BIKINTULIS

← Back to the Workout Builder  ·  All privacy policies

Privacy Policy — Hyrox Power Workout Sync

Last updated: 17 August 2026 · Covers the optional workout-sync feature of the paid Hyrox Power, Hyrox Power Training and Hyrox Power Race Garmin apps, and the builder at bikintulis.de.

This policy covers one optional feature: building HYROX workouts on this website and syncing them to your watch. The feature is identical in all three paid apps that offer it — Hyrox Power, Hyrox Power Training and Hyrox Power Race — so one document describes it for all of them.

Everything each app does on the watch itself is covered by that app's own policy, which is the one linked from its Connect IQ store listing: Hyrox Power · Hyrox Power Training · Hyrox Power Race. Other apps published by BIKINTULIS have their own — see the directory.

1. Who we are

BIKINTULIS is an independent developer of Garmin Connect IQ apps. For questions about this policy, use the contact form.

2. Summary in plain language

  • Sync is optional and opt-in. If you never open the Sync menu on your watch, nothing about you is stored. Note that pressing Pair is already the start of it: that alone creates a device record and a pairing code on our server, even if you never type the code in here.
  • There is no account. No email, no password, no username, no sign-up. Your watch is the identity.
  • What we store is small and deliberate: a random device key generated on your watch, the workouts you build, and short-lived pairing codes.
  • We store no name, no email, no location, no heart rate and no health or activity data whatsoever.
  • Workouts do leave your watch's manufacturer environment — they are stored on our server at bikintulis.de so your watch can download them. That is the whole point of the feature, and we say it plainly.
  • If you pair more than one Hyrox app, this browser remembers each watch separately, and each one's workouts are kept apart from the others.
  • You can delete everything we hold for a watch yourself, at any time, with one button.

3. What the app sends, and when

The app contacts our server only when you ask it to — when you press Pair or Sync now in the app's Sync menu. It never syncs automatically and never during a workout. When it does, it sends:

  • a device key — 32 random hex characters generated on your watch the first time you open the feature. It is not your Garmin ID, not a serial number, and is not linked to your Garmin account or to you personally;
  • an app identifier, so the server knows the request came from the paid app.

That is all. It does not send your location, your heart rate, your workout results, your Garmin account details, or any other activity data.

4. What we store on our server

  • The device key (the random string above), with the dates it was created, paired and last synced, and which Hyrox app that watch is running — that last one is what lets the builder label your watches in the “Workouts for” dropdown.
  • The workouts you build — their names and the list of movements, distances, reps, times and any weights you typed.
  • Pairing codes — a 6-digit code that works for 15 minutes and can be used once. After that it stops working; the used-up code row itself stays in our database until the device data is deleted.
  • A cookie in your browser (see §6).

Please bear in mind that three fields are free text: the workout name and, on each movement, the optional weight and note. Whatever you type into them is stored as typed. Keep them to workout details — don't put anything personal in there.

5. What we never collect

  • No name, email address, phone number, postal address or password — there is no account to hold them.
  • No location or GPS data.
  • No heart rate, calories, activity, training results or any other health data.
  • No Garmin account information — we have no access to it.
  • No advertising, no analytics, no tracking of any kind.

6. The cookie

When you type your watch's pairing code on this site, we set one cookie (hs_dk). It is strictly necessary: it is the only thing that tells the site which watch this browser is allowed to build workouts for. It holds the device key (or, if you have paired more than one Hyrox app in this browser, up to five of them — one per watch, the one you are currently editing first) plus a signature that stops it being tampered with. It is HttpOnly, Secure and SameSite=Lax, lasts about 400 days unless you remove it, and is not used for tracking or advertising. "Disconnect this browser" deletes it.

7. Legal basis (GDPR)

We process this data on the basis of your consent, given by the deliberate act of pairing your watch and building workouts. You can withdraw it at any time by deleting your data (§8) — no request or explanation needed.

8. Deleting your data — you can do it yourself

On the Workout Builder page, "Delete this app's data" permanently removes the workouts, the device key and any pairing codes for the watch currently selected in the "Workouts for" dropdown. It is immediate and cannot be undone.

It deletes that one watch, not all of them. If you have paired more than one Hyrox app in this browser, the others are untouched and one of them becomes the selected watch. To erase everything, repeat the deletion for each app in the dropdown. We cannot do it for you from an email: we hold nothing that links a watch to a person, so there is no way for us to find your records — which is the same reason there is no account to recover.

Two things that do not delete anything on our server: removing the app from your watch, and "Disconnect this browser" — which forgets every watch paired in this browser at once (see §6), while leaving all of it on our server. Use the delete button for actual erasure.

9. Data retention

  • Workouts and the device key: kept until you delete them. We do not expire them on a timer, so nothing disappears behind your back — and equally, nothing is removed until you ask.
  • Pairing codes: usable for 15 minutes and once only. After that the code no longer works, though the spent code row remains in the database until the device data is deleted.
  • Standard web-server access logs: up to 30 days.

10. Security

  • All traffic — watch and browser alike — is over HTTPS with a valid public certificate.
  • The database is not exposed to the public internet.
  • Pairing codes are single-use, expire in 15 minutes, and both issuing and redeeming them are rate-limited to make guessing impractical.
  • The browser cookie is signed, so it cannot be edited to reach another watch's workouts.
  • No payment data is ever handled by BIKINTULIS — purchases go through the Garmin Connect IQ store.

11. Garmin Connect & your Garmin account

The app runs inside Garmin's Connect IQ platform, and a sync travels over your phone's connection. Garmin's own collection and use of data is governed by Garmin's policy at garmin.com/privacy. BIKINTULIS has no access to your Garmin account or anything synced to Garmin Connect.

12. The bikintulis.de website

Separate from this feature, when you use the rest of the bikintulis.de website:

  • If you leave a comment or review, your name, email, rating and comment text are stored. Your name, rating and comment are published publicly after moderation; your email is never published.
  • If you use the contact form, your name, email, subject and message are stored privately and used to reply to you.
  • Your IP address is stored in our database only as a salted SHA-256 hash (rate-limiting / spam prevention), never in raw form there. Raw IP addresses do appear in the standard web-server access log, as they do on any website; those logs are kept for up to 30 days and are used only for security and troubleshooting.
  • No third-party analytics, no advertising, no tracking pixels.

13. Your rights

Under the GDPR you can access, correct or delete your data, withdraw consent, object to processing, or complain to your data-protection authority. Deletion is available to you directly (§8); for anything else use the contact form — requests are answered within 30 days.

14. Children

These are general-purpose fitness apps and are not directed at children under 13.

15. Changes to this policy

This policy may be updated to reflect new features or legal requirements. The "Last updated" date above reflects the latest change.

16. Contact

Questions, requests or complaints: please use the contact form.