Privacy policy

POWALIFTA ("we", "us") respects your privacy. This page explains what we collect, why, and what we do with it. We've kept it short on purpose.

What we collect

When you sign up, we ask for your name, email address, and a password. Coaches additionally provide a bio shown on the public coach directory.

As you use POWALIFTA, we store your training data: the programs your coach builds, the sets you log (weight, reps, RPE, notes, dates), your bodyweight entries, your training goals, and any session notes you write. Coaches can see this data for athletes connected to their account.

If you choose to add them, we also store a profile photo, your country and your Instagram and TikTok handles, plus the messages you send your coach, the form-check videos you upload, and the posts and reactions you share in a club.

When something in the app or the site breaks, we keep an error report so we can fix it: the error message and where in the code it happened, the page (never its query string) and your browser or app version (user agent). It isn't tied to your account.

We do not collect: ID documents, payment card details (handled by Lemon Squeezy on the web and by Apple for purchases in the iPhone app), location data, or biometric data. (Some cameras write where a video was filmed into the file itself. The iPhone app removes that before a form-check video uploads; a video sent from a web browser is stored as your camera saved it.)

Where it lives

Your account and training data are stored in a managed Postgres database operated by Supabase. Data is encrypted in transit (TLS) and at rest. We use Supabase's authentication service to manage logins; passwords are hashed and we never see or store the plaintext. Your browser also keeps a small amount of non-sensitive state (theme preference, session tokens) in localStorage.

Sub-processors

We use a small number of service providers to run POWALIFTA: Supabase (database, authentication, file storage), Vercel (website hosting and CDN), Lemon Squeezy (payments and all card details, as merchant of record), Resend (transactional email, e.g. welcome emails), Google (the Gemini AI assistant, see below; also Google Fonts for font delivery), Apple (in-app purchases and push notifications in the iPhone app). Each only receives the data needed to do its job. If you search OpenPowerlifting to bring in your meet results, the name you type goes to OpenPowerlifting through our server, which doesn't keep it; the meets you choose are saved to your account like any meet you log.

Apple Health

In the iPhone app you can turn on Apple Health (You → Apple Health). It's off until you do, and nothing is read from or saved to Health before that. You can turn it off there at any time, or change what POWALIFTA may read and save in the Health app (tap your picture, then Apps → POWALIFTA). The website never touches Apple Health.

What POWALIFTA reads from Apple Health:

• Bodyweight from your smart scale or other apps (the last 60 days when you turn Health on, then each new reading), to fill in days you haven't logged a weigh-in. If both have a different number for the same day, the app asks which to keep.
• Sleep (minutes asleep each night, or time in bed if that's all Health has, the last 14 nights) and resting heart rate (the last 35 days), shown on Train's "How do you feel today?" and on Progress.
• Heart rate variability (HRV, the last 35 days), which only an Apple Watch or another wearable records. With your resting heart rate it drives the rest suggestion: longer rests between top sets on a morning well off your usual. It never changes your loads.
• Calories and protein you eat, as daily totals from the app you log food in (the last 14 days), shown as 7-day averages on Make weight. We never see what you ate, only the two totals per day.

POWALIFTA doesn't read your workouts; it only saves its own. It never asks for active energy, steps, location or clinical records.

What POWALIFTA saves to Apple Health: the weigh-ins you log in the app, and each finished session as a strength training workout with its name, number of sets, total lifted and the lifts (weights and reps). Undo a session and its workout comes back out of Health.

What stays on your phone: your sleep, resting heart rate, HRV, calories and protein, the readiness and rest suggestion worked out from them, and the Readiness and Lock Screen widgets if you add them. They're kept in the app on that phone, for your account, and leave it only in the cases below.

What reaches our database, and who sees it:

• Weigh-ins from Apple Health. One you bring in becomes an ordinary weigh-in in your account, like one you type: your current coach sees it, and it's used wherever your weigh-ins are (your latest bodyweight on a club board or on the leaderboard if you're on them, and your weekly email). It is never sent to the AI assistant: the assistant gets only the weigh-ins you type, and no Apple Health data at all (no sleep, heart rate, food or readiness). Delete it like any weigh-in. Turning Apple Health off doesn't remove weigh-ins already brought in.
• Sleep, resting heart rate and HRV, only if you switch on Share with your coach. Off by default. Then one row per day goes to our database: minutes asleep, resting heart rate and HRV, starting with the last 14 nights and 35 days so your coach can see your usual. Only you and your current coach can see it; your coach sees your recovery and a readiness marker worked out from it.
• Calories and protein, only if you switch on Share food with your coach, a separate switch, off by default. Then one row per day goes up, the daily calories and grams of protein, starting with the last 14 days. A day with nothing logged sends nothing. Only you and your current coach can see it.
• A check-in answer. If your coach asks a check-in question about sleep, the app fills in last night's hours from Apple Health and says so. You can change or skip it, and it only goes to your coach when you tap Send, like any check-in answer.

When it's deleted: turning a sharing switch off deletes everything that switch sent, straight away. Turning Apple Health off in the app turns both switches off, so both are deleted. If you leave your coach, your coach removes you, or you move to a new coach, both switches turn off and the shared data is deleted; a new coach starts with sharing off. Deleting your account deletes all of it. Changing access in the Health app stops new readings but doesn't delete what was already shared: turn the switch off for that. While a switch stays on, the shared days are kept so your coach can see your trend.

We never use Apple Health data for advertising or marketing, never sell it, never share it with data brokers or anyone outside what's listed here, and never store it in iCloud.

AI assistant

The in-app assistant ("Ask AI") is optional: you only use it if you open it and ask a question. When you do, the question plus a short summary of the relevant training data (for example your recent lifts, e1RM and program, or for coaches a roster overview) is sent to Google to generate a reply with their Gemini model. We send only what's needed to answer, never your password, payment details or anything from Apple Health. The request goes through our own server first so the API key is never exposed to your browser. If you never open the assistant, none of your data is sent to Google.

Coaches can also bring a program in from a photo, a screenshot or a PDF. That file goes through our server to Google's Gemini model, which reads the program and sends it back to your screen to check. Neither we nor the request keep the file: it isn't stored on our servers, and nothing is saved until you choose to save the program.

How long we keep data

While your account is active, we keep your data so you can see your training history. When you delete your account, the erasure is immediate: your profile, programs, logs, messages, uploaded form-check videos and everything else tied to you are removed straight away, not queued for later. The one exception is billing/purchase records we're legally required to keep for tax: those rows survive with your personal details stripped out (the amount and date remain; the identity is anonymized).

Clubs, the leaderboard and public pages

When you join a club, its other members can see your name, profile photo, Instagram and TikTok handles (if you added them), and the numbers behind the club boards: your best squat, bench, deadlift and total, your DOTS score, your latest bodyweight, your sex category, how many sessions and how much weight you lifted this week, your points, hard sets and PRs this week, your points this season, and how much your estimated maxes improved over the last four weeks. If you and another member agree to be training buddies, either of you can send the other a nudge notification, at most once every 12 hours, with wording we write, not theirs. Either of you can end it any time, and leaving the club ends it. They also see the posts and reactions you share in the club. They never see your program, your full training log, your bodyweight history, your messages or your email. Leaving a club removes your posts from it. If someone reports a post, we keep a copy with the report so we can review it.

The public DOTS leaderboard is opt-in. If you publish to it, your name, total, DOTS score, bodyweight, sex category and country are public until you remove yourself. A coach's public profile shows their name, photo, bio and Instagram and TikTok handles.

Applications to a coach

A coach's public profile can have an Apply form for people who aren't on POWALIFTA yet. It asks for your name and email and, if you want to add them, your training age, best lifts, bodyweight, next meet, goals and a note. A note can hold health information (an old injury, say): write only what you're happy for that coach to read.

Who sees it: we email you a link first, and nothing reaches the coach until you open it. Then only that coach can read your application, in the app; they get a notification and an email with your name and a one-line summary (never your note). Nobody else does: not other coaches, not other users, not the public. We don't use it for anything else, and it isn't sent to the AI assistant.

How long we keep it: an application you never confirm is deleted after 48 hours. Once the coach accepts or declines it, it's deleted 90 days later; one nobody has answered is deleted after 180 days. The coach can delete it at any time. If the coach accepts, they email you an invite link; declining sends nothing. To have yours deleted sooner, ask the coach, or email powalifta1320@gmail.com from the address you applied with. To stop abuse we count applications per network address and per email for a day, without storing what you sent with that count.

Your coach's results cards

A coach can make a card of their lifters' results to post themselves, for example on Instagram: their lifters' average e1RM gain this block, or this week's PRs. A lifter on a card shows as their first name and the first letter of their last name, with the change in their e1RM total or what they lifted for a PR. You can keep your name off: in the app, You › Community › Name on your coach's posts. You then still count in the average, shown as "A lifter", and your PRs stay off the PR wall. Only you can change it. A card your coach posts is theirs: they choose where it goes and can delete it.

Who we share it with

Nobody, except: coaches you have connected to (they see your training data and notes, which is the point), members of a club you join (they see what's listed above), everyone if you publish to the leaderboard, our payment processor for billing-related lookups (coaches only), and any authorities if compelled by law. We do not sell user data to advertisers, brokers, or any third party.

Cookies and analytics

We don't use advertising trackers, cross-site cookies, or fingerprinting, and we never sell your data. We keep you logged in with a session token in your browser's localStorage; that's essential, and clearing it just signs you out. For visit counts we use Plausible, a privacy-friendly, cookieless analytics tool that stores no personal data and never tracks you across sites. Prefer not to be counted? Choose "Essential only" on the privacy banner when you first visit, and we'll remember it.

Your rights

You can access, export, or delete your data at any time, all self-serve from Settings on your dashboard. Export is instant: use the Export buttons under "Your data" for a full JSON archive or a CSV of your training log. Deletion is self-serve too: open Settings → Danger zone → "Delete my account", type DELETE to confirm, and your account and data are erased immediately (billing records are retained anonymized, as above). Prefer we do it for you, or need anything else? Email powalifta1320@gmail.com and we'll handle it within 30 days. If you're in the EU, UK, or California, you have specific rights under GDPR/UK-GDPR/CCPA. Same options, same response time.

Children

POWALIFTA is not intended for use by anyone under 16, and everyone confirms they're 16 or older when they sign up. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we'll remove the account.

Changes

If we materially change this policy we'll update the "Last updated" date and, where required, notify you by email.

Contact

Questions: powalifta1320@gmail.com