Privacy Policy

What we store

• Account: your email address and sign-in details. If you sign in with Google we receive your name and email from Google. We never see your Google password.
• Profile: your name, training experience, and, only if you choose to add them, your gender, training goals, bodyweight (including past entries), one-rep maxes (squat, bench press, deadlift) and preferred units.
• Training data: the programs you run, your workouts, and every set you log (exercise, weight, reps, effort ratings and notes).
• Account activity: the type of device you use, the IP address of your last sign-in, how many times you have signed in, and a log of account events such as sign-up, sign-in and profile changes (with your browser or device description). We use these to keep accounts secure and to support you.
• Notifications: if you turn on push notifications, a device token so we can send them. It is removed when you sign out.
• Messages you send us: feedback and support requests, with the email address you use.

The app also keeps a copy of your data on your device (browser storage, or the app's local database on iOS and Android) so it works offline. It syncs with our servers when you are online.

How we use it

• To run your account and sync your training across devices.
• To recommend a starting program and set your weights and reps from what you have logged.
• To keep the service secure, prevent abuse and fix errors.
• To answer you when you contact us.

Who processes it for us

We use these service providers. Each processes your data only to provide its service to us.

• Supabase: our database and sign-in service. Everything listed above is stored there.
• Vercel: hosts the website and web app, and handles the requests your browser makes.
• Google: only if you choose "Continue with Google" to sign in.
• Cloudflare Turnstile: if enabled, checks that sign-up, sign-in and password-reset requests come from a person, using signals from your browser.
• Apple and Google push services: only if you turn on notifications.

Deleting your account

You can delete your account yourself at any time: in the app, go to Profile > Settings and tap Delete account. You can also use the account deletion page or email support@overtrain.app.

Deleting your account removes your profile, programs, workouts and sets from our active systems immediately. Copies in encrypted backups are purged within 30 days. Support requests are anonymized, and we keep a one-way hash (not your email) so we can confirm the deletion later. Offline copies the app keeps on your devices are not on our servers; uninstall the app or clear its data to remove them.

Your choices

• Edit your profile, goals, bodyweight and one-rep maxes in the Profile tab.
• Leave optional fields such as gender, goals and bodyweight empty.
• Ask us for a copy of your data, or to correct or delete it, at support@overtrain.app.

Children

OverTrain is not for anyone under 16, and we do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

Security

Data is encrypted in transit, and access to each user's data is restricted to that user by the database's access rules. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you.

Changes

If we change this policy we will update the date above, and tell you in the app or by email if the change is significant.

Contact

Questions about privacy: support@overtrain.app. See also our Terms.