Privacy

Plain-language privacy.

Short version: your data is yours. We use it to render your dashboard. We don't sell it, share it, or feed it into ad networks. You can export everything or delete your account at any time.

Last updated: June 21, 2026 · [TODO: confirm wording with a human before public launch]

What we store

  • Account info — your name, email, and a hashed password.
  • Fitness logs — the weigh-ins, meals, lifts, and cardio sessions you enter.
  • Profile photo — only if you upload one. Stored in /public/uploads on our server.
  • Goals + preferences — your active calorie goal, target weight, lift PR targets, and weekly cadence goals.
  • Login attempts — IP + timestamp for the last 15 minutes of failed logins, used only to slow down brute-force attempts.

What we don't store

  • Tracking cookies, analytics IDs, or third-party advertising pixels.
  • Any payment information — the app is free.
  • Anything you didn't explicitly type into a form or upload.

How we use it

Only to render your dashboard and the four trackers. Nothing is shared with third parties. Nothing is used to train machine-learning models. Email goes out only when you trigger it (password reset, email verification).

Cookies

One cookie: your session ID, set when you log in. It's HttpOnly, SameSite=Lax, and Secure when served over HTTPS. There is no analytics, advertising, or cross-site tracking cookie of any kind.

Where it lives

Data is stored in a MySQL database hosted on [TODO: name the prod host, e.g. Hostinger]. We don't operate edge caches or CDNs that would replicate your data elsewhere.

Your controls

  • Export — every tracker has a "Download CSV" link in its history section.
  • Delete — the profile page has a Danger Zone that permanently removes your account and every log we have for you. Foreign-key cascades take care of the rest.
  • Edit — every weigh-in, meal, lift, and cardio session can be edited or deleted individually from its tracker.

Children

This site is intended for users aged 13 and over. If you believe a child has registered, contact us via the contact page and we will remove the account.

Changes

If we make material changes to this policy, we'll update the "Last updated" date at the top and surface a banner on the dashboard. Continued use after a change means you accept the new policy.

Contact

Questions or concerns? Use the contact form — every message lands in our inbox.

Just to confirm