Privacy Policy

Account information. Your email address and password (stored hashed, never in plain text). If you sign up as a coach, we also collect your practice name and contact details.

Profile information. Your name, username, bio, profile photo, time zone, and unit preference (kg or lb).

Training data. The workouts you log — exercises, sets, reps, weight, rest times, session notes, dates and times, and any photos you attach. We record the calendar date in your own time zone so a late-night session counts on the right day.

Health and wellbeing data. If you send weekly check-ins, we collect your bodyweight and your self-reported sleep, soreness, and energy ratings, plus any note you write. This is sensitive information and we treat it accordingly — see section 3.

Heart rate and energy. If you train with a Bluetooth heart rate strap or another connected device, the mobile app records your heart rate through the session and stores the trace with the workout, along with the calories the session is estimated or measured to have burned. Both are part of the session, so both are as visible as it is — see section 3.

Body measurements. In the mobile app you can enter your height, bodyweight, date of birth, sex, and VO₂ max. These exist only to work out roughly what a session burned. They are kept apart from your profile and are readable by you alone — not by your coach, not by other lifters — and they never appear on a session or in the feed.

Location. If you start GPS tracking for a run, walk, or ride, the mobile app records your route and the distance you covered, and stores the route with that interval. Location is collected only while an interval you started is being tracked, never otherwise, and never when you have not started one. Before a route is saved we cut roughly 200 metres from each end of it, so the line kept on the session does not begin or end at your door. See section 3. The distance you covered is measured from every point your phone reported and is not affected by that trim.

Apple Health. On iPhone the app can read heart rate, active energy, resting heart rate, and cardio fitness (VO₂ max) from Apple Health, and can write your finished sessions back to it as workouts. Reading and writing are separate switches, both off until you turn them on, and either can be withdrawn at any time in the Health app. What we read is used to measure the session you are logging: the resulting heart rate trace and calorie figure are stored with that workout. Nothing else read from Apple Health is stored. None of it is ever used for advertising or marketing, sold, or shared with anyone.

Coaching content. Programs assigned to you, feedback your coach leaves on your sessions, and direct messages between you and your coach.

Payment information. Coach plan payments are processed by Stripe. We never see or store your card number — only a Stripe customer ID and your current subscription status.

Usage data. Standard server logs (IP address, browser type, pages visited, timestamps) used to operate and secure the service.

We use the information we collect to:

• Run the service — save your workouts, calculate your progress, and show your history
• Work out roughly what a session burned, from your measurements and your heart rate if one was recorded
• Measure a run or ride you asked us to track, and draw its route on the session
• Show your coach the training and check-ins you have shared with them
• Deliver messages and session feedback between coaches and clients
• Process Coach plan payments via Stripe
• Send transactional email (account confirmation, password reset, invitations, and coaching notifications)
• Respond to support requests
• Detect and prevent fraud, abuse, and unauthorized access
• Diagnose faults and improve the app

We do not sell your data. We do not use your training or health data for advertising, and we do not share it with advertisers or data brokers.

This is the part worth reading closely.

Your coach. If you join a coach’s practice, that coach can see your logged workouts, your training history and progress charts, your weekly check-ins (including bodyweight, sleep, soreness, and energy), and your messages with them. That access is the point of coaching, but you should know its extent before you accept an invitation. Leaving a practice ends that access going forward — contact us if you want past data removed from a coach’s view.

Other lifters. Your profile — name, username, bio, and profile photo — is visible to every signed-in user and can be found through search. Every session you complete is readable by any signed-in lifter, whether or not they follow you. Following decides what turns up in someone’s feed; it does not decide what they are allowed to open. That covers everything attached to a finished session: your exercises, sets, reps, weights, notes and photos, the heart rate trace, the calorie figure, and the GPS route if you tracked one. A session you have started but not finished stays yours alone.

A word about routes. A tracked run usually starts and finishes where you live, and because a completed session is readable by any signed-in lifter, so is the route drawn on it. So we remove roughly 200 metres from each end of a route before it is saved, each end measured from itself, which means a loop finishing where it started loses both. A run that never leaves that radius, such as laps of your own block, is stored with no route at all.

What remains is the middle of the run, at the precision your phone reported, and we would rather tell you its limits than let you assume more. It still shows the roads you ran along. If you pass close to home part way through a run, that part is kept on purpose: cutting a hole in the line would draw a straight chord across the gap and point at the place more plainly than the line did. And a short run from an unusual starting point can still be recognisable to somebody who knows the area. If you would rather share none of it, do not start GPS tracking for that run. You can still enter the distance and the time yourself, and the session is otherwise identical.

Uploaded images. Profile photos and workout photos are stored on public URLs. Anyone who has the link to an image can open it without signing in. The links are long and not published anywhere, but they are not secret — please do not upload anything you would not want seen.

Nobody else. Coaches can only see lifters in their own practice, enforced in the database itself and not just in the app.

We share data only with the services required to operate Exersets:

• Supabase — database, authentication, and file storage. Your data is stored on Supabase-managed PostgreSQL servers.
• Stripe — Coach plan billing. Stripe processes payments and is subject to its own privacy policy.
• Resend — transactional email delivery.
• Vercel — hosting and edge infrastructure.

We may disclose information if required by law or to protect the rights, property, or safety of Exersets, our users, or the public.

When you invite clients, you gain access to personal and health information about real people. You are responsible for handling it lawfully and for having their agreement to coach them. Use what you see to coach them and nothing else — do not export it, sell it, or pass it on.

We act as a processor for the client data you access through the platform. We do not market to your clients.

We keep your data for as long as your account is active.

You can delete your account yourself, from Settings in the mobile app. Deletion is immediate and permanent — there is no grace period and nothing is held in reserve. It removes your profile, every session and set you have logged, your notes, photos, heart rate traces and routes, your body measurements, your follows, your messages, and your login itself. We cannot bring a deleted account back. If you would rather we did it for you, email us.

Cancelling a Coach plan does not delete anything — you keep your account and your own training log, and only the coaching features switch off.

You can request a full copy of your data — workouts, programs, check-ins, and messages — at any time by emailing us.

We use encrypted connections (TLS) everywhere, hash all passwords, and enforce row-level security in the database so that each account and each practice can only reach its own records. No method of transmission over the internet is completely secure — we cannot guarantee absolute security, but we take it seriously.

Exersets uses cookies to keep you signed in. We do not use advertising cookies, tracking cookies, or third-party analytics cookies. We also store a few preferences — your theme, your unit choice, and any workout still in progress — locally in your own browser, not on our servers.

The mobile app keeps the same sort of thing on your phone: your preferences, a session you are part-way through, the last copy of your exercise list and program so the app opens without waiting for the network, and any finished session still queued to upload the next time you have a signal. Deleting your account removes all of it from the device.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw a coach’s access to your training and check-ins

To exercise any of these rights, email us at support@exersets.com. We will respond within 30 days.

You must be at least 18 to use Exersets. The service is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe someone underage has created an account, contact us and we will remove it.

We may update this policy from time to time. We will notify you by email or in-app notice before material changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Questions about this policy or your data? Email us at support@exersets.com.