Privacy policy

BoxLog is an app for logging your training. This policy explains what data of yours it handles, what for, who else is involved and what you can do about it. We wrote it to be understood. Who is responsible, and how to reach us, is in section 12.

1. In short

• Without an account, everything stays on your phone.
• With an account, we keep a copy of your training and photos so you don't lose them.
• In Social, only people you approve see what you share. Nothing is public.
• No ads, no tracking, no analytics, and we don't sell your data.
• You can delete your account in the app, and with it everything we keep.

2. What we handle and why

If you use BoxLog without an account. Your WODs, lifts, notes, photos, videos and settings are kept on your phone, and in your iCloud backup if you have it on (that is Apple's). Nothing reaches us except what is described below for reading the workout, searching for places and error reports.

If you create an account.

• Your email and password (or your Apple or Google account, if you sign in with one), to give you access. If you sign in with Apple or Google, they give us your email and your name, and Google also your account photo; with Apple you can hide your real email.
• Your history: WODs, lifts, notes, places, saved lists and settings. We keep them so you can get them back when you change phones or reinstall the app.
• Your photos and videos, for the same reason — private ones too, seen only by you.
• Account emails: verification codes and notices such as "password changed".
• Your acceptance of the Terms: which version you accepted and when, so we can show it and ask you again if they change. Until you accept them, the app copies nothing from your phone to the account.

To create an account, only your email (or your Apple or Google account) is needed. Everything else is optional: without it BoxLog still works, though not whatever depends on that detail.

If you use Social (optional, needs an account):

• Your @username, your name, your profile photo (optional) and, if you choose, your usual box.
• The WODs and lifts you share, with their photos, video and place. Anything set to "Only me" is not shared.
• Who you follow and who follows you, requests, kudos, comments, what you save, who you block and the reports you make.
• Tags: who you tag in a WOD for having trained with you, who tags you, and whether you accept each tag or remove it, and which WODs are copies of the same session.
• Your activity (who followed you, who gave kudos, commented or tagged you), to show it to you in the app.
• If you turn on notifications, your phone's notification token, its language and which notices you want.

Each notification (who and what; for a comment, its first words) passes through the notification-delivery service and Apple to reach your phone.

Reading the workout. When you attach pictures to a WOD, your phone first checks, on the phone itself, which ones have anything written on them: pictures with no text never leave it. Those that do (three at most each time) are sent to an AI service that finds which ones show the workout — the whiteboard photo, or a screenshot of a note, a chat or an app — and returns its text; if that service fails or is slow, to a second one. Each image is sent whole, with everything visible in it: in a screenshot of a chat, for example, the name and messages of whoever wrote to you. The app keeps only the workout's text, in your WOD. The pictures pass through our server without being stored; the providers do not use them to train their models and keep them at most as long as they need to prevent abuse (up to 30 days). We keep only anonymous counts (how many reads, how long they took, which service answered), with nothing about you. You can turn reading off in Settings → Transcription, and then no picture is sent.

Place search. When you search for where a WOD happened, what you type and, if you allow it, your approximate position (rounded to about 100 m) are sent to Apple Maps for that search. Nobody keeps them.

Error reports, only if you say yes. The app asks you once, and until you answer they are off. If you turn them on and the app fails, a technical report (the error, the phone model and an anonymous identifier kept on it) is sent to an error-reporting service (in the EU) so it can be fixed. It does not include your name, your email or your training. You can change this any time in Settings → Data → Crash reports.

This website. It uses no cookies and no analytics. It remembers in your browser the language you choose, and nothing else. Our web provider handles your IP address only to serve the pages and protect them from attacks.

3. Who else is involved

To work, BoxLog relies on providers who handle data only on our behalf and under contract:

When a provider handles data outside the European Economic Area, it does so with the safeguards the GDPR requires (the European Commission's standard contractual clauses or the EU-US Data Privacy Framework). You can ask us for a copy of those safeguards at hola@boxlogtraining.com.

4. What other people see in Social

• Anyone with a BoxLog account can find you by @username or name and see your @username, your name and your profile photo. Nothing else.
• Your approved followers also see what you share (WODs and lifts with their photos, video and place), your RMs and stats worked out only from what you shared, your usual box if you show it, the kudos and comments, and who follows you and whom you follow (the names, no numbers).
• So if you follow someone, their approved followers can see you in their followers list, even if they don't know you; and whoever follows you shows in yours to your followers. Someone who doesn't follow that person doesn't see their lists. Nobody you blocked, or who blocked you, sees you in any list, nor you them.
• Your email is never shown to anyone. What you save, and your saved lists, only you see.
• Your profile link (boxlogtraining.com/u/…) shows nothing about you on the web; it only opens the app.
• If someone tags you in a WOD (only someone you follow can), until you accept only you and they see it. If you accept, your @username shows on that WOD to whoever can already see it — their approved followers —; your own followers are not shown it because of that. You can remove the tag whenever you like, and nobody is told. If you add that WOD to yours, the copy is yours, with its photos and video, and it shows that person tagged, already accepted, since they tagged you first (they can still remove it).
• That WOD and the copies each person adds to theirs make one session: each of them shows the @username of everyone who accepted a tag on any of them, to whoever can see that WOD — so the followers of someone who copied the WOD may see your @username even if they do not follow you. Nobody sees a WOD they could not already see. If you remove your tag, you disappear from all of them.
• If you block someone, they stop seeing your profile and what you share, and you stop following each other.

5. Reports and moderation

If you report a post, a comment or a profile, we keep the report (who made it, what it is about and why) and it reaches us by email at hola@boxlogtraining.com, with what is being reported, to be reviewed. We may hide that content or suspend the account that posted it. The person who reports stops seeing it at once; the person reported is never told who reported them.

6. Why we may handle it (legal basis)

• To give you the service you ask for (your account, the copy of your data, Social, and reading the workout in the pictures you attach): performance of the contract, i.e. the Terms of Use. You can turn reading the workout off in Settings → Transcription.
• Your location and notifications: your consent, given in your phone's prompt and withdrawn in iOS Settings.
• Error reports: your consent, given when the app asks and withdrawn in Settings → Data.
• Security and moderation: our legitimate interest in the app working and being a safe place.

You can withdraw your consent at any time; that does not affect what was handled before you withdrew it.

We make no automated decisions and build no profiles that affect you. Reading the workout only turns what your pictures show into text, which you check before saving.

7. How long we keep it

• Your account, history, photos and what you have posted in Social: while you have the account.
• What you delete in the app (a WOD, a photo, a comment) is deleted from our copy too: from your other devices as soon as they open, and from our server after 30 days (that margin lets a deletion made by mistake be undone); photos and videos, the next time the app syncs after that.
• Activity notifications: 90 days.
• Error reports: up to 90 days.
• Reports and moderation emails: up to one year after they are resolved.
• Emails you send us: as long as needed to help you, and up to one year after.

If you delete your account (Settings → Account → Delete account), we delete your account, your history, your photos and videos, your Social profile, what you shared, your kudos, comments and tags, your followers and the reports you made — and, from the phone you delete it on, your WODs, lifts, photos and videos too.

8. Minimum age

You must be at least 14 to create an account and use Social (the age of digital consent in Spain). If we learn an account belongs to someone younger, we will delete it.

9. Your rights

You can ask to access your data, correct it, delete it, restrict or object to how it is handled, and receive it in a portable format, and withdraw your consent, by writing to hola@boxlogtraining.com. We will answer within one month at most. Many of these you can do yourself in the app. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD).

10. Security

Connections are encrypted, access to each piece of data is limited to who should see it, and the services' keys are never inside the app. No system is perfect: if a security breach could put you at high risk, we will tell you without delay, as the law requires.

11. Changes

If we change this policy in an important way (new data, a new use, a new provider or country), we will tell you before it takes effect, by email and in the app, explaining what changes. If a change needs your consent, we will ask for it separately, and you can say no. This policy is not accepted: it is information. Minor changes (wording, typos) only change the date.

Version 3 (29 October 2026): your approved followers can see who follows you and whom you follow, as on Instagram — so if you follow someone, their followers can see you in their list. Nobody blocked sees whoever blocked them in those lists, nor the other way round. We keep no new data.

Version 2 (18 October 2026): explains the legal basis of each use more clearly, what Apple and Google give us when you sign in with them, what this website handles, and how long we keep reports and emails. It also says when we will tell you about a security breach: if it puts you at high risk, as the law says. The new data is your acceptance of the Terms (which version, and when) and tags in WODs (who tags whom, whether it is accepted, and who trained in the same session); we use nothing for anything new. And we no longer keep your age, body weight or gender: the app stops asking for them, and any you had typed in are deleted from your history when it updates, and from our server at most 30 days later. And error reports are now sent only if you say yes: the app asks you once, and until then they are off. And whiteboard reading now reads the workout from any picture you attach, screenshots of a note, a chat or an app included: your phone first checks which pictures have anything written on them, and only those are sent.

This English version is a translation of the Spanish one; if they differ, the Spanish version prevails.

12. Who is responsible, and contact

BoxLog is a project of Mario Ramos, who is the controller of your data. For anything about it: hola@boxlogtraining.com.