BIKINTULIS

← Back to the Workout Builder  ·  All privacy policies

Privacy Policy — GYM Power Workout Sync

Last updated: 5 September 2026 · Covers the optional workout-sync feature of the paid GYM Power Pro Garmin app (v2.0.0 and later), including workout-history sync from v3.1.0, and the builder at bikintulis.de/gym-sync.

This policy covers one optional feature: building gym workouts on this website, syncing them to your watch, and reviewing the final workouts you saved on the watch.

Everything the app does on the watch itself is covered by its own policy, which is the one linked from the Connect IQ store listing: GYM Power. Other apps published by BIKINTULIS have their own — see the directory.

The free version of GYM Power cannot use this feature at all. It is built without the sync code, does not request internet permission, and cannot reach this service.

1. Who we are

BIKINTULIS is an independent developer of Garmin Connect IQ apps. For questions about this policy, use the contact form.

2. Summary in plain language

  • Sync is optional and opt-in. If you never open the Sync menu on your watch, nothing about you is stored. Note that pressing Pair is already the start of it: that alone creates a device record and a pairing code on our server, even if you never type the code in here.
  • There is no account. No email, no password, no username, no sign-up. Your watch is the identity.
  • What we store is deliberate: a random device key generated on your watch, the workouts you build, final saved workout results, and short-lived pairing codes.
  • From GYM Power Pro v3.1.0, Sync travels both ways: custom workout plans go website → watch, while completed workout history goes watch → website.
  • A history record can contain its date, workout name, duration, each exercise and completed set, weights, reps or hold seconds, totals, heart-rate summary, calories and whether the session set a personal record.
  • We still store no account, email, location, Garmin identity or GPS route.
  • The workouts you build do leave your watch's manufacturer environment — they are stored on our server at bikintulis.de so your watch can download them. That is the whole point of the feature, and we say it plainly.
  • If you pair more than one watch, this browser remembers each separately, and each one's workouts are kept apart from the others.
  • You can delete everything we hold for a watch yourself, at any time, with one button.

3. What the app sends, and when

The app contacts our server only when you ask it to — when you press Pair or Sync now in Settings → Sync. It never syncs automatically, never in the background, and never during a workout. When it does, it sends:

  • a device key — 32 random hexadecimal characters generated on your watch the first time you open the feature. It is not your Garmin ID, not a serial number, and is not linked to your Garmin account or to you personally;
  • an app identifier, so the server knows the request came from the paid app;
  • when you press Sync now, any final saved workout records still waiting on the watch: date, workout name, duration, every exercise and completed set, weight, reps or hold seconds, total sets and volume, average and maximum heart rate, calories, and a personal-record flag.

The upload happens only after a workout has been saved and only on an explicit Sync now. The watch's latest 30 history records double as its bounded offline queue; sync periodically if you want a longer continuous web archive. The app does not send location, GPS routes, Garmin account details or a Garmin device serial number. It never uploads automatically, in the background or during a workout. On the first sync after updating, up to the recent history still stored by an older app version may be uploaded with summary-only exercise detail because exact per-set data did not yet exist.

4. What we store on our server

  • The device key (the random string above), with the dates it was created, paired and last synced, and which edition of the app that watch is running — that last one is what lets the builder label your watches in the “Workouts for” dropdown.
  • The workouts you build — their names, and for each exercise its name from the app's fixed list of 60, the number of sets, the number of reps (or seconds, for a plank), and the target weight if you set one.
  • Your synced workout history — the final result fields listed in §3. New records include every completed set. Older compatible records may contain only per-exercise set counts and top weight.
  • Pairing codes — a 6-digit code that works for 15 minutes and can be used once. After that it stops working; the used-up code row itself stays in our database for up to 24 hours and is then deleted.
  • A cookie in your browser (see §6).

Please bear in mind that the workout name is free text. Whatever you type into it is stored as typed. Everything else in a workout is a number or a name chosen from the app's own fixed list, so the name is the only field that could hold personal information. Keep it to workout details — don't put anything personal in there.

5. What we never collect

  • No name, email address, phone number, postal address or password — there is no account to hold them.
  • No location, GPS route, body measurements or sensor stream. Only the average and maximum heart-rate numbers saved with a completed workout are uploaded.
  • No incomplete or live workout data. Only the final record created when you save a workout can enter the queue.
  • No Garmin account information — we have no access to it.
  • No advertising, no analytics, no tracking of any kind.

6. The cookie

When you type your watch's pairing code on this site, we set one cookie (gs_dk). It is strictly necessary: it is the only thing that tells the site which watch this browser is allowed to build workouts for. It holds the device key (or, if you have paired more than one watch in this browser, up to five of them — one per watch, the one you are currently editing first) plus a signature that stops it being tampered with. It is HttpOnly, Secure and SameSite=Lax, lasts about 400 days unless you remove it, and is not used for tracking or advertising. "Disconnect this browser" deletes it.

This cookie is specific to GYM Power. If you also use the Hyrox workout builder on this site, that page sets its own separate cookie; the two do not see each other.

7. Legal basis (GDPR)

We process this data on the basis of your consent, given by the deliberate acts of pairing your watch, building workouts and pressing Sync now. You can withdraw it at any time by deleting your data (§8) — no request or explanation needed.

8. Deleting your data — you can do it yourself

On the Workout Builder page, Each workout-history card has a button to delete that one server copy. The "Delete this watch's data" button permanently removes all synced history, custom workouts, the device key and pairing codes for the watch currently selected in the "Workouts for" dropdown. Server deletion does not delete the watch's local copy or the activity in Garmin Connect. Deletion is immediate and cannot be undone.

It deletes that one watch, not all of them. If you have paired more than one watch in this browser, the others are untouched and one of them becomes the selected watch. To erase everything, repeat the deletion for each watch in the dropdown. We cannot do it for you from an email: we hold nothing that links a watch to a person, so there is no way for us to find your records — which is the same reason there is no account to recover.

Two things that do not delete anything on our server: removing the app from your watch, and "Disconnect this browser" — which forgets every watch paired in this browser at once (see §6), while leaving all of it on our server. Use the delete button for actual erasure. A history item deleted only from the website is not uploaded again because the watch retains an acknowledgement cursor.

9. Data retention

  • Workouts, workout history and the device key: kept until you delete them, or until the watch has been inactive for 24 months. After 24 months with no sync and no pairing, the device record and all associated data are deleted automatically. Any sync or re-pair from the watch starts that clock again, so an app you are still using is never purged.
  • Pairing codes: usable for 15 minutes and once only. Spent and expired codes are deleted within 24 hours.
  • Standard web-server access logs: up to 30 days.

10. Security

  • All traffic — watch and browser alike — is over HTTPS with a valid public certificate.
  • The database is not exposed to the public internet.
  • Pairing codes are single-use, expire in 15 minutes, and both issuing and redeeming them are rate-limited to make guessing impractical.
  • The browser cookie is signed, so it cannot be edited to reach another watch's workouts.
  • Everything the browser or watch sends is re-checked on the server before it is stored, and downloaded workout plans are checked again by the watch before use.
  • No payment data is ever handled by BIKINTULIS — purchases go through the Garmin Connect IQ store.

11. Garmin Connect & your Garmin account

The app runs inside Garmin's Connect IQ platform, and a sync travels over your phone's connection. Garmin's own collection and use of data is governed by Garmin's policy at garmin.com/privacy. BIKINTULIS has no access to your Garmin account or anything synced to Garmin Connect.

12. The bikintulis.de website

Separate from this feature, when you use the rest of the bikintulis.de website:

  • If you leave a comment or review, your name, email, rating and comment text are stored. Your name, rating and comment are published publicly after moderation; your email is never published.
  • If you use the contact form, your name, email, subject and message are stored privately and used to reply to you.
  • Your IP address is stored in our database only as a salted SHA-256 hash (rate-limiting / spam prevention), never in raw form there. Raw IP addresses do appear in the standard web-server access log, as they do on any website; those logs are kept for up to 30 days and are used only for security and troubleshooting.
  • No third-party analytics, no advertising, no tracking pixels.

13. Your rights

Under the GDPR you can access, correct or delete your data, withdraw consent, object to processing, or complain to your data-protection authority. Deletion is available to you directly (§8); for anything else use the contact form — requests are answered within 30 days.

14. Children

GYM Power is a general-purpose fitness app and is not directed at children under 13.

15. Changes to this policy

This policy may be updated to reflect new features or legal requirements. The "Last updated" date above reflects the latest change.

16. Contact

Questions, requests or complaints: please use the contact form.