Privacy Policy

Account information. Your email address and password (stored hashed, never in plain text). If you sign up as a coach, we also collect your practice name and contact details.

Profile information. Your name, username, bio, profile photo, time zone, and unit preference (kg or lb).

Training data. The workouts you log — exercises, sets, reps, weight, rest times, session notes, dates and times, and any photos you attach. We record the calendar date in your own time zone so a late-night session counts on the right day.

Health and wellbeing data. If you send weekly check-ins, we collect your bodyweight and your self-reported sleep, soreness, and energy ratings, plus any note you write. This is sensitive information and we treat it accordingly — see section 3.

Coaching content. Programs assigned to you, feedback your coach leaves on your sessions, and direct messages between you and your coach.

Payment information. Coach plan payments are processed by Stripe. We never see or store your card number — only a Stripe customer ID and your current subscription status.

Usage data. Standard server logs (IP address, browser type, pages visited, timestamps) used to operate and secure the service.

We use the information we collect to:

• Run the service — save your workouts, calculate your progress, and show your history
• Show your coach the training and check-ins you have shared with them
• Deliver messages and session feedback between coaches and clients
• Process Coach plan payments via Stripe
• Send transactional email (account confirmation, password reset, invitations, and coaching notifications)
• Respond to support requests
• Detect and prevent fraud, abuse, and unauthorized access
• Diagnose faults and improve the app

We do not sell your data. We do not use your training or health data for advertising, and we do not share it with advertisers or data brokers.

This is the part worth reading closely.

Your coach. If you join a coach’s practice, that coach can see your logged workouts, your training history and progress charts, your weekly check-ins (including bodyweight, sleep, soreness, and energy), and your messages with them. That access is the point of coaching, but you should know its extent before you accept an invitation. Leaving a practice ends that access going forward — contact us if you want past data removed from a coach’s view.

Other lifters. Exersets has social features. Your profile — name, username, bio, and profile photo — is visible to other signed-in users and can be found through search. Your logged sessions can appear in the feed of people who follow you.

Uploaded images. Profile photos and workout photos are stored on public URLs. Anyone who has the link to an image can open it without signing in. The links are long and not published anywhere, but they are not secret — please do not upload anything you would not want seen.

Nobody else. Coaches can only see lifters in their own practice, enforced in the database itself and not just in the app.

We share data only with the services required to operate Exersets:

• Supabase — database, authentication, and file storage. Your data is stored on Supabase-managed PostgreSQL servers.
• Stripe — Coach plan billing. Stripe processes payments and is subject to its own privacy policy.
• Resend — transactional email delivery.
• Vercel — hosting and edge infrastructure.

We may disclose information if required by law or to protect the rights, property, or safety of Exersets, our users, or the public.

When you invite clients, you gain access to personal and health information about real people. You are responsible for handling it lawfully and for having their agreement to coach them. Use what you see to coach them and nothing else — do not export it, sell it, or pass it on.

We act as a processor for the client data you access through the platform. We do not market to your clients.

We keep your data for as long as your account is active. If you delete your account, we keep it in inactive storage for 90 days in case you want it back, after which it is permanently deleted. You can request immediate deletion at any time by emailing us.

Cancelling a Coach plan does not delete anything — you keep your account and your own training log, and only the coaching features switch off.

You can request a full copy of your data — workouts, programs, check-ins, and messages — at any time by emailing us.

We use encrypted connections (TLS) everywhere, hash all passwords, and enforce row-level security in the database so that each account and each practice can only reach its own records. No method of transmission over the internet is completely secure — we cannot guarantee absolute security, but we take it seriously.

Exersets uses cookies to keep you signed in. We do not use advertising cookies, tracking cookies, or third-party analytics cookies. We also store a few preferences — your theme, your unit choice, and any workout still in progress — locally in your own browser, not on our servers.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw a coach’s access to your training and check-ins

To exercise any of these rights, email us at support@exersets.app. We will respond within 30 days.

You must be at least 18 to use Exersets. The service is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe someone underage has created an account, contact us and we will remove it.

We may update this policy from time to time. We will notify you by email or in-app notice before material changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Questions about this policy or your data? Email us at support@exersets.app.