Train Swole

Effective Date: July 3, 2026

Privacy Policy

Train Swole ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application and related services (collectively, the "Service").

1. Information We Collect

We collect the following types of information:

We use product analytics to understand how the Service is used and to improve features such as training flows and subscriptions.

  • Account Information: name, email address, and password hash when you register or sign in.
  • Profile Photo (optional): if you upload a profile picture, we store it in private object storage (Cloudflare R2) and keep a compressed copy on your device for offline display. If you sign in with Google, we may show Google's profile image without storing a copy on our servers unless you upload your own photo.
  • Authentication Data: if you use Google sign-in, we receive your name and email from Google. We also store OAuth tokens and session identifiers.
  • Fitness Data: workouts, exercises, sets, reps, weights, RPE ratings, program cycles, templates, and related training metrics you log through the Service.
  • Health Integration Data: if you connect WHOOP, Google Fit (Health Connect on Android), Apple Health, or Google Health (Fitbit and Pixel account data via the Google Health API), we sync and store profile and health metrics such as weight, workouts, recovery or readiness indicators, heart rate variability (HRV), sleep, steps, and related data made available by the provider you connect.
  • AI Feature Context: when you use AI-assisted features, we may process and temporarily retain bounded training context such as program details, planned targets, workout history, recovery or readiness status, check-in notes you choose to provide, the AI prompt, the AI output, and related technical metadata for quality review, troubleshooting, prompt improvement, and AI evaluations. We design AI payloads and retained traces to exclude direct identifiers such as your name, email address, phone number, address, passwords, tokens, and raw health samples, but the training and recovery context may still relate to your account.
  • Body Stats: bodyweight and height values you enter.
  • Device and Usage Data: IP address, user agent, and timezone preference for session management, rate limiting, and security.
  • Product Analytics: if enabled, we use PostHog to collect product usage events tied to your account ID (for example, screens viewed, workouts completed, and subscription actions). We do not send your email address or workout content to PostHog.
  • Local Device Data: a local database on your device caches workouts and preferences for offline access and sync. Depending on your device and operating-system settings, local app data may also be included in an encrypted Apple or Google device backup controlled by your platform account.

2. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service.
  • Authenticate your account and keep you signed in.
  • Track and analyze your fitness and recovery data.
  • Sync data with connected third-party services (e.g., WHOOP).
  • Generate AI Coach and AI Session suggestions, progression suggestions, and external AI context when you request those features, and review retained AI prompts and outputs to improve quality and safety.
  • Enforce rate limits and protect against abuse.
  • Communicate with you about your account or the Service.

3. How We Store and Protect Your Data

Your synced data is stored in a Cloudflare D1 (SQLite) database. Local accounts keep training on the device. Verified free accounts receive limited recent cloud backup, currently 7 days, without full-history restore, export, or external AI access. Once an account has Train Swole Pro, its full synced training history is retained for the life of the account; restore, export, and supported external AI access require active Pro access. Profile photos you upload are stored in private Cloudflare R2 object storage and served only through authenticated requests to our API, not via public R2 URLs. Offline data is also stored on your device and may be covered by your platform backup settings. Deleting your account removes active server and on-device app data, but copies already held in an encrypted platform backup remain governed by Apple or Google and may persist until that backup expires or you delete it. We use industry-standard practices to protect your information, including hashed passwords and encrypted connections. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

4. Third-Party Services

We integrate with third-party services to provide features. These services have their own privacy policies:

We do not sell your personal information to third parties.

  • Google OAuth: used for sign-in and sign-up. Subject to Google's Privacy Policy.
  • WHOOP: used for health and recovery data integration. Subject to WHOOP's Privacy Policy.
  • PostHog: used for product analytics when enabled. Subject to PostHog's Privacy Policy.
  • AI infrastructure providers: when you request AI-assisted features, bounded training and recovery context, prompts, and outputs may be routed through our AI gateway and downstream model providers to generate suggestions and support observability. We currently use Cloudflare AI Gateway for this routing and observability, and we may change gateway or model providers over time.

5. Cookies and Sessions

We use session cookies and tokens to keep you authenticated, protect requests, and remember your cookie choices. These are essential for the Service to function. On the website, optional analytics are disabled unless you accept the Analytics category in Cookie settings.

6. Your Rights and Choices

You may:

We will comply with applicable laws regarding your rights to access, correct, or delete your personal information.

  • Access, update, or delete your account information through the app.
  • Update your display name and remove your profile photo from Profile at any time.
  • Delete your account and associated active server and local app data from Help & Support in the app. Account deletion requires an internet connection and permanently deletes uploaded profile photos and account-linked AI quality traces from our servers. Copies in an existing Apple or Google device backup are controlled through your platform backup settings.
  • Reset account removes your uploaded profile photo and local cache; Google profile images from sign-in may remain until you remove them or delete your account.
  • After deletion, we may retain minimal billing records (hashed email, store subscription identifiers, trial usage, and limited payment metadata) for chargebacks, fraud prevention, and legal obligations, typically up to seven years, then delete them automatically.
  • Contact support through Help & Support in the app.
  • Disconnect WHOOP or other integrations at any time.

7. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

8. International Users

The Service is hosted in the United States. If you access the Service from outside the United States, you consent to the transfer of your information to the United States.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the app. Your continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

Train Swole

Email: support@trainswole.com