We collect the following categories of information when you use TrainingGround:

• Account information: your email address and the date your account was created, provided when you sign up.
• Profile data: display name, fitness goals, equipment preferences, skill level, and avatar, which you provide during onboarding or in settings.
• Training data: workouts completed, session logs, exercise set and rep records, workout plans you create, and progress metrics such as streak counts and total minutes trained.
• Progress photos: images you choose to upload to the progress photos feature. These are stored securely and are private to your account.
• Body measurements: any measurements you optionally record within the app (e.g. weight, body measurements).
• Payment information: handled directly by Stripe. We do not receive or store your full card details. We receive confirmation of payment status and subscription tier from Stripe.
• Usage and technical data: basic diagnostic information such as the type of device or browser you use, to help us operate and improve the Service. We do not currently use third-party behavioural analytics.

We use the information we collect to:

• Create and manage your account and provide access to the Service.
• Personalise your experience — for example, showing appropriate workouts based on your skill level and goals, or surfacing your training history and streak data.
• Generate AI-powered workout suggestions (Pro feature) using your profile and readiness inputs. AI generation is performed server-side and your data is not shared with third-party AI providers without your knowledge.
• Process payments and manage your subscription status.
• Send transactional communications — such as password reset emails — that are necessary to operate your account.
• Improve the Service by understanding how features are used at an aggregate level.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Authentication is handled by Supabase Auth, which stores your email address and a hashed version of your password. We never store your password in plaintext. Session tokens are stored locally in your browser and are used to maintain your logged-in state.

Your user profile data (display name, goals, preferences, and training statistics) is stored in our database, hosted on infrastructure provided by Supabase. Access to your data is controlled by row-level security policies — meaning only you can read and modify your own records.

All payment processing is handled by Stripe, a PCI-DSS compliant payment processor. When you purchase a subscription or lifetime access, you enter your payment details directly into Stripe's secure hosted form. We do not have access to your full card number, CVV, or bank account details.

We receive from Stripe: your subscription status, the product you purchased, and basic billing information such as the last four digits of your card and billing email, which are used solely to manage your account and display your subscription details to you.

Stripe's privacy policy governs how Stripe handles your payment data: stripe.com/gb/privacy.

Training data you generate — including session logs, completed workouts, set/rep records, personal records, and custom workout plans — is stored in your account and is private to you. This data is used to power features such as your training history, streak tracking, and progress charts.

We do not share your individual training data with other users or third parties. We may use aggregated, anonymised data (where no individual can be identified) to understand general usage patterns and improve the Service.

Progress photos are a sensitive category of personal data. Photos you upload are stored in a private, access-controlled storage bucket. They are not publicly accessible; only you can view them when signed in to your account.

We do not analyse, process, or share the contents of your progress photos. They are stored solely to enable you to view your own progress over time within the app.

You can delete your progress photos at any time from within the app. Deletion is permanent.

Body measurements you record (weight, body measurements, etc.) are treated with the same level of care and are private to your account.

We may collect basic technical and diagnostic information — such as browser type, device type, and general geographic region — to help us diagnose errors and improve the reliability of the Service. This information is not linked to identifiable individuals.

We do not currently use third-party advertising trackers or behavioural analytics tools (such as Google Analytics or Meta Pixel) within the authenticated application. If this changes, we will update this policy and provide appropriate notice.

We retain your personal data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymise your personal data within a reasonable time, except where we are required to retain it for legal or accounting purposes.

Certain anonymised or aggregated data (with no link to you as an individual) may be retained indefinitely for analytical purposes.

You can request deletion of your account and associated data at any time by contacting us (see the Contact section below). We will respond to deletion requests within 30 days.

We take the security of your personal data seriously. We use industry-standard measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit.
• Encrypted storage for data at rest via our infrastructure provider.
• Hashed passwords — we never store plaintext passwords.
• Row-level security policies that prevent cross-account data access.
• Leaked-password protection — we check passwords against known breach databases on sign-up and will prompt you to change your password if a compromise is detected.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

Depending on your location, you may have the following rights in relation to your personal data:

• Access: the right to request a copy of the personal data we hold about you.
• Rectification: the right to correct inaccurate or incomplete personal data. Much of your profile data can be updated directly within the app.
• Erasure: the right to request that we delete your personal data, subject to certain legal exceptions.
• Portability: the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Restriction: the right to request that we restrict the processing of your data in certain circumstances.
• Objection: the right to object to processing based on legitimate interests.

To exercise any of these rights, please contact us at the address in the Contact section. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data in accordance with applicable law.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will provide additional notice such as an in-app notification or email.

Your continued use of the Service after changes take effect constitutes your acceptance of the revised Policy. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to report a concern, please contact us at: