Privacy Policy

When you create an account, we collect your name and email address. If you sign in with Apple or Google, we receive only what those services provide — typically a name and email.

We store the workout sessions you log — including exercises, sets, reps, weights, and rest times — so your program and progress are available across sessions and devices.

With your permission, Train can read and write data to Apple Health — including workout summaries and active energy. This is entirely optional and controlled by your iOS permissions settings.

We collect anonymised usage data (which features are used, crash reports) to improve the app. This data cannot be used to identify you personally.

Your height, weight, date of birth, and biological sex. Train uses these to personalise your training program — for example, selecting appropriate load progressions. This is optional: if you decline, you can enter the values manually and Train still works.

Completed workout sessions and active energy burned, so your training is reflected in your overall health record.

You can grant or revoke HealthKit permissions at any time via iOS Settings → Privacy & Security → Health → Train.

Your account and workout data powers your personalised training program, progress tracking, and performance analytics within the app.

Anonymised usage analytics and crash reports help us identify bugs, understand which features are most useful, and prioritise improvements.

We may email you about important changes to the app, your account, or your subscription. We do not send marketing emails without your explicit opt-in.

We process your account details, programme and workout history because you asked us to provide the Train service. Without this data we cannot build or store your programme. This is Article 6(1)(b) of the UK and EU GDPR.

Your height, weight, date of birth, biological sex and training records count as health data — a special category under Article 9. We process it only with your explicit consent, which you give when you complete the questionnaire or grant Apple Health access. You can withdraw that consent at any time by deleting your account or revoking HealthKit permission in iOS Settings. Withdrawal does not affect processing carried out before you withdrew.

We use crash and diagnostic data to keep the app stable and secure. Our interest is a working product; the data is aggregated and does not identify you. This is Article 6(1)(f). You can object — see your rights below.

We use Firebase Analytics and Firebase Crashlytics, provided by Google LLC, for crash reporting and aggregated, non-identifying usage analytics. Firebase receives event names (such as "paywall_shown" or "workout_completed"), session diagnostics, and an anonymous device identifier (IDFV) — but never your health data, workout content, body measurements, email, or name. Train does not use Apple's App Tracking Transparency framework and does not track you across other apps or websites. Google's privacy policy applies: policies.google.com/privacy

Supabase provides our database, authentication and hosting. It stores your account details, workout history, programmes and body measurements on our behalf. Your data is held in Zurich, Switzerland. Supabase acts only on our instructions and never uses your data for its own purposes.

RevenueCat manages subscription status and receipt validation. It receives your Train account identifier, your purchase and renewal events, and an anonymous device identifier — but never your health data, workout content, body measurements or name. RevenueCat is based in the United States; see the transfers section below.

Resend delivers our transactional email — sign-in links, confirmations and account notices. It receives your email address and the contents of those messages. We do not send marketing email.

If you choose to sign in with Apple, Apple processes your authentication. Apple's privacy policy applies. We receive only the minimum data Apple provides (name, email).

If you choose to sign in with Google, Google processes your authentication. Google's privacy policy applies. We receive only your name and email address.

Subscription payments are processed entirely by Apple. We never see or store your payment information. Apple's privacy policy governs payment processing.

Held while your account is open, and deleted when you delete your account.

Kept for 7 years after your last transaction, because UK tax law requires us to retain records of sales. These records survive account deletion. They hold your account identifier, what you paid and when — never your name, email, health or workout data.

Kept only as long as it is useful for fixing the problem it reports, then deleted on our analytics provider's retention schedule.

Request a copy of the personal data we hold about you.

Request that we correct inaccurate or incomplete data.

Request that we delete your personal data and close your account.

Request your data in a machine-readable format for transfer to another service.

Withdraw your consent to health-data processing at any time. Revoke HealthKit access in iOS Settings, or delete your account to remove the data we hold. This does not affect anything we did before you withdrew.

Object to processing we carry out under our legitimate interests, such as crash diagnostics.

Ask us to pause processing while a dispute about accuracy or lawfulness is resolved.

Train is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at info@trainstrengthapp.com and we will delete it promptly.

We may update this privacy policy from time to time. When we do, we'll update the "Last updated" date at the top of this page and notify you via the app or email if the changes are material. Continued use of Train after changes constitutes acceptance of the updated policy.