PRIVACY

What we record, and what leaves the server

Last updated 2 September 2026. KRAFTful is operated by Tommy Mikkelsen, Randers, Denmark — the data controller for everything below. Questions: tommy@klaxon.dk.

The short version

KRAFTful is a small, self-hosted service. Your data sits on a single machine in Denmark that we own and run ourselves. It is not sold, not used for advertising, and not shared with anyone you have not explicitly granted access to. There is no third-party analytics or tracking in the app.

What is recorded

• Training — workouts, sets, weights, exercises, personal records, and any notes or photos you attach to a session.
• Nutrition — food entries, recipes, targets, and meal photos.
• Health — metrics you choose to share from Apple Health (weight, sleep, heart rate, steps and similar), plus anything measured in the app.
• Progress photos — posed check-in photographs and body-scan video frames, only if you use those features.
• Account — your email address, a password verifier (never the password itself), and session records. If you install the iOS app, a device registration.

Where it is stored

On a single server in Denmark, operated by us — not on a third-party cloud platform. Databases are backed up daily and backups are kept for fourteen days. Photographs are stored as files on the same machine.

Access is separated in the database itself, per account, so one person's records are not reachable from another's session. Coaches are the only exception, and only by grant — see below.

What leaves the server

Three things, and nothing else:

• Meal photos, when you use photo logging. The image is sent to Anthropic's vision API to estimate what is on the plate, and the estimate comes back for you to confirm.
• Progress photos and scan frames, when you use the body-scan or photo-alignment features. Frames are sent to the same vision service to measure proportions. If you never use those features, no photograph of you leaves the machine.
• Bank account information, in the private finance module — see the last section. This does not apply to KRAFTful client accounts.

We do not send your data anywhere for training, advertising or resale.

Coaches

If you link to a coach, that coach can see specific categories of your record — training, nutrition, health, and photographs — and each category is a separate grant. Holding one does not imply the others: a coach who can see your weight graph cannot see your progress photographs unless that grant exists. Unlinking revokes all of them.

Your rights

Under GDPR you can ask for a copy of everything held about you, ask for corrections, ask for deletion, or withdraw consent. Email tommy@klaxon.dk and it will be handled directly — this is a small service and requests are answered by a person, not a queue. Deletion removes your records from the live database; backups age out on the fourteen-day cycle described above.

The finance module

The operator runs a separate, private finance module on the same server, which reads his own bank accounts through Enable Banking Oy, a licensed account information service provider supervised by the Finnish financial regulator. Access is read-only, cannot initiate payments, covers only accounts explicitly linked by the account holder, and expires automatically unless renewed.

This module has no client users and holds no KRAFTful customer data. It is described here because the same operator and the same server are involved.