Controller: CaptureFit B.V., Douzastraat 28, 2201JD Noordwijk, Netherlands. Registered with the Dutch Chamber of Commerce under KvK 96695173.
Contact: privacy@captrcraft.com
1. The short version
Right now, CaptrCraft is a waitlist and a newsletter. We collect your email address because you gave it to us, we use it to tell you about CaptrCraft, and you can leave at any time. We don't sell data, we don't run ads, and we don't buy data about you from anyone.
When the CaptrCraft app launches, it will process training and health-related data to build your plan — under stricter rules, with your explicit consent, described in Section 5 so you can see the architecture before you ever hand us a heartbeat.
2. What we process today, and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address (waitlist signup) | To tell you when CaptrCraft launches, and to send the occasional update you signed up for | Consent — Art. 6(1)(a). Withdraw any time via the unsubscribe link in every email. |
| The optional price answer you give after signing up | To work out what to charge. It is one tap, it is optional, and skipping it changes nothing | Consent — Art. 6(1)(a) |
| Which page you signed up from, the referring site, and a campaign tag if you arrived through one | To see which writing actually brings people in, so we write more of it. Attached to the signup, not built into a profile | Legitimate interest — Art. 6(1)(f) |
| Anything you send us (email replies, messages) | To answer you | Legitimate interest — Art. 6(1)(f) |
| Server logs, and aggregate page analytics that set no cookies and build no cross-site profile | To keep the site working and see how many people read what | Legitimate interest — Art. 6(1)(f) |
We do not use your email for anything beyond the above. No profiling, no enrichment, no resale. The site sets no advertising or tracking cookies.
3. Who touches the data
Two providers today, both under data-processing agreements. This list is what is actually running, not what we intend to run:
- Resend — stores waitlist emails and sends the launch email, plus a notification to us when someone signs up.
- Vercel — hosts and serves this site, and produces the server logs and aggregate analytics described above. The site is served from Vercel's US East region, so this involves a transfer outside the EU, covered by Standard Contractual Clauses.
That is the whole list. The database, AI and wearable providers named in Section 5 process nothing today, because the app does not exist yet.
4. Your rights
You can ask us, at any time, to: access what we hold about you, correct it, delete it, export it, restrict or object to processing, or withdraw consent (which stops future processing but doesn't undo the past). Email privacy@captrcraft.com — no forms, no fee, answered within one month.
If you're unhappy with how we handle it, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to your own local EU authority.
Retention. Waitlist emails are kept until you unsubscribe or until we delete the list; unsubscribes are honoured immediately. Correspondence is kept as long as needed to handle it, then deleted.
5. When the app launches — the rules we've built toward
This section describes processing that will begin only when the CaptrCraft app is available, and only for people who create an account. We're publishing it now for transparency, not because any of it is happening yet.
What the app will process: training plans and logged sessions; profile details you provide (age, disciplines, schedule constraints, equipment); optional injury-history and screening answers; optional wearable data (activities, heart rate, sleep, HRV) if you connect a device account; and messages you send in the app.
Health data is special-category data. Training, physiology and screening information fall under GDPR Article 9. We will process it only with your explicit consent (Art. 9(2)(a)), collected per category, at onboarding:
- Plan consent — the data needed to generate and adapt your training plan. Without it the app can't do its job, and we'll say so plainly rather than bury it.
- Wearable consent — separate, per connected provider, via that provider's own authorization flow. Disconnecting stops the flow of new data.
- Research consent — a separate, optional, withdrawable consent for pseudonymised use of your training data to improve defaults and study how masters athletes respond to training. Declining it changes nothing about your plan. Withdrawing removes your data from future analyses.
AI-assisted planning, stated plainly. Plans are generated and adapted with the help of AI models operating under our training methodology's rules, and every plan is checked by a deterministic rule engine before you see it. Your plan can always show you why it looks the way it does. Plan generation is decision support for your training — it is not medical advice, and it produces no legal or similarly significant automated decisions about you in the sense of GDPR Art. 22.
App-era processors will include Supabase (database and authentication, hosted in the EU — Frankfurt), Anthropic (the AI models used to generate plans), Fly.io (the EU-hosted service that runs plan generation), the payment provider that handles your subscription, and any wearable platform you explicitly connect. Section 3 will be updated on launch day, and the in-app privacy screen will always show the current list.
Deletion means deletion. Account deletion removes your personal data from live systems and excludes it from future research analyses, subject only to legal retention duties. We built this as a tested feature, not a support ticket.
6. Things we deliberately don't do
No advertising or ad-tech on the site or in the app. No sale or rental of personal data. No data brokers. No dark-pattern consent flows — every consent is as easy to withdraw as to give. The service is not directed at children under 16.
7. Changes
If this policy changes materially we'll say so on this page and — for anything affecting app-era processing — in the app, before the change takes effect. Version history available on request.
Questions, requests, complaints: privacy@captrcraft.com. A human reads it.