Privacy Policy

When you create an account, we collect your name and email address. If you sign in with Apple or Google, we receive only what those services provide — typically a name and email. If you use Apple's “Hide My Email”, we receive Apple's private relay address instead of your real one, and that is the address we write to.

We store the workout sessions you log — including exercises, sets, reps, weights, and rest times — so your program and progress are available across sessions and devices.

With your permission, Train can read your height and weight, and save your completed workouts, through Apple Health on iPhone or Health Connect on Android. On iPhone it can also read your date of birth and biological sex. This is entirely optional and controlled by your device's permission settings.

If the app crashes or hits an error, we receive a report: the error, your app version, your device model and operating system, and what the app was doing when it failed. It is tied to your account identifier, never to your name or email. We do not collect usage analytics or advertising data.

We email you a sign-in or confirmation code when you need one, a welcome message when your account is ready, and, if you start a free trial, a reminder before it ends. These are messages about your account, not marketing.

Your height, weight, date of birth, and biological sex. Train uses these to personalize your training program — for example, selecting appropriate load progressions. This is optional: if you decline, you can enter the values manually and Train still works.

Your completed workout sessions, recorded as strength-training workouts with their start and end times, so your training appears in your overall health record.

You can grant or revoke HealthKit permissions at any time via iOS Settings → Privacy & Security → Health → Train.

Your height and weight, to personalize your training program. Health Connect does not hold a date of birth or sex, so Train asks you for those directly. This is optional: if you decline, you can enter the values yourself and Train still works.

Your completed workout sessions, recorded as strength-training exercise sessions with their start and end times.

You can grant or revoke access at any time in Health Connect: Settings → Health Connect → App permissions → Train. You can also delete the data Train has written from there.

Your account and workout data powers your personalized training program, progress tracking, and performance analytics within the app.

Crash reports help us find bugs and decide which fixes matter most.

We email you sign-in and confirmation codes, a welcome message when your account is ready, a reminder before a free trial ends, and notice of important changes to the app or your account. We do not send marketing email. If that ever changes, we will ask you first.

We process your account details, program and workout history, and send the service messages described above, because you asked us to provide the Train service. Without this data we cannot build or store your program. This is Article 6(1)(b) of the UK and EU GDPR.

Your height, weight, date of birth, biological sex and training records count as health data — a special category under Article 9. We process it only with your explicit consent, which you give when you complete the questionnaire or grant Apple Health or Health Connect access. You can withdraw that consent at any time by deleting your account or revoking the permission in your device's settings. Withdrawal does not affect processing carried out before you withdrew.

We use crash and diagnostic data to keep the app stable and secure. Our interest is a working product. The reports are tied to an account identifier, not to your name or email. This is Article 6(1)(f). You can object — see your rights below.

We use Sentry, provided by Functional Software, Inc., to receive crash and error reports. They are stored in Germany. A report contains the error, your app version, your device model and operating system, and your account identifier — but never your email, name, health data, workout content or body measurements. Train does not use analytics or advertising tools, does not use Apple's App Tracking Transparency framework and does not track you across other apps or websites. Sentry's privacy policy applies: sentry.io/privacy

Supabase provides our database, authentication and hosting. It stores your account details, workout history, programs and body measurements on our behalf. Your data is held in Zurich, Switzerland. Supabase acts only on our instructions and never uses your data for its own purposes.

RevenueCat manages subscription status and receipt validation. It receives your Train account identifier, your purchase and renewal events, and an anonymous device identifier — but never your health data, workout content, body measurements or name. RevenueCat is based in the United States; see the transfers section below.

Resend delivers our transactional email from Ireland: sign-in and confirmation codes, your welcome message, and free-trial reminders. It receives your email address and the contents of those messages. We switch off open and click tracking, and we do not send marketing email.

On iPhone you can choose to sign in with Apple, and Apple processes your authentication. Apple's privacy policy applies. We receive only the minimum data Apple provides (name, email — or Apple's private relay address if you hide your email).

On iPhone and Android you can choose to sign in with Google, and Google processes your authentication. Google's privacy policy applies. We receive only your name and email address.

On iPhone, subscription payments are processed entirely by Apple. We never see or store your payment information. Apple's privacy policy governs payment processing.

On Android, subscription payments are processed entirely by Google Play. We never see or store your payment information. Google's privacy policy and Google Play's terms govern payment processing.

Exercise demonstration videos are streamed from Bunny Stream, operated by BunnyWay in the EU. To play a video your device connects to Bunny, which therefore sees your device's IP address and which video you asked for. Bunny receives none of your account, health or workout data.

We deliver app updates through Expo's update service. When the app checks for an update it sends your app version and platform, and Expo sees your device's IP address. It receives none of your account, health or workout data.

Held while your account is open, and deleted when you delete your account.

Kept for 7 years after your last transaction, because UK tax law requires us to retain records of sales. These records survive account deletion. They hold your account identifier, what you paid and when — never your name, email, health or workout data.

Kept only as long as it is useful for fixing the problem it reports, then deleted automatically on our crash-reporting provider's retention schedule.

Request a copy of the personal data we hold about you.

Request that we correct inaccurate or incomplete data.

Request that we delete your personal data and close your account.

Request your data in a machine-readable format for transfer to another service.

Withdraw your consent to health-data processing at any time. Revoke access in iOS Settings or in Android's Health Connect settings, or delete your account to remove the data we hold. This does not affect anything we did before you withdrew.

Object to processing we carry out under our legitimate interests, such as crash diagnostics.

Ask us to pause processing while a dispute about accuracy or lawfulness is resolved.

Train is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@trainstrengthapp.com and we will delete it promptly.

We may update this privacy policy from time to time. When we do, we'll update the "Last updated" date at the top of this page and notify you via the app or email if the changes are material. Continued use of Train after changes constitutes acceptance of the updated policy.