Last updated: 30.10.2026. This page explains in plain language which data is processed when you use joynado.com, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and applicable local data protection laws.
Michael Dieckmann / Joynado, Adams-Lehmann-Straße 60, 80797 Munich, Germany, e-mail: joy@joynado.com.
The 90-second routines, member accounts and statistics run on the AHΞHA platform (www.aheha.com). Your account is a shared account: with the same e-mail and password you can sign in on joynado.com, on aheha.com and on the other AHΞHA websites. Michael Dieckmann / Joynado and the operator of AHΞHA are joint controllers for the account data (Art. 26 GDPR); we will send you the essence of this arrangement on request. You can exercise your rights with either of us.
The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (servers in Germany). When you visit, technically necessary data is processed: IP address, date and time, page requested, browser and operating system. This serves secure operation (Art. 6(1)(f) GDPR). Logs are deleted or anonymised after 14 days at the latest. A data processing agreement is in place with IONOS. If you visit from a country outside the EU, your data is transferred to Germany, which offers a high level of data protection.
You can start routines without signing in. We count anonymously which routine was started and finished (routine, music, time, website), without name or e-mail. This shows us which exercises help (Art. 6(1)(f) GDPR). Your progress (“done” ticks, reminder times) is only stored locally in your browser.
For a free account we store: e-mail address, first name (optional), password (only as a secure hash, never in plain text), date of registration, the website you registered on, the routines you started and finished, your invite code and how many people came through your link. Purpose: providing the account, history, streak and invite statistics (Art. 6(1)(b) GDPR). The data is kept until you ask us to delete your account; a short e-mail to joy@joynado.com is enough.
For signing in, a necessary session cookie (“AHSESS”) is set, which ends when you close the browser or sign out. If you forget your password, we send you a link by e-mail that is valid for two hours.
If you turn on reminders, we store the technical push address of your browser, your times and your time zone in order to remind you at the chosen time (consent, Art. 6(1)(a) GDPR). Delivery runs through your browser’s push service (e.g. Google, Apple or Mozilla). You can turn reminders off at any time in the app or in your browser settings; the data is then deleted.
Bookings and questions are handled by e-mail at joy@joynado.com. Your details are only used to answer your request and to carry out the session (Art. 6(1)(b) GDPR). Health information you choose to share (for example about injuries or health conditions) is processed only with your explicit consent (Art. 9(2)(a) GDPR) and only for the session. Business e-mails are kept for the periods required by law; other requests are deleted once they are settled.
On your first visit a banner asks for your consent. Without consent, no analytics or advertising services are loaded and Google receives no data (Google Consent Mode v2, default “denied”). We store your choice in the cookie “ah_consent” so that the banner does not appear on every visit, and your language in the cookie “p_lang”. You can change or withdraw your choice at any time under Cookie settings.
| Category | Service | Purpose | Legal basis |
|---|---|---|---|
| Necessary | Session cookie, consent cookie, language | Sign-in, security, remembering your choice | Art. 6(1)(b)/(f) GDPR |
| Statistics | Google Analytics 4 | Pseudonymous usage statistics, e.g. which routines are started | Consent, Art. 6(1)(a) GDPR |
| Marketing | Google Ads (conversion measurement, only when ads are running) | Measuring whether ads lead to sign-ups | Consent, Art. 6(1)(a) GDPR |
Google: the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Analytics data is deleted after 14 months. More: policies.google.com/privacy.
Fonts, videos and music are delivered from our own server. No external font services (such as Google Fonts) are used.
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw your consent at any time with effect for the future. Just write to joy@joynado.com.
You can also complain to a data protection authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, or the data protection authority of your country.
There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.