Data we collect

Depending on how you use Workout Trackr, we process:

• Google account data: your Google account identifier, name, email address, email verification status, and profile image when available.
• Email sign-in data: the email address you submit when requesting a passwordless sign-in link.
• Authentication data: session identifiers and the OAuth credentials Google provides, or a single-use email verification token, to keep your account signed in securely. Workout Trackr does not receive your Google or email password.
• Training data: log and exercise names, workout dates, repetitions, weights, hard-set selections, durations, distances, and calculated performance metrics.
• Technical data: hosting and security logs may include your IP address, browser or device information, requested pages, timestamps, and diagnostic information. Short-lived, one-way hashes derived from an email address and IP address are used to limit repeated sign-in requests.
• Correspondence: information you include when you contact us about support, privacy, or another request.

How and why we use your data

We use personal data to:

• authenticate you and protect your account;
• save, calculate, and display your private training record;
• operate, troubleshoot, secure, and improve the service;
• respond to support and privacy requests; and
• comply with legal obligations and enforce legal rights.

Where the GDPR applies, these activities rely on performing the service you request, our legitimate interests in running a secure and reliable service, compliance with legal obligations, and consent where we specifically ask for it. You may withdraw consent at any time when processing depends on consent.

Sign-in providers

Workout Trackr uses Google OAuth to create and secure your account. Google account data received through sign-in is used only for authentication, account security, and retrieving your private training data. It is not sold, used for advertising, or transferred for unrelated purposes.

Google processes information under its own Privacy Policy. You can also review or revoke Workout Trackr's access through your Google Account settings.

You may instead request a passwordless sign-in link. Postmark delivers the link to the email address you provide. The link is single-use and expires after 24 hours. If that email already belongs to a Workout Trackr account, the verified link signs you into the existing account.

Cookies

Workout Trackr uses a strictly necessary Auth.js session cookie to keep you signed in and associate requests with your private account. It is HTTP-only, uses secure settings in production, and expires when the authentication session ends. Blocking it prevents sign-in and authenticated features from working.

Workout Trackr currently does not use analytics, advertising, behavioural-tracking, or marketing cookies. Because the session cookie is necessary to provide the service you request, it is not presented as an optional cookie.

Service providers and sharing

We do not sell personal data or share it for targeted advertising. We use the following providers to operate Workout Trackr:

• Google for sign-in and account authentication: privacy policy.
• Postmark/ActiveCampaign for transactional delivery of passwordless sign-in links: privacy policy.
• Vercel for application hosting, delivery, and operational logs: privacy notice.
• Neon/Databricks for managed PostgreSQL database services: privacy notice.

Data may also be disclosed when required by law, to protect users or the service, or as part of a business reorganisation where appropriate safeguards apply.

How long we keep data

• Account and training data are retained while your account is in use and until you ask us to delete the account.
• Training records you delete through the app are removed from the active database with their related data.
• Temporary demo workspaces expire after two hours and are removed when you exit the demo or by scheduled cleanup after expiration.
• Authentication sessions are retained until they expire, are replaced, or you sign out.
• Email verification tokens expire after 24 hours. Hashed sign-in-rate-limit buckets expire after 15 minutes and are pruned during subsequent sign-in requests.
• Technical logs and backup copies may remain for a limited period under provider retention schedules or where required for security and legal obligations.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data; restrict or object to processing; and withdraw consent where consent is the legal basis. You may also complain to your local data-protection authority.

To request account deletion, a copy of your data, or help exercising another privacy right, email admin@workouttrackr.com. We may need to verify that the request belongs to you before acting on it.

International processing

Our service providers may process data in countries outside your own. Where required, we rely on contractual and other safeguards intended to protect personal data during international transfers.

Security

We use reasonable technical and organisational safeguards, including encrypted connections, restricted database access, secure session cookies, and access controls. No online service can guarantee absolute security.

Children's privacy

Workout Trackr is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has provided personal data, contact us so we can investigate and delete it where appropriate.

Changes and contact

We may update this policy when the service or legal requirements change. The date at the top shows the latest revision. Material changes will be communicated through an appropriate notice.

For questions or privacy requests, contact Vasilis Zisis at admin@workouttrackr.com.