Privacy Policy
Version: October 14, 2026
In short
- You can make an account if you are at least 16. You can read the public pages (parks, guides, events, blog) without an account at any age.
- An athlete profile is private until you publish it yourself. Profile photos exist only while the profile is public: when you make it private, they are deleted.
- Google Analytics switches on only if you press “Accept”, and you can change your mind any time in the footer. There are no ads and data is not sold.
- Competition results and records are public sporting facts. If there is a reason to assume a competitor may be a minor, the name is shortened and the club and profile link are not shown. The same applies on city and skill pages: a person who is not certainly an adult appears with a shortened name, without a photo and without a link.
- You can download your data and delete your account yourself in the settings. For anything else, write to [email protected]; I answer within 30 days at the latest.
Calisthenics Balkan is a community platform about calisthenics, street workout and bodyweight training in the Balkans and beyond. This page says what data I hold about you, why, who else sees it, how long it is kept and what you can do. It is written so that someone who is 16 can follow it. It applies under the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH 12/25) and, where it concerns people in the European Union, Regulation (EU) 2016/679 (GDPR). This text is a notice, not something you have to agree to; it is not legal advice either.
1. Who is responsible for your data
The controller is: Zoran Gaković (an individual), Bosnia and Herzegovina Website: https://calisthenics-balkan.com Email for any data question and for content reports: [email protected] The platform is run by one person, as a non-profit project, without a data protection officer. I do not claim an exemption because the project is small: I apply the law to the extent it applies to me. The platform is meant for the community in the Balkans and is open to all athletes and visitors, including those from Croatia and other countries. The rights in this text apply to everyone, whichever country you live in.
2. What data I hold about you
This is the data that is processed, by where it comes from. No date of birth, document number or location of yours is asked for (only the coordinates of a park, if you suggest one yourself).
Account
- Name, email address and password (only a hash is stored, never the password). Surname is optional.
- Confirmation that you are at least 16, when you accepted the terms and which version of the terms and of this policy applied then (the policy is a notice, not something you agree with).
- Language, notification settings and, if you give them, city and country.
- Sign-in data: a description of your device from the browser and a shortened IP address per session, so that you can see and end your sessions.
- Account photo, if you add one. It is visible to the administrator and to managers of a club you join.
- If you join a club: the owner of that club sees your name and your account email address, and the other managers of the club see your name and account photo.
- Your list of saved parks is private: only you see it.
Sign in with Google (optional)
- If you sign in with Google, only the Google account identifier, the email address (which Google verifies) and the name as entered on the Google account arrive from Google. Password, contacts, calendar and files are not taken.
- An account created with Google has no password with me. You delete it in the settings with a confirmation by the same Google account.
Newsletter (optional)
- Email address, language and subscription setting.
- When you confirmed the subscription, where (form or account) and which version of this policy applied then.
- An address that someone types into the form and its owner does not confirm through the link in the email does not become a subscription and is deleted soon after the link expires (see retention).
Athlete profile (optional, private until you publish it)
- Display name, gender, country, city, about me, what you train, since which year you train, skills, what you are looking for and links to Instagram, TikTok and Facebook. Gender is used for filters and figures but is not shown on the public profile or on cards.
- Birth year is optional. If you say you are under 18 or give no year, your birth year, your parks, what you are looking for and your club are not shown publicly, and the profile is not visible to search engines. An unknown age is never counted as proof that you are an adult.
- Profile photos (one main and up to two for display). A photo is stored on a public image server, so they are allowed only while the profile is public. When you make it private, the photos are deleted and you must add them again when you publish again.
- If you publish a profile, anyone on the internet can see it. What was once public may have been copied; I can remove only what is with me.
Results, records and events
- Competition results: the competitor’s name, placing, result and category are entered by the organiser of the event. You can have a result even if you have no account (see “What is public”).
- Records: the holder’s name, discipline, value, date, place and source (a link to the evidence) are publicly visible. A record proposal or an objection to a record is sent through an account; your account is not shown, and a note you leave is seen only by the administrator.
- Event organisers: the contact details and the explanation you give in a request to take over an event are seen only by the administrator. When you delete your account these requests are deleted, and published events stay as platform events.
- A profile with results or records stays after the account is deleted as an archived page (see “How long data is kept”).
Coach or judge profile (optional, only from 18)
- Display name, country, city, about me, experience, references, languages, services, disciplines and, if you give them, links to Instagram, TikTok and Facebook.
- A declaration that you are 18 or older, and when and to which version of the text you consented to the public display. A coach also declares that they may do this work in the country where they offer it; the date of the declaration is a private record and I do not check it. The profile becomes public only after the administrator approves it; you can pause or delete it, and I then take it off the site at once (search engines may keep a copy for a while).
- If an event organiser engages you as a judge, the record of it (event and status) is seen by the organiser. Only places taken through the public profile and confirmed by both sides are shown publicly (event, year and the total number of confirmed judgings). Places taken through a private invitation link, invitations and unconfirmed places do not become public history.
- The profile is deleted with the account.
Content you add to the community
- Park reviews (rating and comment), park suggestions, location corrections, park photos and event suggestions. A park and a photo are reviewed before they become public. When you delete your account, a review stays without your name and comment (the rating stays), and a park you added stays without your name.
- Club membership requests: the managers of that club see your name.
- Stories and interviews (only from 18): the answers you give yourself and the name under which you want them published. A story is published only with your approval; you can withdraw it. If you delete your account, a published story stays under the name you chose, unless you ask me to take it down.
Journey and “Injury and recovery” entries (optional)
- In the “Journey” of your athlete profile you can add up to 60 entries (year, title, text up to 400 characters): a milestone, a mindset, a goal or a tip. Do not write another person’s name or another person’s health data.
- An entry of the kind “tip” can be public only on a profile with a stated birth year that makes you an adult, and only after the administrator has reviewed it; on other profiles it stays private (only you see it).
- Entries of the kind “Injury and recovery” are health data. They are currently switched off: no new ones can be added and none is shown publicly. If you made such an entry earlier, it stays private: only you see it, and you can edit, export or delete it. If I ever bring this kind of entry back, I will ask for explicit consent for each entry and change this text first.
- Entries are deleted with the account and are part of the export of your data.
Skill Atlas: tips and suggestions (optional)
- A skill page shows how many people reached the skill or are working on it. If your profile is public, a small mark of you may stand next to the number: for a person with a stated birth year that makes them an adult it is the name and profile photo with a link to the profile; for everyone else (under 18, or no stated year) only a shortened name, without a photo and without a link. The number always counts everyone.
- A tip for a skill (10 to 400 characters, no links) can be written only by an adult profile that is public and holds that skill. The administrator reviews it before it is published. Your display name is publicly visible with the tip. Others can mark it “This helped me”; who voted is recorded so that everyone votes once and you can withdraw a vote.
- A suggestion for a new skill: the text of the suggestion and, if you give one, a video link that only the deciding administrator sees and that is deleted when the decision is made. You alone see a suggestion that is waiting.
- When you delete your account, your tips, votes and suggestions are deleted. Exception: you can keep published tips without your name if you explicitly choose that when deleting.
Questionnaires (only if you get a personal link)
- A questionnaire is filled in through a personal link, without an account. The secret part of the link is in the address after the # sign, is not sent to the server when the page opens, and only its hash is stored.
- Answers are sent only if you declare that you are 18 or older. You leave contact details only if you explicitly answer “Yes”. An answer is not linked to an account and is not published. Answers are deleted a year after they were given, and an unanswered link 30 days after it ends.
City photos (suggestions)
- If you suggest a cover photo for a city, the image, the city, your display name (if you give it), your account and your confirmation that you have the rights to the photo are stored. Nothing is visible until the administrator approves it. An approved photo is shown publicly, with the author’s name if given; a rejected or withdrawn one is deleted.
- By sending a photo you confirm that you are the author or have permission to publish it. Do not send photos in which other people can be recognised, especially children, without their (or a parent’s) permission.
Technical data
- IP address and browser data in the server’s access logs (kept 14 days), and application logs (errors and events; email addresses are partly hidden in them). They are used for security and to fix errors.
- How often you send requests, to prevent abuse. The check that you are a human runs on the platform’s server and sends no data to a third party.
- Search: what you type into a search (for example an athlete’s or a competition’s name in results) is used only to show you the results and is not kept as your profile or search history. The typed term may appear in the page address and so stay in your own browser history; the whole query is removed from the address in the server’s access logs and in analytics (and so is the address of the page you came from).
- If you press “Parks near me”, your position is read by the browser and used only to calculate distances on your device. It is not sent to the server and not stored.
Reports, messages and moderation
- Content reports: the page, the reason, a note and, if you leave them, your name and email. The person the report is about does not learn who reported.
- Contact-form messages: name and email (if you give them), the type of message you choose, the page you write from and the text. The message also arrives in the platform’s mailbox.
- Notifications in your account (for example the decision on your suggestion) are kept for a year.
- If I hide or remove content or suspend an account, I record the reason, the date and the decision and send you the reason by email and notification.
- When an account is deleted: the profile name or name, who deleted the account, the reason if one was given, the dates of creation and deletion. No email address. A profile with competition results or records stays as an archived page with the name, country, gender, training focus and those results, without a link to the account, and search engines are asked not to index it.
- Reports, messages, the list of deleted accounts and moderation records are visible only to the platform administrator.
3. On what basis data is processed
For every purpose there is one of these bases (Article 6 GDPR; Article 8 of the BiH Law):
Your consent
Newsletter, Google Analytics and the public display of a coach or judge profile. You can withdraw it any time, as easily as you gave it: unsubscribe is in every message, you change analytics in “Cookie settings” in the footer, and you pause or delete a coach or judge profile in your account.
Contract, that is the service you ask for
The account, sign-in, an athlete profile you publish yourself, reviews, suggestions, club membership and notifications about what you submitted.
Legitimate interest
Security of the site and prevention of abuse, moderation of content, answering messages and reports, and the public display of sporting results and records. For minors it is taken into account that children need special protection (see “What is public”), and you have the right to object (see “Your rights”).
Legal obligation
When the law requires it, for example to act on a notice of illegal content or to answer a competent authority.
4. What data is used for
Only for this:
- Account, sign-in and account security
- Community functions: profiles, parks, reviews, clubs, events, results and records
- Emails and notifications about what you did on the platform
- Newsletter, only if you confirmed it
- Measuring how the site is used, only if you accept analytics
- Platform security and prevention of abuse
- Review of reports and messages and moderation of content
- Meeting legal obligations
5. What is public
Athlete profile: only if you publish it, and only what you filled in, with exceptions for people who are under 18 or gave no year (see section 2). You can make it private at any time. Photos: public while the profile is public; they are deleted when it is made private. Parks, reviews and events: a review is shown with your name until you delete your account or the review. Competition results: the event organiser enters the name, placing and result; publication is public because it is a sporting fact. You can have one without an account. When there is a reason to assume the competitor may be a minor (the organiser marked the category as an age group under 18, or the linked profile says the person could be under 18), a shortened name is shown (for example “Ana K.”), without the club and without a link to a profile; the placing, the result and the event stay. A shortened name is not anonymity: with the event and the placing someone can still recognise you. If this is uncomfortable for you, tell me and I will remove or correct the row; you have the right to object and to erasure. If you claim your result through your profile, the full name is shown. The organiser is responsible for accuracy and for having the right to publish results; I do not always know who is a minor, so I need your report. Records: the holder’s name, discipline, value, date, place and source are public, because they are part of a sporting record. The full name of the holder is shown when the person is certainly an adult (the birth year on the linked profile shows it) or claimed the record themselves. For a holder who could be a minor, or whose age is unknown with a youth category, only a shortened name is shown, without a link, badge or age group, in the list, on the record page and in the record’s history, and such a record cannot be found by searching for the name. Showing the full name of an adult holder is my choice, not a legal obligation: if you do not want your full name shown, tell me and I change the name to initials or to “Former athlete”; the record itself is not deleted. City and skill pages (Atlas): search engines may index them, so the rule is stricter there. Sporting content is not removed because of age, but a person who is not certainly an adult (under 18, or with no stated birth year) is shown with a shortened name, without a photo, without a link to a profile and without any identifier; the numbers always include them. An unknown age is never counted as being an adult. Search engines: profiles of people who are not certainly adults, and results and records of protected holders, are not indexed. I cannot prevent someone from copying what was public.
6. Who else processes data
Data is not sold and there are no ads. Data is processed by the service providers I use. Most of them process it on my behalf; Google, Cloudflare and Backblaze also act partly under their own terms:
Server hosting (OVH)
Purpose: Their server runs the site, the database and the server logs. The server is in France (EU).
Data transfer: Because of hosting itself, data does not leave the EU. Encrypted database backups are kept at Cloudflare (R2) and Backblaze for up to 13 months; they are encrypted with a key held only by the project owner, so the providers cannot read them.
Cloudflare and Backblaze
Purpose: Cloudflare provides DNS and protection of the site (traffic passes through their servers) and stores and serves images (your browser fetches images directly from their network, so Cloudflare sees the IP address) and stores encrypted backups. Backblaze stores a second encrypted copy of the database. When the project owner switches on the weekly photo backup (until then it does not exist), Backblaze will also hold it, in an EU region, in case the main image storage is lost.
Data transfer: Both are US companies; transfer rests on the mechanisms they offer (Cloudflare: the EU–US framework and standard contractual clauses; Backblaze: standard contractual clauses). Older photos that have not been moved are still in Backblaze’s storage in the US.
Google Analytics
Purpose: Measuring how the site is used, only if you accept analytics. Until then Google’s script is not loaded and nothing is sent to Google. After you accept, the page address is sent (without parameters, and for a person’s page without the name), what you do on the site (for example which part you use or whether you read an article to the end) and the data Google itself collects (IP address, device, browser). No name, email, search words or precise location is sent; advertising features are off. If you withdraw consent, measuring stops at once.
Data transfer: Google LLC is a US company. In the Google Analytics account, Google’s data processing terms have been accepted; for transfers they offer the EU–US framework and standard contractual clauses.
Brevo (newsletter)
Purpose: If you confirm the newsletter, your address is kept by Brevo (a French company, formerly Sendinblue), which sends messages on my behalf. Brevo reports if an address does not work or you unsubscribe.
Data transfer: Brevo states that it keeps data in the EU; some sub-processors may be outside the EEA.
Email messages (Gmail)
Purpose: Messages that arrive at [email protected] and some messages from the platform (for example account confirmation) go through Google’s Gmail.
Data transfer: Google LLC is a US company; its terms apply.
Sign in with Google (optional)
Purpose: Google’s sign-in script is loaded only when you open the sign-in window. Google may process the IP address and browser data under its own privacy policy.
Data transfer: Google LLC; see above.
Maps (CARTO)
Purpose: When you view a map, your browser fetches map tiles from CARTO’s servers, so they see your IP address and which parts of the map you look at.
Data transfer: Map providers are outside BiH; see their policies.
Have I Been Pwned
Purpose: When you set a password, it is checked that it is not in known leaks. Only the first five characters of the password’s SHA-1 hash are sent, never the password itself or anything about you.
Data transfer: The service is outside the EU.
I do not claim that a separate data processing agreement is signed with each of these providers: for Google Analytics, Google’s processing terms have been accepted, and for the others the standard terms the provider offers all customers of its service apply. Google sign-in and analytics are optional: the site works without them.
7. Transfers outside Bosnia and Herzegovina and the EU
Some of the providers in section 6 have their seat or servers outside Bosnia and Herzegovina and outside the EU (notably in the USA). Data is then protected by the mechanisms of Chapter V GDPR (Articles 44 to 49), and Articles 46 to 51 of the BiH Law: an adequacy decision, standard contractual clauses or the EU–US framework. Section 6 states what each provider offers. You can ask for more information.
8. How long data is kept
Only as long as needed. Then it is deleted or the name is removed:
The periods are an upper limit. Data that was published can be removed only where I hold it, not from those who copied it.
9. Cookies and similar technologies
There is only what is needed for the site to work and one optional part, analytics, which switches on only with your choice. There are no advertising cookies. This is the whole list:
Sign-in (cookies accessToken, refreshToken, refreshTokenId)
Purpose: Keep you signed in. The access cookie lasts 15 minutes and is renewed by the refresh cookies for at most 30 days. They are sent only to the platform’s server.
Consent: Necessary, no consent needed
Language and theme (preferred_language, theme)
Purpose: They remember the language (the cookie preferred_language, also kept in the browser) and the light/dark theme (kept only in browser storage under the name theme, not in a cookie) that you choose.
Consent: Necessary for a choice you asked for, no consent needed
Your cookie decision (cookie_consent, cookie_consent_receipt)
Purpose: Remembers what you chose and which version of the notice applied then; it contains nothing that identifies you and does not leave the browser. Acceptance of analytics is renewed after 12 months; that is my rule, not a legal deadline. A refusal does not expire.
Consent: Necessary, no consent needed
Auxiliary consent-withdrawal cookie (cookie_consent_withdrawn, cookie_consent_clarity_withdrawn)
Purpose: Set only if your browser does not allow remembering that you withdrew consent for analytics. It serves only to keep the withdrawal in force after the page reloads. It is set by the site itself (first-party), contains nothing that identifies you, lasts up to a year and is deleted when you accept analytics again.
Consent: Necessary, no consent needed
Drafts and settings in the browser (for example an event draft, parks view)
Purpose: They keep what you started so that you do not lose your input. They are sent to no one.
Consent: Necessary for the function you use
Google Analytics (cookies _ga and _ga_*)
Purpose: Measuring use, only if you press “Accept”. If you withdraw consent, the cookies are deleted.
Consent: Consent required
You can change your decision in “Cookie settings” in the footer. Microsoft Clarity is not used at present; if it is ever introduced, separate consent will be asked and this policy will be changed.
10. Your rights
You can (GDPR / BiH Law 12/25):
Access (Art. 15 / Art. 17)
To know whether I hold your data and to get a copy. You can download a copy of most data tied to the account (profile, club memberships and requests, reviews, suggestions, Journey entries, tips, stories, notifications) in the account settings; for the rest (newsletter subscription, public results and records, moderation records) you write to me and get them on request.
Rectification (Art. 16 / Art. 18)
To have inaccurate data corrected, including an incorrect result or a name next to a result or record. Most data you change yourself in the profile.
Erasure (Art. 17 / Art. 19)
To have data deleted. You delete your account yourself in the settings. For public sporting results and records see sections 5 and 8: the name can be changed, and the fact itself stays.
Restriction (Art. 18 / Art. 20)
To have processing paused while your request is checked.
Portability (Art. 20 / Art. 22)
To receive data in a structured form.
Objection (Art. 21 / Art. 23)
To object to processing based on legitimate interest, in particular to the showing of your result or of your full name next to a record. If you object, I stop unless there is a stronger reason.
Withdrawal of consent (Art. 7(3) / Art. 9(3))
At any time. It does not affect what happened before the withdrawal.
Complaint to a supervisory authority (Art. 77 / Art. 108)
If you think I violate the law, you can contact the Personal Data Protection Agency in BiH or the authority in your own EU country.
Send a request to [email protected] or through the contact form (type “Privacy or my data”). I answer without delay and within 30 days at the latest; the period can be extended with a reason. I can refuse a request only with a reason. If I am not sure it is you, I ask you to confirm from the account’s address. I do not ask for a document.
11. Content reports and incidents
If you see content that is illegal, endangers a child or you, or is your data published without a right, report it: the “Report content” button on the page, or the contact form (type “Content report”), or email. Write where the content is (link) and why you think it is a problem; leave your name and email if you want an answer. If you report with an account, when I close the report you get a notification in the app and an email to the account’s address: whether a measure was taken or no ground for a measure was found, and how to object (without data about the reported person); if you leave an email in the contact form, I answer by hand as soon as I can. I notify the person whose content was removed or restricted and explain the reason. If a data breach occurs that endangers your rights, I will notify the competent agency within 72 hours of learning of it and you when the law requires. Questions and reports that concern children are handled first.
12. Security
Passwords are stored only as a hash, traffic goes over HTTPS, access to administration is protected by a second identity check, and backups are encrypted. When a password is set, it is checked that it is not in known leaks (see Have I Been Pwned). No system is completely secure; if a breach occurs, I act as in section 11.
13. Automated decisions
No decisions that significantly affect you are made solely by automated means, and no profiles are built for advertising.
14. Under 18 and children
You can make an account if you are at least 16. That is my decision, not a ban on reading the site: the GDPR (Article 8) and the BiH Law (Article 10) say that for information society services offered directly to a child consent is valid from 16, and for younger children the consent of a parent or guardian is needed; I have no way to check that reliably, so I do not offer accounts to younger people. You can read the public pages (parks, guides, events, blog) without an account at any age; then nothing is asked beyond what is sent when a page opens and, if you accept, analytics. Sporting content (results, records, achievements, figures and cards) does not disappear because a sportsperson is a minor or their age is unknown. The identity is protected: for a person who is not certainly an adult the name is shortened, and the photo, the link to a profile, the club and other identifiers are not shown where search engines may index the page, in results and in records. Age is not guessed, and an unknown age is not taken as proof that the person is an adult. If you are 16 or 17, your profile is private until you publish it yourself; your birth year, parks, club and “what I am looking for” are not shown publicly and search engines do not index it. No date of birth or document is asked for. Stories and interviews, and coach and judge profiles, are only for people 18 or older, and tips are published only from the profiles of people who are certainly adults. If you are a parent or guardian and think a child left data or appears in results, records or a photo, tell me: I will remove it without delay.
15. Supervisory authority
Bosnia and Herzegovina: Personal Data Protection Agency in BiH, https://azlp.ba EU: the data protection authority of the country where you live or work.
16. Changes
If this policy changes materially, I update the version and date and notify you on the site or by email. The version you accepted at registration is recorded with your account.
17. Contact
Email: [email protected] Website: https://calisthenics-balkan.com
E-mail: [email protected] · Contact form (privacy and data requests)