Host-oa_session, HttpOnly) that keeps you signed in, and oa_in, which only tells the page to show “Account” instead of “Sign in”. Both are strictly necessary and expire after 30 days of inactivity or when you sign out. No analytics or advertising cookies.

Delete data on this device

Clear what's saved in this browser with the button below, or by clearing this site's data in your browser settings. This doesn't affect your account.