Carnet privacy notice
Last updated: 2026-10-19
Carnet is a training log for powerlifting athletes and their coaches. It is a small, free, non-commercial project built and run by one person, Cristian Crețan, in Romania. This page says what Carnet stores about you, who can see it, where it lives, how long it stays, and what you can ask for.
Contact for anything on this page: carnet@carnet.coach
Version française : carnet.coach/privacy/fr/
Coach terms: carnet.coach/privacy/coach/
Who is responsible
Two roles, because Carnet is used by coaches to work with their athletes:
- Your coach decides what training data is collected about you and why: they write your plan and ask you to log sets, pain, sleep and check-ins. For that training data your coach is the controller.
- Cristian Crețan runs the app and the servers. For your training data he is the coach's processor: he stores it and keeps the app working, and does nothing else with it. Each coach accepts the coach terms in the app, which say exactly that.
- For your account itself (email, name, sign-in) and for running the service (security, backups, fixing bugs), Cristian is the controller.
Cristian also coaches one athlete himself; for that athlete he is coach and operator at once, so there are no coach terms to accept between the two roles.
In practice: you can write to the contact address above for anything, and it will be handled or passed to your coach where the decision is theirs.
What Carnet stores and why
| Data | Examples | Why |
|---|---|---|
| Account | email, display name, profile picture, language, password (stored hashed by the sign-in service) | to sign you in and show your name to your coach |
| Athlete profile | level, bodyweight, weight class, sessions per week | so the coach can plan |
| Training plan | blocks, weeks, sessions, exercises, prescriptions, the coach's notes and limits (for example "no deficit deadlifts: back pain") | so you see what to do |
| Logged sets | kg, reps, RPE, pain (EVA 0–10), outcome, when each set was done, corrections and undos | the core of the log; the coach reviews it |
| Check-ins | hours of sleep, sleep quality, pain and where it hurts, motivation, stress, calories (low/normal/high) | so the coach can adjust the load |
| Session posts | how the session felt (1–10), pain after | same |
| Notes | messages between you and your coach | communication |
| Library | articles and videos your coach uploads, and which ones you opened | coaching material |
| Coaching links and invites | who coaches whom, who invited whom and when | to decide who sees what |
| Push notifications (iPhone) | your device's push token and its language, if you allow notifications | to tell you when your coach has planned a week or a block |
Pain, sleep, stress, bodyweight and similar entries are health data (GDPR Art. 9). Carnet asks for your explicit consent in the app, once: at first sign-in, or at the next start for people already using Carnet (Art. 9(2)(a)), and only uses them for your coaching. The rest of your data is processed to provide the service you signed up for (Art. 6(1)(b)), and backups and security logs on the basis of keeping the service safe and recoverable (Art. 6(1)(f)).
The app on your phone keeps a copy of your data and your sign-in session on the device, so it works without signal.
Carnet has no analytics, no ads, no tracking, and never sells or shares your data with anyone beyond the people and services listed here. The app sends no emails: invites are links that the inviting person shares themselves.
Who can see it
- You see all your own data.
- Your current coach sees your plan, sets, check-ins, posts and library views while you are linked as their athlete. When the coaching link ends, they lose access. Notes are per coach: a new coach does not see the notes you exchanged with a previous one.
- Nobody else using Carnet can see your data. This is enforced by the database itself (row-level security), not only by the app.
- Cristian, as the operator, can technically access the database and the backups. He does so only to run, fix or restore the service, or when you ask him to.
Where it is stored
- Database, videos and profile pictures: Supabase, in the AWS data centre in Ireland (eu-west-1). Your data stays in the EU.
- Nightly backup: a copy of the database is saved each night to Cristian's own computer in Romania, on an encrypted disk, in a folder only his account can read. Library videos are not in the backup.
- Web app: the website carnet.coach is served from a virtual server rented from Vultr, in Chicago, USA. That server holds only the app's code and this page, plus the web server's access logs (IP address, time, path requested), rotated daily and kept 14 days. None of your training or account data is ever sent to it: in the browser, the app talks straight to Supabase in Ireland.
- Fonts on the web: the web app loads fallback glyph fonts from fonts.gstatic.com, so Google receives your IP address when your browser fetches a font file. Nothing else goes to Google.
- Push notifications: on iPhone, "your coach planned week 3" reaches you through Apple's push service. Apple receives your device's push token, that sentence and the id of the week it is about, never a training detail.
Sub-processors and other recipients
| Who | What for | Where |
|---|---|---|
| Supabase Inc. (on Amazon Web Services) | database, sign-in, file storage | EU (Ireland) |
| Vultr (The Constant Company, LLC) | the virtual server that serves the web app's code and this page; holds only that and the access logs (IP address, time, path; 14 days), never training or account data | USA (Chicago) |
| Google LLC (Google Fonts) | fallback font files for the web app; receives your IP address with each font request | USA; EU-US Data Privacy Framework participant |
| Apple Inc. (Apple Push Notification service) | delivers push notifications to iPhones; receives the push token, the notification text and the id of the week it is about, never a training detail | USA; EU-US Data Privacy Framework participant |
Coaches are told before a new sub-processor is added.
How long it is kept
- While your account exists, your data is kept so your history stays complete. Logged sets are never edited in place: a correction or undo is recorded next to the original.
- When you ask for your account to be deleted, your data is removed from the live database within 30 days of the request. If you are a coach, notes you wrote stay in your former athletes' threads without your name, so their history stays whole.
- Backups roll off automatically: each nightly copy is deleted after 30 days, so a deletion is gone from every backup at most 30 days later.
- Web server access logs are deleted after 14 days.
Your rights
You can ask for any of the following by writing to carnet@carnet.coach. You get an answer within one month, usually much sooner. For now requests are handled by hand, by email; export and account deletion from inside the app are planned.
- Access and export: a copy of all your data in a common format (CSV or JSON).
- Correction: fix wrong account details; a set you logged wrong can be corrected in the app yourself (in your current block), or by asking.
- Erasure: delete your account and all your data.
- Withdraw consent: you can withdraw your health-data consent at any time. Since health entries are central to the log, this means deleting the health data and, in practice, usually the account. Withdrawing does not make past processing unlawful.
- Restriction and objection: ask to pause or object to processing.
- You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or the authority where you live.
If the request is about training data your coach controls, Cristian tells your coach and carries it out on their instructions; erasure of your own account is always honoured.
If Carnet shuts down
Carnet is a hobby project, so it may stop one day. If it does:
- Every user gets at least 60 days' notice, in the app and by email to the address on the account.
- During that time anyone can ask for a full export of their data, and coaches get an export of their athletes' training data.
- After the notice period, all data is deleted from Supabase, and the backups are gone within 30 days after that.
Who can use Carnet
Carnet is for people aged 16 or older.
Changes
If this notice changes in a way that matters, users are told in the app before it applies.
Rezumat în română
Carnet este un jurnal de antrenament gratuit, administrat de Cristian Crețan (România). Stochează contul tău (email, nume), planul de antrenament, seriile înregistrate (kg, repetări, RPE, durere), check-in-urile (somn, durere, motivație, stres, calorii), notițele și materialele de la antrenor. Durerea, somnul, greutatea corporală și datele similare sunt date despre sănătate: le stocăm doar cu acordul tău explicit, cerut la prima autentificare. Datele le văd doar tu și antrenorul tău actual. Antrenorul este operatorul datelor tale de antrenament; Cristian este persoana împuternicită (le stochează pentru antrenor) și operator pentru cont. Datele sunt în UE (Supabase, Irlanda), cu o copie de rezervă nocturnă pe un disc criptat, păstrată 30 de zile. Fără reclame, fără analiză, fără vânzarea datelor. Carnet este pentru persoane de cel puțin 16 ani. Poți cere oricând o copie, corectarea sau ștergerea datelor ori retragerea acordului la carnet@carnet.coach; ștergerea se face în 30 de zile, iar copiile de rezervă dispar în cel mult 30 de zile după aceea. Dacă Carnet se închide, primești 60 de zile de preaviz și un export complet, apoi datele se șterg.