Privacy
Local-only mode sends nothing
Without an account, your training data never leaves the device. There is no server to send it to.
A shared plan travels in the link
When you share a plan, the routines are packed into the link itself, after the # — the part of a URL browsers never send to any server. Nothing is uploaded and we cannot see what you shared. It contains routines and their prescriptions only: no workouts, no body measurements, nothing that identifies you. Treat the link like the plan: anyone you send it to, and anyone they forward it to, can open it.
Third parties
Cloud sync and accounts
In useStores your training data and account when you turn on cloud sync. Row-level security means no account can read another account’s data.
ivvjxeirjofilyrhnkuu.supabase.coBot check on the sign-in form
In useCloudflare Turnstile guards account creation and sign-in. It loads only when you open that form, and it receives your IP address and technical details about your browser. It is never loaded anywhere else in the app, and it sets no advertising cookie.
challenges.cloudflare.comPayment
Not in useHandles the subscription as merchant of record. Nothing from them loads on this site; buying is a link to their own hosted page.
Waitlist form
Not in useHosts the "tell me when sync is ready" form. Nothing from them loads on this site — the link navigates you to their page, and an address you enter is held by them, not here.
Error reports
Not in useReceives crash reports. Your identity, request contents, network and console logs, and any exercise or workout names are stripped before sending — a report carries a stack trace and a route shape.
Page counts
Not in useCounts visits to the public pages only, without cookies. It is never loaded inside the app itself.
show email