Privacy Policy — CrossFit Power

Last updated: 29 August 2026 · Applies to CrossFit Power v1.0.0 and later.

This policy applies to CrossFit Power — both the free version (5-workout trial) and CrossFit Power Pro (they are the same app). Other apps published by BIKINTULIS have their own policies — see the directory.

CrossFit Power Pro has one optional online feature: workout sync. You can build your own WODs at bikintulis.de/crossfit-sync and download them to the watch. It is described in full in section 5, and it is the only web request the app ever makes — there is no analytics, no crash reporting, no advertising and no update check anywhere in the binary. If you never open the Sync screen, nothing in section 5 applies to you and everything else below is the whole story.

The free version cannot use it at all. It is built without the sync code, does not request internet permission, and cannot reach any server — see section 3.

1. Who we are

BIKINTULIS is an independent developer of Garmin Connect IQ apps. For questions about this policy, use the contact form. CrossFit Power is not affiliated with, endorsed by, or sponsored by CrossFit, LLC; "CrossFit" is a registered trademark of CrossFit, LLC, used here descriptively to refer to the training style.

2. Summary in plain language

• CrossFit Power runs entirely on your watch. Apart from the optional workout sync described in section 5, it makes no network or web requests and talks to no server. In the free version there is no BIKINTULIS server involved at all — it contains no networking code.
• The sync, in Pro and only if you use it, is download-only and needs no account: no email, no password, no username, no sign-up. A random device key generated on your watch is the identity, and workouts travel one way — website to watch. The watch never uploads a completed WOD, a personal best or a heart rate.
• It reads your heart rate, (optionally) GPS, and — and, while Auto rep count is on, which it is unless you turn it off — the motion sensor, all on the device during a workout; those values are processed locally and recorded into the activity.
• Your athlete profile, personal bests and history are stored only on the watch.
• Each session is saved as a standard Garmin activity (FIT), with one lap per movement, which your watch syncs to your own Garmin Connect account just like any built-in workout — under Garmin's own policy (see section 7).
• It asks for no name, email or account, and contains no advertising or analytics.

3. Permissions this app requests

The app requests no other permission. The free version requests no internet/communications permission of any kind.

4. Data stored locally on the watch

• Your athlete profile (level, Rx or scaled default, gender, goal time) and settings (language follows the watch).
• Your custom workouts and weekly plan.
• History and personal bests (per workout, per benchmark movement, per lift) and workout counts. Each saved session also keeps its average and maximum heart rate and its calorie total.
• In Pro, if and only if you use the sync feature: the random device key described in section 5, and the workouts downloaded from the website.

This data stays on the watch and is removed when you uninstall the app.

5. Data sent to a server — the optional workout sync

In the free version: none. It has no networking code and contacts no server. In CrossFit Power Pro: none either, unless you use the workout sync. The app contacts our server only when you ask it to — when you open the Sync screen, or choose Sync now. It never syncs automatically, never in the background, and never during a workout.

Simply opening the Sync screen is already the start of it: the watch asks our server for a pairing code as soon as that screen appears, and that alone creates a device record and a code on our server, even if you never type the code into the website.

What the watch sends

• a device key — 32 random hexadecimal characters generated on your watch the first time you open the feature. It is not your Garmin ID, not a serial number, and is not linked to your Garmin account or to you personally;
• an app identifier, so the server knows the request came from the paid app.

That is all. It does not send your location, your heart rate, your session results, your personal bests, your training history, your Garmin account details, your watch model, or any other data. Sync travels one way only — website to watch.

What we store on our server

• The device key (the random string above), with the dates it was created, paired and last synced, and which edition of the app that watch is running — that last one is what lets the builder label your watches in the "Workouts for" dropdown.
• The workouts you build — their names, their workout type (AMRAP, EMOM, Tabata, rounds for time, for time, chipper or a single lift) and that type's setting (a time cap, a number of rounds or a number of minutes), and for each movement: which movement it is, chosen from the app's own fixed list of 68, how many reps, metres, calories or seconds, and the optional weight in kilograms.
• Pairing codes — a 6-digit code that works for 15 minutes and can be used once. After that it stops working; the used-up code row itself stays in our database for up to 24 hours and is then deleted.
• A cookie in your browser (see section 8).

Please bear in mind that the workout name is free text. Whatever you type into it is stored as typed. Everything else in a workout is a number or a movement chosen from the app's own fixed list, so the name is the only field that could hold personal information. Keep it to training details — don't put anything personal in there.

The workouts you build do leave your watch's manufacturer environment — they are stored on our server at bikintulis.de so your watch can download them. That is the whole point of the feature, and we say it plainly.

Apart from that, the only data that ever leaves the watch is the standard Garmin activity (FIT) your watch syncs to your own Garmin Connect account, which is handled entirely by Garmin (see section 7).

6. What this app does NOT collect or send

• No name, email address, phone number, postal address, or account credential — there is no account to hold them.
• No transmission of your location — any GPS fix is used only on the watch and stored in your activity.
• No heart rate, calories, session results, personal bests or training history are ever uploaded — the workout sync is download-only.
• No Garmin account information — we have no access to it.
• No advertising or analytics SDKs of any kind, and no tracking.

7. Garmin Connect & your Garmin account

The app runs inside Garmin's Connect IQ platform and records a standard activity. When your watch syncs, that activity goes to your Garmin Connect account — exactly like any built-in workout. Garmin's own collection and use of data is governed by Garmin's policy at garmin.com/privacy. BIKINTULIS has no access to your Garmin account, your activities, or anything synced to Garmin Connect.

8. The bikintulis.de website

Separate from the app, when you use the bikintulis.de website itself:

• If you leave a comment or review, your name, email, rating and comment text are stored. Your name, rating and comment are published publicly after moderation; your email is never published.
• If you use the contact form, your name, email, subject and message are stored privately and used to reply to you. If you attach a photo or video (optional, up to 20 MB), it is stored on the BIKINTULIS server alongside the message and only viewable by the site owner via an authenticated admin panel. The attachment is deleted when the message is deleted.
• Your IP address is stored in our database only as a salted SHA-256 hash (rate-limiting / spam prevention), never in raw form there. Raw IP addresses do appear in the standard web-server access log, as they do on any website; those logs are kept for up to 30 days and are used only for security and troubleshooting.
• Standard web-server access logs are kept up to 30 days.
• No third-party analytics, no advertising, no tracking pixels. The site sets a cookie only on a page where you deliberately pair a watch, and only if you do: the CrossFit workout builder, or the Hyrox, GYM or PLANK builders, or the Work Hours timesheet. Each sets one strictly-necessary cookie of its own; none of them is used for tracking.
• The CrossFit builder's cookie is cs_dk. We set it when you type your watch's pairing code on the builder page. It is strictly necessary: it is the only thing that tells the site which watch this browser is allowed to build workouts for. It holds the device key (or, if you have paired more than one watch in this browser, up to five of them — one per watch, the one you are currently editing first) plus a signature that stops it being tampered with. It is HttpOnly, Secure and SameSite=Lax, lasts about 400 days unless you remove it, and is not used for tracking or advertising. "Disconnect this browser" on the builder page deletes it; your workouts stay on the server and pairing again from the watch brings them back.

9. Legal basis (GDPR)

• The optional workout sync (Pro only): your consent, given by opening the Sync screen and typing the pairing code into the website. You can withdraw it at any time by deleting your data — see section 11.
• The website: your consent (when you submit a comment or contact message) and legitimate interest (IP hashes and server logs, used solely to keep the site secure and operational).
• The app itself, if you never sync, collects and sends nothing to BIKINTULIS, so there is nothing to have a basis for.

10. Data retention

• On the watch: kept until you delete it or uninstall the app.
• Synced workouts on our server (Pro, only if you paired a watch): you can delete them yourself at any time, and a watch left unused for 24 months is purged automatically, workouts included. If you never paired a watch, no server copy of anything exists.
• Pairing codes: valid 15 minutes, single use; the row is deleted within 24 hours.
• Website comments: retained while CrossFit Power is listed on this site.
• Contact messages: retained as long as needed to handle your enquiry, then deleted.
• Server access logs: up to 30 days.

11. Your rights

Under the GDPR you can ask to access, correct, or delete data we hold, withdraw consent, object to processing, or lodge a complaint with your data-protection authority. For synced workouts there is a Delete this app's data button on the Workout Builder page — it removes the device key, every workout stored for that watch and its pairing codes, immediately and permanently, with no email or account needed. For anything else (website comments and contact messages — the app itself holds nothing on our side if you never sync), use the contact form — requests are answered within 30 days.

12. Security

• All traffic to bikintulis.de — website and workout sync alike — is over HTTPS with a valid public certificate.
• The pairing cookie is signed, HttpOnly and Secure, so page scripts cannot read your device key and it cannot be edited to point at someone else's watch.
• The free version makes no network connections at all, so there is no app-to-server traffic to secure.
• No payment data is ever handled by BIKINTULIS — purchases go through the Garmin Connect IQ store.

13. Children

CrossFit Power is a general-purpose fitness app, is not directed at children under 13, and does not knowingly collect any data from them. It asks nobody, of any age, for a name, an email address or an account — the only thing the optional sync stores is a random key the watch generated and the workouts built for it.

14. Changes to this policy

This policy may be updated to reflect new features or legal requirements. The "Last updated" date at the top reflects the latest change. Continued use after a change indicates acceptance of the updated policy.

15. Contact

Questions, requests or complaints about this policy: please use the contact form.