Privacy Policy

Effective date: 18 July 2026 · Last updated: 7 September 2026

1. Controller

The controller of personal data collected through the Hero Training pre-launch Website is Aleks Mavrič, an individual based in Slovenia.

Website: https://herotraining.app
Privacy contact: privacy@herotraining.app
General contact: hello@herotraining.app

2. Personal Data Collected

Depending on how you use the Website, the following data may be processed:

Early-access data: email address, sign-up date and time, consent record, source page and subscription status.
Communications: messages, feedback and information you voluntarily provide.
Technical and security data: IP address, browser and device information, timestamps and hosting or security logs.
Analytics data, only after valid consent: page views, events, approximate location, device and browser information, and referral information generated through Google Analytics.
Advertising measurement data, only after valid consent: IP address, browser and device information, pages opened, and whether a visit led to an early-access sign-up, collected through the Meta pixel and shared with Meta. Where you submit the early-access form, your email address is converted in your browser into an irreversible fingerprint (a SHA-256 hash) and that fingerprint is sent to Meta so the sign-up can be attributed to an advertisement. The address itself is not sent, and nothing else you type into a form is sent.

3. Purposes, Legal Bases and Retention

Manage the early-access list and later send launch news and meaningful product updates

Data: email, sign-up record and subscription status

Legal basis: consent

Retention: until consent is withdrawn, the launch list is discontinued, or 36 months after the last meaningful interaction, whichever occurs first

Respond to messages and product feedback

Data: contact details and message content

Legal basis: legitimate interests in communication and product development

Retention: up to 36 months after the last substantive communication

Protect and operate the Website

Data: technical and security logs

Legal basis: legitimate interests in security, abuse prevention and reliable operation

Retention: up to 90 days, unless required longer for an active security incident or legal claim

Measure Website use with Google Analytics

Data: analytics identifiers and events

Legal basis: consent

Retention: 14 months for user-level and event-level data, subject to the configured Google Analytics settings

Measure which advertisements bring people to the Website

Data: IP address, browser and device information, pages opened, whether a sign-up occurred, and a hashed form of your email address where the early-access form is submitted

Legal basis: consent

Retention: determined by Meta under its own policies; cookies placed by the pixel typically expire within 90 days

A meaningful interaction includes submitting or confirming the sign-up, clicking a launch or product-update link, replying to a message, requesting access, or otherwise actively engaging with Hero Training. Passive email opens alone are not treated as a meaningful interaction. Retention will be reviewed periodically, and data that is no longer needed will be deleted or anonymised.

4. Early-Access Consent

When you submit the early-access form, you consent to the storage of your email address and to receiving Hero Training launch news and meaningful product updates when communication begins. You may withdraw consent at any time by using an unsubscribe link in a future email or by contacting privacy@herotraining.app.

No external email-delivery provider is currently used. Email addresses are currently stored in Google Firebase / Cloud Firestore. This Privacy Policy will be updated before a third-party email-delivery provider begins processing the launch list.

Providing your email address is entirely voluntary. If you choose not to provide it, you can still use the Website in full; we simply cannot add you to the early-access list or send you launch updates. If you later unsubscribe, we may keep a minimal record of your withdrawal so that we do not contact you again by mistake.

Your data is not used for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

5. Service Providers and Recipients

Personal data may be processed by:

Google Firebase / Cloud Firestore, used to host the Website infrastructure and store early-access registrations;
Zoho Mail (Zoho Corporation, EU data centre), used to operate the hello@herotraining.app and privacy@herotraining.app mailboxes — if you write to us, your email address and the content of your message are processed and stored there;
Google Analytics, used only after valid consent to measure Website usage;
Meta Platforms Ireland Limited, used only after valid consent: the Meta pixel measures which advertisements bring people to the Website and whether a visit led to an early-access sign-up. For this purpose Meta receives your IP address, browser and device information, the pages you opened and the fact that a sign-up occurred. Meta acts as an independent controller for its own further use of that data. Where you submit the early-access form, your email address is hashed in your browser first, so Meta receives a fingerprint rather than the address itself. This still allows Meta to recognise you, because it can compute the same fingerprint from addresses it already holds. Nothing else you type into a form is sent;
professional advisers, service providers or public authorities where necessary to comply with law, protect rights or address security incidents.

The Website's typefaces are served from our own server. Your browser does not contact Google Fonts, and no request for a font leaves this site.

6. Share Links

The app can turn a list of goals, timers or habits into a link you send to someone. That link carries the data inside its own address, after the # — and a browser never transmits that part to a server. Nothing is uploaded, nothing is stored by us, and no account is involved: opening the link simply decodes it again in the recipient's browser. We cannot see what you shared, and neither can the server hosting the page that displays it.

What follows from that is worth saying plainly. A share link is readable by anyone who has it, it cannot be revoked once sent, and it keeps working for as long as the address exists. Treat it like the message you send it in: if the contents are sensitive, choose the recipient and the channel accordingly. Deleting the data in your app does not shorten the life of a link already sent — the copy inside that link is independent of yours.

7. International Transfers

Some Google and Meta services may involve processing outside the European Economic Area, including in the United States. Where required, transfers rely on recognised legal safeguards such as adequacy decisions, standard contractual clauses or other lawful mechanisms. You may request a copy or summary of the safeguards that apply to your data by writing to privacy@herotraining.app.

8. Cookies, Analytics and Advertising Measurement

Google Analytics and the Meta pixel are not activated before you provide valid consent. Neither is loaded at all until then, so on a first visit no request reaches Google or Meta. Analytics and advertising measurement are accepted or rejected together; there is no option to accept one and refuse the other.

Rejecting non-essential technologies is offered alongside acceptance, and you may change your choice later through the Cookie settings link. Where the scope of what is being consented to changes, the earlier choice is not carried over and consent is requested again.

The consent in force at the moment of an early-access sign-up is recorded with that registration, so that a later advertising measurement is only ever carried out for people who agreed to it. See the Cookie Policy for details.

9. Your Rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time without affecting processing already carried out. You may also lodge a complaint with the Information Commissioner of the Republic of Slovenia.

Requests should be sent to privacy@herotraining.app.

10. Children

Hero Training is a productivity tool intended for adults and is not directed to children. The early-access list is not offered to anyone below 15 years of age in Slovenia, or below the minimum age for valid consent to information society services in the user's own country where that age is higher. Personal data is not knowingly collected from children below that age without the consent required by applicable law. If you believe a child has provided us with personal data, write to privacy@herotraining.app and it will be deleted.

11. Future Business Operator

If Hero Training later begins operating through a registered sole trader, the controller remains the same natural person acting in a registered business capacity, and this Policy will be updated with the business details.

If operation is transferred to a separate legal person, such as a company, users will be informed of the new controller and any material change. Fresh consent will be requested where required by law.

12. Security and Changes

Reasonable technical and organisational measures are used to protect personal data, including restricted database access and protected administrator accounts. No online system can guarantee absolute security.

This Policy may be updated when providers, purposes, the product operator or legal requirements change. Material changes affecting the launch list will be communicated where appropriate.