Privacy Policy

POWALIFTA ("we", "us") respects your privacy. This page explains what we collect, why, and what we do with it. We've kept it short on purpose.

What we collect

When you sign up, we ask for your name, email address, and a password. Coaches additionally provide a bio shown on the public coach directory.

As you use POWALIFTA, we store your training data: the programs your coach builds, the sets you log (weight, reps, RPE, notes, dates), your bodyweight entries, your training goals, and any session notes you write. Coaches can see this data for athletes connected to their account.

We do not collect: ID documents, payment card details (handled by our payment processor — Lemon Squeezy), location data, or biometric data.

Where it lives

Your account and training data are stored in a managed Postgres database operated by Supabase. Data is encrypted in transit (TLS) and at rest. We use Supabase's authentication service to manage logins; passwords are hashed and we never see or store the plaintext. Your browser also keeps a small amount of non-sensitive state (theme preference, session tokens) in localStorage.

Sub-processors

We use a small number of service providers to run POWALIFTA: Supabase (database, authentication, file storage), Vercel (website hosting and CDN), Lemon Squeezy (payments — they act as merchant of record and handle all card details), Resend (transactional email, e.g. welcome emails), Google (the Gemini AI assistant, see below; also Google Fonts for font delivery). Each only receives the data needed to do its job.

AI assistant

The in-app assistant ("Ask AI") is optional: you only use it if you open it and ask a question. When you do, the question plus a short summary of the relevant training data (for example your recent lifts, e1RM and program, or for coaches a roster overview) is sent to Google to generate a reply with their Gemini model. We send only what's needed to answer, never your password or payment details. The request goes through our own server first so the API key is never exposed to your browser. If you never open the assistant, none of your data is sent to Google.

How long we keep data

While your account is active, we keep your data so you can see your training history. When you delete your account, the erasure is immediate — your profile, programs, logs, messages, uploaded form-check videos and everything else tied to you are removed straight away, not queued for later. The one exception is billing/purchase records we're legally required to keep for tax: those rows survive with your personal details stripped out (the amount and date remain; the identity is anonymized).

Who we share it with

Nobody, except: coaches you have connected to (they see your training data and notes — that's the point), our payment processor for billing-related lookups (coaches only), and any authorities if compelled by law. We do not sell user data to advertisers, brokers, or any third party.

Cookies and analytics

We don't use advertising trackers, cross-site cookies, or fingerprinting, and we never sell your data. We keep you logged in with a session token in your browser's localStorage; that's essential, and clearing it just signs you out. For visit counts we use Plausible, a privacy-friendly, cookieless analytics tool that stores no personal data and never tracks you across sites. Prefer not to be counted? Choose "Essential only" on the privacy banner when you first visit, and we'll remember it.

Your rights

You can access, export, or delete your data at any time — all self-serve from Settings on your dashboard. Export is instant: use the Export buttons under "Your data" for a full JSON archive or a CSV of your training log. Deletion is self-serve too: open Settings → Danger zone → "Delete my account", type DELETE to confirm, and your account and data are erased immediately (billing records are retained anonymized, as above). Prefer we do it for you, or need anything else? Email powalifta1320@gmail.com and we'll handle it within 30 days. If you're in the EU, UK, or California, you have specific rights under GDPR/UK-GDPR/CCPA — same options, same response time.

Children

POWALIFTA is not intended for use by anyone under 16. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we'll remove the account.

Changes

If we materially change this policy we'll update the "Last updated" date and, where required, notify you by email.

Contact

Questions: powalifta1320@gmail.com