Privacy & Cookie Policy

1) Who we are (Controller)

Joy2Move is operated by SC GLOBAL PERSPECTIVE SRL, the data controller for processing on joy2move.net. Contact: support@joy2move.net. Registered address: [Str. Buzoieni 10, Sector 5, Bucuresti, RO]. We have not appointed a DPO; please use the contact above for privacy matters.

Home Fitness Exercise Library connector

Home Fitness Exercise Library is a public, read-only exercise connector provided by Joy2Move. No Joy2Move account is required. The connector receives the exercise search terms, equipment, muscle or category filters, and exercise identifiers supplied by your AI assistant to answer your request. It does not access your Joy2Move profile, workout history, subscription or payment information, and cannot change your account.

These inputs are processed to look up public exercise information. The connector does not save searches or conversation content in the Joy2Move database. Its application diagnostics record protocol methods, status codes and response sizes, not search arguments, credentials or cookies. Our hosting provider may process technical request data for delivery and security as described in this policy. Your AI provider handles your conversation under its own privacy policy.

Playing a demonstration in ChatGPT or Claude loads video from Mux and shares technical connection data with Mux. Opening the full-workout YouTube link also shares technical connection data with YouTube. Following an exercise or workout link opens the Joy2Move website, where the cookie and analytics choices described below apply. Referral links identify the source as ChatGPT or Claude; they do not include your conversation or an account identifier.

For connector support, unavailable demonstrations or privacy requests, email support@joy2move.net. Include the exercise name and a description of the issue. Do not send passwords, authentication tokens or medical records.

Sign in with Google

If you choose to sign in with Google, Joy2Move requests only the basic profile scopes (openid, email and profile). With your permission, Google shares your email address, name and profile picture URL with us. We do not request access to your Gmail, Google Drive, contacts, calendar, fitness data or any other Google service.

  • How we use it: your email address identifies and authenticates your account and receives service emails (sign-in, welcome and trial emails, plus leaderboard updates only if you opt in). Your name prefills your nickname and your picture URL is shown as your avatar. You can change both in your profile.
  • Storage: this data is stored with your account in our authentication and database provider, Supabase. We do not store or use Google access tokens to call Google APIs on your behalf.
  • Sharing: we do not sell Google user data, use it for advertising, or share it with third parties except the service providers listed in Section 6 that are needed to run Joy2Move, or where required by law.
  • AI: we do not use Google user data to develop, improve or train generalized AI or machine learning models.
  • Deletion: you can download or delete your data at any time from your profile or on the delete account page. Deleting your account removes this data. You can also revoke Joy2Move's access in your Google Account under Security, Third-party apps and services.

Joy2Move's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2) What data we collect

  • Account data (if you sign in): email (for authentication), nickname, avatar URL, profile ID, and authentication metadata needed to operate your account.
  • App usage: favorites, workout history, leaderboard participation, and similar in-app actions (for your features and progress).
  • Health-related workout data (only after explicit consent): duration, frequency, and perceived effort. Because these may reveal aspects of your physical condition, we treat them as health data (special category) and process them only with your explicit consent.
  • Device & technical: limited device/browser info and network logs necessary to run the service securely (e.g., error logs).
  • Subscription data: plan, billing provider, purchase/subscription identifiers, status, and renewal period. Payment card details are handled by Google Play, Paddle, or Stripe and are not stored by Joy2Move. We also retain verified payment transaction or invoice identifiers, amounts, currencies, payment dates and test/live status as part of your billing records.
  • Consent records: your cookie preferences stored in a first-party cookie (j2m_consent).
  • Analytics (optional, only after consent): events, page views, approximate region, device/browser identifiers, and performance measurements via Google Analytics 4 and Vercel Analytics (see Section 5).

3) Purposes & legal bases

  • Provide and secure the service (authentication, storage, PWA/offline, fixing bugs) — performance of a contract and legitimate interests.
  • Health & progress features (store workout session details such as duration, frequency, perceived effort; show streaks/insights) — explicit consentfor any health-related data (Art. 9(2)(a)); where non-health data is used, performance of a contract. You can use the app without granting health-data consent and may withdraw consent at any time.
  • Remember your consent — legal obligation and legitimate interests.
  • Analytics (understand usage to improve the app) — consent.
  • Marketing communications — consent. Joy2Move does not display third-party advertising in the app.

4) Cookies & storage we consider functional

We use essential cookies and storage (e.g., service worker cache, localStorage, IndexedDB) to keep the app fast, secure, and installable (PWA). These are required for core features and can’t be turned off within the app.

We store your cookie choice in j2m_consent (first-party).

  • Name: j2m_consent
  • Expiry: up to 12 months
  • Contents: JSON (e.g. {"functional":true,"analytics":false,"marketing":false,"v":1})
  • Purpose: remember your preferences

To understand how many visitors choose each option, the banner sends an anonymous count each time it is shown and when a choice is saved: only the choice (for example "rejected") and a broad traffic category (for example "paid ad" or "search"). This request sends no cookies and stores no identifier, IP address, device details or page address. Daily totals are kept for up to 13 months.

Browsers used by our own team and test accounts may store j2m_internal (value 1, up to 12 months) so that analytics can exclude internal visits. It is never set for customers.

5) Analytics

We use Google Analytics 4 (GA4) and Vercel Analytics to measure usage only after you grant analytics consent. Until then, these analytics tools are not loaded. Your consent can be changed anytime below.

Google Analytics receives only a broad page category (such as "workout player" or "blog"), never the full address. It also receives campaign labels from the link you followed (utm_source, utm_medium, utm_campaign, utm_content), the domain of the site that referred you (not the page), and milestones such as starting setup, signing up and starting or completing checkout, without amounts, plans or account details. Performance measurements include the page element that loaded slowly or moved.

With analytics consent, we also measure visits from connectors such as Muse. We retain the connector name in this browser tab for up to 24 hours and, after sign-in, associate it with account and checkout activity to measure referrals. Withdrawing analytics consent clears the tab attribution and stops new tracking.

With analytics consent, our own measurement records broad traffic sources, page categories, setup steps, sign-in outcomes, video start/error signals and checkout milestones. The optional j2m_journey cookie identifies a visit for up to 24 hours. If you sign in during that visit, we associate those events with your account. We do not include your email, setup answers, workout titles or IDs, full URLs, payment tokens or raw error messages in these events.

These first-party journey events expire after 90 days through daily cleanup. Withdrawing analytics consent requests deletion of the current visit and any journey events linked to your signed-in account. Signed-in video signals also require health consent and are removed when that consent is withdrawn. Account exports include linked journey events; account deletion removes them. Billing records are separate from optional analytics.

To prevent delayed requests from restoring a deleted visit, we temporarily retain its random visit identifier without account or event information. This deletion marker is valid for 24 hours and is removed by daily cleanup afterward.

  • Provider: Google LLC (and affiliates)
  • Data: page views, events, approximate region, device/browser identifiers, and performance measurements
  • Legal basis: your consent
  • Retention: typically 14 months (configurable in GA4)
  • Cookies (when consented): GA4 may set first-party cookies such as _ga and _ga_<container-id> to distinguish users/sessions
  • Opt-out/withdraw: use the “Open cookie settings” button below.

TikTok advertising measurement (optional)

With your marketing-cookie consent, we use TikTok Pixel on the public homepage and About page for signed-out visitors to measure visits from our advertisements and clicks on the homepage's main buttons. TikTok may receive the page address, referral and advertising identifiers, IP address, browser/device information and page interactions. It may use cookies such as _ttp and ttclid to attribute visits to ads. This is separate from analytics consent.

We do not send account details, workout history, health information or payment details through this integration. We do not call TikTok's identity-matching API. Tracking is disabled on account, onboarding, workout and billing screens. You can withdraw marketing consent at any time using cookie settings below; this stops future sharing but does not erase information already sent to TikTok. See TikTok's privacy policy for its processing, retention and privacy choices.

6) Service providers (processors) & recipients

  • Supabase — authentication, database and application services (including transactional emails for sign-in).
  • Vercel — hosting, build and edge delivery (including CDN and image optimization), plus analytics only after consent.
  • Google Analytics — analytics measurement (only after consent).
  • TikTok — advertising measurement on public marketing pages, only after marketing consent.
  • Google Play — Android app distribution, subscription checkout, billing status, and subscription management.
  • Paddle and Stripe — web checkout, billing, payment records, and subscription management, depending on your purchase. Paddle acts as merchant of record for Paddle purchases. We share your account email and billing identifiers; workout and health information is not sent to payment providers.

We sign data-processing terms with our providers where applicable, and only share what’s necessary to run Joy2Move.

7) International transfers

When data is transferred outside the EEA/UK (for example, to Google LLC in the United States), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and provider commitments. We take steps to ensure an adequate level of protection consistent with applicable law.

8) Retention

  • Account & app data: for as long as your account exists (deleted upon account deletion).
  • Health-related workout data (duration, frequency, perceived effort): retained only while consent is active; deleted or anonymized if you withdraw consent or delete your account.
  • Consent records: up to 12 months.
  • Analytics: typically 14 months in GA4 (configurable).

9) Your rights

You have rights of access, rectification, erasure, restriction, portability, and objection; plus the right to withdraw consent at any time (this doesn’t affect past processing). You can also lodge a complaint with the Romanian supervisory authority (ANSPDCP).

10) Children

Joy2Move is intended for adults aged 18 and over. We don’t knowingly collect personal data from children.

11) Manage your consent

See browser controls

You can clear cookies and site data in your browser settings. This removes your saved consent and you’ll be asked again on your next visit. Your profile lets you withdraw health-data consent, download your data, or delete your account. Withdrawing health-data consent permanently deletes workout history, effort reports and workout achievements. Giving consent again starts a new history. For help, contact support@joy2move.net.

12) Updates & contact

We may update this page to reflect changes in our use of data or legal requirements. For questions, email support@joy2move.net.

Last updated: 12 October 2026