Privacy Policy

Strength Programs ("we," "us," or "our") operates the strength-programs.com website and related mobile applications (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not access or use the Service.

1. Information We Collect

1.1 Information You Provide

• Account data: email address, display name/username, and authentication credentials (managed by Supabase Auth and Google OAuth)
• Training data: exercise records, workout sessions, personal records, body weight, height, age, gender, training maxes, readiness check-in inputs, and program configurations
• Profile data: biography, training experience level, goals, and equipment/unit preferences set during onboarding or in Settings
• Community & social data: optional workout/PR posts, comments, likes, follows, monthly challenge participation, custom community program templates, and safety moderation reports/blocks
• Coaching data: coach profiles, specializations, coaching relationships, program offers, check-in notes, coach-client messages, and optional coach listing images uploaded to storage
• Communications & notifications: optional Web Push notification subscriptions and messages sent via our contact form

1.2 Information Collected Automatically

• Standard request metadata: device type, operating system, browser user-agent, and IP address processed by our hosting and authentication infrastructure to deliver pages, maintain session security, and rate-limit abuse
• First-touch signup attribution: on your first signed-out visit, the browser stores a local record (sp:first-touch) in localStorage containing the external referring hostname (referrerHost), initial landing path (landingPath), campaign/referral link parameters (utm_source, utm_medium, utm_campaign, ref), and first-visit timestamp (at). If you sign in with a newly created account (within 7 days of signup), this first-touch record is sent once to /api/signup-source and stored on your profiles.signup_source record
• Cookies and browser storage: authentication session cookies, preference keys, and offline workout storage (see Section 5)

2. How We Use Your Information

• Provide, operate, and maintain the Service
• Calculate workout weights, track progress, and generate training analytics
• Enable optional community sharing, monthly challenges, and coach-athlete collaboration
• Manage your account and authentication
• Send transactional emails and optional training notifications (magic links, workout reminders, coaching updates, and security notices via Resend and Web Push)
• Understand which referral channels and features bring lifters to the Service through first-party product metrics
• Prevent fraud, abuse, and unauthorized access
• Comply with legal obligations

We do not use your data for targeted advertising or sell your information to third parties.

3. Information Sharing

We share information only in these limited circumstances:

• Service providers: Supabase (database, authentication, and file storage), Netlify (application hosting and edge delivery), Resend (transactional email), and Lemon Squeezy (payment processing only if paid features or subscriptions are used). The current release does not load third-party analytics or advertising SDKs
• User-directed sharing: when you choose to share workout posts or programs in Community, or connect with a coach on Strength Programs
• Legal compliance: when required by law, regulation, or valid legal process
• Safety: to protect the rights, property, or safety of our users or the public
• Business transfers: in connection with a merger, acquisition, or sale of assets (with prior notice)

We do not sell, rent, or trade your personal information.

4. Data Security

We implement industry-standard security measures including TLS encryption in transit, encrypted data at rest, Row Level Security (RLS) policies on all database tables, and regular security audits. Authentication is handled by Supabase Auth with OAuth 2.0 and PKCE.

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data. You are responsible for maintaining the confidentiality of your account.

5. Cookies & Tracking

We use:

• Essential cookies: Supabase authentication session tokens (sb-*-auth-token, required to keep you signed in)
• Preference & offline local storage: browser localStorage and IndexedDB entries used to store your theme preference (theme), cookie banner preference (cookieConsent, a local record that you dismissed the cookie notice), and active or offline workout state so in-gym logs are preserved when connectivity drops
• First-party signup attribution: on your first signed-out visit, the browser stores sp:first-touch in localStorage (without a cookie-consent gate) with the external referring hostname, initial landing path, any UTM/referral query parameters, and timestamp. No network request is sent while signed out. After you sign in, a newly created account (< 7 days old) submits this object once to POST /api/signup-source (stored on profiles.signup_source, first write wins) and removes sp:first-touch from localStorage
• Third-party analytics & advertising: the current release does not load Google Analytics or any third-party analytics or advertising scripts, so the cookie notice only asks you to acknowledge essential cookies

You may clear or disable cookies and local storage through your browser settings, though blocking essential cookies or local storage may affect sign-in and offline workout persistence.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your account and associated data, at any time from Settings (how to delete your account)
• Export your training data in a portable format
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at bitsandmettle@gmail.com or via our contact form.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. When you delete your account in Settings (/delete-account), your live account, sign-in credentials, uploaded coach listing images, profile (including signup_source), training logs, community posts, and coaching records are deleted immediately from our active database and storage. Provider-managed encrypted database backups expire automatically according to our infrastructure provider's backup rotation schedule. Signed-out deletion requests submitted via /contact or bitsandmettle@gmail.com are processed after verifying ownership of the account email, except where limited transaction records must be retained by our payment processor (Lemon Squeezy) for past paid transactions under tax or accounting law.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

9. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at bitsandmettle@gmail.com or use our contact form.