Privacy

What it stores

• From Google sign-in: your name, email address, and profile picture. That is the entire permission being requested — nothing in your Gmail, Drive, Contacts, Photos, or Calendar is requested or reachable.
• What you log: the exercise, the weight, the reps, the time you saved it, and how it was logged — in the app, at the weight-room kiosk, or by an AI assistant you connected. Also any bodyweight, notes, and cardio you type in yourself.
• Baseline tests: the results your coach records for you on a testing day, such as a jump height or a sprint time.
• A kiosk PIN, if you set one: stored only in scrambled (hashed) form, never the PIN itself.
• Cardio from your phone, only if you set it up: if you pair the Lift Day app, it reads your phone's health store — Health Connect on Android, Apple Health on iPhone — and sends each workout's activity type, start and end time, duration, distance, calories burned (active calories, or on Android total calories when the phone has no active figure), and heart rate. Heart rate arrives as individual readings; we keep only the average, high and low for each workout and discard the rest. On an iPhone, Apple Health asks you what Lift Day may read, and Lift Day only ever asks to read.

Who can see it

• You see your own history.
• Coaches see the athletes on their own team, and nothing outside it. A coach of one team cannot see another team's athletes.
• An AI assistant you connect sees only what you allowed when you connected it — see below.
• Whoever runs the server has database access. That is unavoidable when something is self-hosted, and it is worth saying out loud rather than implying otherwise.
• Nobody else. Your data is never sold, shared, or used for advertising.

What it doesn't do

• No analytics, no advertising trackers, no third-party scripts.
• Cookies are only for signing in: the ones that sign you in and keep you signed in, and on a weight-room kiosk, the ones that remember the device and who is lifting. Your light or dark choice is kept in your browser and never sent to us.
• No email is ever sent to you from this app.

Other services involved

• Google — sign-in only.
• Cloudflare — carries traffic between your phone and the server, and can see IP addresses and request metadata the way any network provider does.
• GitHub — the demo photos on "How to perform" are served from a public exercise dataset, so opening one makes your browser request an image from raw.githubusercontent.com.
• The Lift Day app (Android and iPhone) — ours, free, and involved only if you pair it. It reads the workout records listed above from Health Connect or Apple Health on your phone and sends them here, and it never writes to your health data. You can withdraw its access in Health Connect's settings, or on an iPhone in Settings → Privacy & Security → Health → Lift Day, or disconnect it under Connect your phone, at any time.
• Apple — while the iPhone app is being tested it comes through Apple's TestFlight. If you install it that way, Apple tells us when the app crashes and passes on any feedback you choose to send from TestFlight.
• An AI assistant (Claude, ChatGPT, Gemini, Grok, or a Siri shortcut) — only if you connect one, and only for what you tick when you do: logging your lifts, reading your own training, reading the exercise list and, for coaches, writing the team's programme or seeing what stands out about the team. A coach's assistant never receives athletes' names, email addresses or rows, only conclusions with athletes identified by a code. Whatever passes through an assistant is also handled by the company that makes it, under its own privacy policy. You can disconnect one at any time under Settings → Manage assistant keys.

Deleting your data

Ask and it gets deleted. Email [email protected] and say what you want removed.

One thing worth knowing: when a coach removes an athlete from a team, that detaches the athlete from the roster but keeps the sets they logged. Deleting everything is a separate request, and it is always available to you.

Most athletes here are under 18. A parent or guardian can ask to see or delete their child's data at the same address, no questions asked.

The Lift Day phone app keeps nothing of its own: the workouts it sent are part of your log and are deleted with it. Disconnecting the app, or taking away its access to Health Connect or Apple Health, stops new workouts arriving but leaves the ones already sent in your log until you ask.

The site is backed up every night, encrypted, and backups are kept for up to 90 days. Something you had deleted can stay inside an older backup until that backup is cleared out; backups are only ever used to put the site back after a failure.

Changes

If any of this changes in a way that matters, the date at the top changes and coaches will be told so they can pass it along.

Contact

[email protected]