Last updated 27 August 2026. This is the first published version.
The short version. Your workouts and meals are written to your own device first and then copied to our database so you can sign in from somewhere else. We do not run analytics, we do not use advertising or tracking tools of any kind, and we do not sell or share your data for marketing.
If you link with a coach, that coach can read your training data. They cannot read your app settings or your progress-photo consent decision — that restriction is enforced by the database itself, not by hiding a button.
Personalized Workout App is an independent training and nutrition application operated from the United States and reachable at admin@personalfitnessapp.com. It is an early-stage product. This policy describes what the application actually does today; where something is not built yet, this page says so rather than describing an intention.
Very little, and none of it for marketing. Our hosting and database providers keep standard server logs — IP address, timestamp, and the request made — for security and operational purposes. We do not add any analytics, attribution, advertising or session-recording tools to this application. There are no third-party tracking scripts, no advertising pixels, and no cookies used for advertising.
We store your date of birth and calculate your age from it each time it is needed. We do not store a fixed age value, because a stored age silently becomes wrong on your birthday.
Two places, and the distinction matters:
To be precise about a phrase we deliberately avoid: we do not claim your data “never leaves your device.” It does. Local-first is a reliability property — it is why the app works offline — not a promise of secrecy.
| Purpose | Data used | Basis |
|---|---|---|
| Providing the app — programs, logging, targets | Profile, training, nutrition | Performance of our agreement with you |
| Signing you in and keeping the account secure | Email, password hash, server logs | Legitimate interest in security |
| Coaching features | Training data, check-ins, messages, photos | Your consent, given by linking with a coach |
| Progress photos | Photos, age | Your explicit consent, revocable |
| Moderating a reported photo | The reported photo only | Legitimate interest in preventing misuse |
Coaching links require agreement from both sides. A coach cannot attach themselves to you, and you cannot attach yourself to a coach without them approving. Until a coach approves your request, they see only your name and email address.
Once you are linked, the boundary is enforced in the database, not in the interface:
| Your coach can read | Your coach can never read |
|---|---|
| Yes — profile, one-rep maxes, bodyweight log, cardio log, pantry, custom programs, program progress, training schedule, exercise swaps, today's meals, plus any check-ins, habits, goals and messages you share with them. | No — your app settings, which include your progress-photo consent decision. A coach also cannot write or change any of your data. |
Two further points worth stating plainly:
Photos are optional and off by default. Uploading requires both that you are 18 or over and that you have accepted the consent prompt. If we cannot determine your age, the feature stays closed.
An honest limitation. The age check is a client-side gate over a date of birth you enter yourself. It is a consent mechanism, not a security boundary, and we will not describe it as one.
We do not sell your data, and we do not share it with advertisers or data brokers. There are no such relationships to disclose. The service providers below are the complete list:
| Provider | What it handles | What it receives |
|---|---|---|
| Supabase | Authentication, database, file storage | Account, training, nutrition and coaching data, and photos |
| Netlify | Website hosting | Standard request logs, including IP address |
| IONOS | Domain and email | Email you send us |
| Open Food Facts | Barcode and food lookup | The barcode or search term only — never your account or your logs |
| Cloudflare cdnjs, Google Fonts | Application code libraries and fonts | Your IP address, as with loading any web page asset |
The app also links out to YouTube searches for exercise demonstrations. Those are ordinary links — nothing is sent until you choose to follow one, and YouTube's own policies apply once you do.
We may disclose data if legally compelled, or where necessary to investigate misuse or protect someone's safety.
We keep your data for as long as your account exists. Local data on your device stays there until you clear your browser's site data. A photo removed through a moderation decision is deleted from storage immediately; the record of that moderation decision is kept.
You can view and change your profile, training and nutrition data at any time inside the app, and you can export any program as a portable file.
What is not built yet, stated plainly: there is no self-service “download all my data” button and no self-service account deletion. Both are on the list. Until they ship, email admin@personalfitnessapp.com and we will export or delete your account manually. We aim to respond within 30 days.
You may withdraw photo consent, or end a coaching link, at any time from within the app. Depending on where you live, you may also have rights to access, correct, delete, restrict or port your data, and to complain to your local data protection authority. We apply these rights to everyone who asks, regardless of location.
Data is encrypted in transit. Access rules are enforced at the database row level rather than in the interface, which means a restriction cannot be bypassed by manipulating the app. Passwords are stored only as hashes.
No system is perfectly secure, and we are a small operation. If you find a vulnerability, please report it to admin@personalfitnessapp.com rather than disclosing it publicly, and we will work with you.
This app is not intended for children under 13, and we do not knowingly collect their data. Progress photos are restricted to users 18 and over. If you believe a child has created an account, contact us and we will remove it.
Our infrastructure is operated in the United States. If you use the app from elsewhere, your data is transferred to and processed in the United States.
If we change this policy in a way that materially affects how your data is handled, we will update the date at the top and notify you in the app. We will not quietly broaden what we collect.
Questions, requests, corrections and complaints: admin@personalfitnessapp.com.