BIKINTULIS

← Back to the Workout Builder  ·  All privacy policies

Privacy Policy — Gym Workout Sync

Last updated: 1 October 2026 · Covers the optional workout-sync feature of GYM Power Pro and Strength Flow Pro, including saved-workout history (available in GYM Power Pro from v3.1.0), and the builder at bikintulis.de/gym-sync.

This policy covers one optional feature: building gym workouts on this website, syncing them to your watch, and reviewing the final workouts you saved on the watch.

Everything the app does on the watch itself is covered by its own policy, which is the one linked from the Connect IQ store listing: GYM Power. Strength Flow has its own app policy when published. Other apps published by BIKINTULIS have their own — see the directory.

The free versions do not use this sync feature. They cannot pair with this service.

1. Who we are

BIKINTULIS is an independent developer of Garmin Connect IQ apps. For questions about this policy, use the contact form.

2. Summary in plain language

  • Sync is optional and opt-in. If you never open the Sync menu on your watch, nothing about you is stored. Note that pressing Pair is already the start of it: that alone creates a device record and a pairing code on our server, even if you never type the code in here.
  • There is no account. No email, no password, no username, no sign-up. Your watch is the identity.
  • What we store is deliberate: a random device key generated on your watch, the workouts you build, final saved workout results, and short-lived pairing codes.
  • From GYM Power Pro v3.1.0, Sync travels both ways: custom workout plans go website → watch, while completed workout history goes watch → website.
  • A history record can contain its date, workout name, duration, each exercise and completed set, weights, reps or hold seconds, totals, heart-rate summary, calories and whether the session set a personal record.
  • We still store no account, email, location, Garmin identity or GPS route.
  • The plans you build on this website are stored on our server at bikintulis.de so your watch can download them. Saved workout results are uploaded from the watch only when you press Sync now.
  • If you pair more than one app or watch, each has its own key and workout history. GYM Power Pro and Strength Flow Pro share website plans only if you explicitly link them and choose which plan list to use.
  • You can delete a watch's live server records yourself, at any time, with one button. Backup copies follow the retention described in §9.

3. What the app sends, and when

The app contacts our server only when you ask it to — when you press Pair or Sync now in Settings → Sync. It never syncs automatically, never in the background, and never during a workout. When it does, it sends:

  • a device key — 32 random hexadecimal characters generated on your watch the first time you open the feature. It is not your Garmin ID or a serial number. Once paired, the site uses it to associate this browser with that watch's records;
  • an app identifier, so the server can distinguish GYM Power Pro from Strength Flow Pro;
  • when you press Sync now, any final saved workout records still waiting on the watch: date, workout name, duration, every exercise and completed set, weight, reps or hold seconds, total sets and volume, average and maximum heart rate, calories, and a personal-record flag.

The upload happens only after a workout has been saved and only on an explicit Sync now. The watch's latest 30 history records double as its bounded offline queue; sync periodically if you want a longer continuous web archive. The app does not send location, GPS routes, Garmin account details or a Garmin device serial number. It never uploads automatically, in the background or during a workout. On the first sync after updating, up to the recent history still stored by an older app version may be uploaded with summary-only exercise detail because exact per-set data did not yet exist.

4. What we store on our server

  • The device key (the random string above), with the dates it was created, paired and last synced, and which edition of the app that watch is running — that last one is what lets the builder label your watches in the “Workouts for” dropdown.
  • The workouts you build — their names, and for each exercise either its name from the website builder's current list of 60 or the custom name, muscle group and tracking type you entered, plus the number of sets, reps (or seconds) and target weight if you set one.
  • If you link the two Pro apps, an opaque plan-group identifier and one shared workout-plan collection. The original per-app plan lists are kept as recovery copies while linked. Workout history remains under each app's own key.
  • Your synced workout history — the final result fields listed in §3. New records include every completed set. Older compatible records may contain only per-exercise set counts and top weight.
  • Pairing codes — a 6-digit code that works for 15 minutes and can be used once. The code record is removed by a daily cleanup after it is more than 24 hours old, normally within 48 hours of creation.
  • A cookie in your browser (see §6).

Please bear in mind that workout names and custom exercise names are free text. Whatever you type into them is stored as typed. Keep those fields to workout details — don't put anything personal in them.

5. What we never collect

  • No name, email address, phone number, postal address or password — there is no account to hold them.
  • No location, GPS route, body measurements or sensor stream. Only the average and maximum heart-rate numbers saved with a completed workout are uploaded.
  • No incomplete or live workout data. Only the final record created when you save a workout can enter the queue.
  • No Garmin account information — we have no access to it.
  • No advertising or analytics. Standard web-server access logs are used for security and troubleshooting (see §9 and §12).

6. The cookie

When you type your watch's pairing code on this site, we set one cookie (gs_dk). It is strictly necessary: it is the only thing that tells the site which watch this browser is allowed to build workouts for. It holds the device key (or, if you have paired more than one watch in this browser, up to five of them — one per watch, the one you are currently editing first) plus a signature that stops it being tampered with. It is HttpOnly, Secure and SameSite=Lax, lasts about 400 days unless you remove it, and is not used for tracking or advertising. "Disconnect this browser" deletes it.

This cookie is shared by the GYM Power and Strength Flow workout builder. If you also use the Hyrox workout builder on this site, that page sets its own separate cookie; the two do not see each other.

7. Legal basis (GDPR)

We process this data on the basis of your consent, given by the deliberate acts of pairing your watch, building workouts and pressing Sync now. You can withdraw it at any time by deleting your data (§8) — no request or explanation needed.

8. Deleting your data — you can do it yourself

On the Workout Builder page, Each workout-history card has a button to delete that one server copy. The "Delete this watch's data" button removes all synced history, custom workouts, the device key and pairing codes for the watch currently selected in the "Workouts for" dropdown. Server deletion does not delete the watch's local copy or the activity in Garmin Connect. Deletion from the live database is immediate and cannot be undone through this site. Backup copies are described in §9.

It deletes that one watch, not all of them. If you have paired more than one watch in this browser, the others are untouched and one of them becomes the selected watch. To erase everything, repeat the deletion for each watch in the dropdown. We cannot do it for you from an email: we hold nothing that links a watch to a person, so there is no way for us to find your records — which is the same reason there is no account to recover.

If two apps share plans, deleting one app's data removes its history and device key while the other linked app keeps the shared plans. Deleting the last linked app through this website also deletes that shared plan collection. Stopping plan sharing copies the current shared plans to the selected app's separate collection.

Two things that do not delete anything on our server: removing the app from your watch, and "Disconnect this browser" — which forgets every watch paired in this browser at once (see §6), while leaving all of it on our server. Use the delete button for actual erasure. A history item deleted only from the website is not uploaded again because the watch retains an acknowledgement cursor.

9. Data retention

  • A watch's private workouts, workout history and device key: kept in the live database until you delete them, or until the watch has been inactive for 24 months. A weekly cleanup removes device records once they pass that threshold. Any sync or re-pair from the watch starts that device's clock again.
  • Shared workout plans: kept while either linked app remains. Using this website to delete the last linked app also deletes its shared plan collection. A separate weekly cleanup removes any shared plan collection left with no linked app after the inactivity cleanup.
  • Pairing codes: usable for 15 minutes and once only. Records older than 24 hours are removed by a daily cleanup, normally within 48 hours of creation.
  • Standard web-server access logs: up to 30 days.
  • Nightly local database backups are kept for about 14 days. Separate backups made before website changes may be retained longer for recovery; deleting live records does not immediately erase those backup copies.

10. Security

  • All traffic — watch and browser alike — is over HTTPS with a valid public certificate.
  • The database is not exposed to the public internet.
  • Pairing codes are single-use, expire in 15 minutes, and both issuing and redeeming them are rate-limited to make guessing impractical.
  • The browser cookie is signed, so it cannot be edited to reach another watch's workouts.
  • Everything the browser or watch sends is re-checked on the server before it is stored, and downloaded workout plans are checked again by the watch before use.
  • No payment data is ever handled by BIKINTULIS — purchases go through the Garmin Connect IQ store.

11. Garmin Connect & your Garmin account

The app runs inside Garmin's Connect IQ platform, and a sync travels over your phone's connection. Garmin's own collection and use of data is governed by Garmin's policy at garmin.com/privacy. BIKINTULIS has no access to your Garmin account or anything synced to Garmin Connect.

12. The bikintulis.de website

Separate from this feature, when you use the rest of the bikintulis.de website:

  • If you leave a comment or review, your name, email, rating and comment text are stored. Your name, rating and comment are published publicly after moderation; your email is never published.
  • If you use the contact form, your name, email, subject and message are stored privately and used to reply to you.
  • Your IP address is stored in our database only as a salted SHA-256 hash (rate-limiting / spam prevention), never in raw form there. Raw IP addresses do appear in the standard web-server access log, as they do on any website; those logs are kept for up to 30 days and are used only for security and troubleshooting.
  • No third-party analytics, no advertising, no tracking pixels.

13. Your rights

Under the GDPR you can access, correct or delete your data, withdraw consent, object to processing, or complain to your data-protection authority. Deletion is available to you directly (§8); for anything else use the contact form — requests are answered within 30 days.

14. Children

GYM Power and Strength Flow are general-purpose fitness apps and are not directed at children under 13.

15. Changes to this policy

This policy may be updated to reflect new features or legal requirements. The "Last updated" date above reflects the latest change.

16. Contact

Questions, requests or complaints: please use the contact form.