Privacy

Only what you enter, plus what is needed to sign you in:

• Your email address and a securely hashed password.
• Profile details you choose to add: display name, height, date of birth, sex, and activity level. These exist solely to calculate your calorie and macro targets, and every one of them is optional.
• Bodyweight entries, goal weight, and any notes you attach.
• Workouts: sessions, exercises, sets, reps, load, RPE, and templates.
• Nutrition: your food library, saved meals, and your daily food log.

Some of this is information about your body and your eating. It is treated as private by default: every row is readable only by the account that created it, enforced by the database itself rather than by application code.

• No analytics or usage tracking of any kind.
• No advertising identifiers, and no advertising.
• No third-party scripts. The app loads nothing from other sites.
• No location data, contacts, or device identifiers.

If you log a set with no signal, it is saved in your browser's local storage until it can reach the server, then removed. This is what stops a workout being lost in a gym basement.

The app also caches its own interface files — code, fonts, icons — so it opens offline. That cache deliberately contains none of your records: no weigh-ins, no workouts, no meals. Signing out on a shared device leaves nothing of yours behind in it.

Two services, both acting only as infrastructure: Supabase stores the database and handles sign-in, and Vercel runs and serves the app. Neither uses your data for their own purposes. There are no other processors.

Needs your input: Confirm the Supabase project region so this page can state where your data physically lives. It is in Supabase → Settings → General, and it is the one thing people in the EU and UK will ask about first.

From Profile you can download everything you have logged as a single JSON file, with field names and units documented inside it, plus spreadsheets of your weigh-ins, sets and food log. No request, no waiting period.

Also from Profile. Deletion is immediate and permanent: your account and every record attached to it are removed from the database outright. Nothing is anonymised and retained, nothing is held in a recovery window, and there is no copy anyone can restore — including us.

Backups taken by Supabase before the deletion may retain data until they expire on their normal schedule. That is the one exception, and it is worth knowing about rather than glossing over.

If what the app does changes, this page changes with it. The date at the top is the honest one.

Questions about any of this go to tufluvfit@gmail.com.

Needs your input: Two things a lawyer should settle before anyone other than you uses this: who legally operates the service (a name and address), and whether you are making formal commitments under the GDPR, UK GDPR or CCPA. This page describes what the software does accurately, but it deliberately does not make legal promises on your behalf.