Privacy Policy

1. Who is responsible for your data

Sweat Exchange is the data controller for personal data processed on the platform. This policy explains what we collect, why we use it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

2. What we collect

• Account data: email address, display name, password (stored as a hash by our authentication provider), and account settings.
• Purchase data: plans you buy or acquire for free, order amounts, currency, timestamps, entitlements, receipts, refunds and disputes. Stripe processes card details; they do not touch our servers.
• Training data you choose to provide: workout sessions, plan and exercise identifiers, sets, repetitions, loads, rest periods, notes, completion times, basic completion status, plan progression and bodyweight entries.
• Optional progress analytics: calculations derived from training data, such as volume, streaks, estimated one-repetition maximums, estimated performance and personal records.
• Creator data: for sellers, profile and listing content plus identity and payout information collected by Stripe for Know Your Customer checks. Stripe is the controller for its own identity-verification processing.
• Technical data: authentication session cookies and security logs, including IP address and user agent, needed to operate and protect the service.

3. Why we process it and our lawful bases

• We process account, purchase, entitlement and delivery data to perform our contract with you.
• We process tax, accounting and financial-crime records to meet legal obligations.
• We process security, fraud-prevention, content-moderation and service-integrity data for our legitimate interests where those interests do not override your rights.
• Workout logging and sync, bodyweight tracking, and optional progress analytics are three separate purposes that remain off until you make the corresponding choice described in the Health Data Processing Notice. For each purpose we rely on consent under Article 6(1)(a) of the UK GDPR and, where the data reveals information about health, explicit consent under Article 9(2)(a).
• Marketing consent is separate from every health-data choice and can be withdrawn independently.
• We retain only minimum workout-completion evidence needed to administer the contractual Refund Policy, prevent refund abuse, resolve disputes and establish, exercise or defend legal claims. This evidence is not used to reconstruct workouts or produce analytics and is retained on the separate bases explained below.

4. Health-data choices and withdrawal

The Health Data Processing Notice gives separate controls for workout logging and sync, bodyweight tracking, and progress analytics. Refusing or withdrawing any choice does not affect your account, purchases, entitlements or access to plan content.

From the moment you withdraw a choice in the app, new local persistence for that purpose stops, new and pending uploads are blocked, protected server reads stop, and related calculations or analytics stop. Records already queued on the device are never uploaded automatically after withdrawal, including if you later opt in again. A later opt-in applies only to data created after that new acceptance.

Withdrawal does not make earlier processing unlawful and is not itself a deletion request. Existing protected records remain unavailable to product features. You can still exercise access, portability and deletion rights through the privacy or account-erasure request flow or by contacting support, and bodyweight deletion remains available in the app. We process protected records only as needed to carry out that request, meet a legal obligation, or comply with a legal hold.

5. Cookies

We use only strictly necessary authentication cookies that keep you signed in securely. We do not use advertising or other non-essential cookies. If that changes, we will ask for any consent required before setting them.

6. Who we share data with

• Supabase hosts our database and authentication in the European Union, region eu-north-1.
• Vercel hosts the website and trusted mobile API routes.
• Stripe processes payments, creator onboarding and payouts. We do not send Stripe your detailed workout, bodyweight or progress records.
• We do not sell personal data or share it with advertisers or plan creators.

Where a processor is outside the UK or EEA, transfers rely on UK-approved safeguards such as an adequacy regulation or approved contractual clauses.

7. How long we keep data

• Account, entitlement and current settings data is kept while your account exists.
• Consent-controlled workout, bodyweight and optional analytics records are used only while the matching consent is current. After withdrawal they remain isolated from product processing and are accessed only to answer an access, portability or deletion request, unless a legal hold or another legal obligation requires limited retention.
• Minimum completion evidence consists only of the completed-workout count, completion time and the purchase or plan needed to apply the Refund Policy. We keep it with the related purchase, refund or dispute record for up to six years after the relevant transaction or account closure. We rely on performance of contract and our legitimate interests in preventing abuse and resolving claims under Article 6, and, where this minimum evidence reveals health information, the legal-claims condition in Article 9(2)(f). It is never used for progress analytics.
• Purchase, refund, dispute, ledger and tax records are retained after account closure for as long as tax, accounting or legal-claims rules require, normally six years.
• When you request account deletion, we erase or irreversibly anonymise data we are not required to keep. A legal hold can pause deletion during a dispute or investigation; deletion resumes when the hold ends.

8. Your rights

• You can request access to, correction or deletion of your personal data, object to or restrict certain processing, and ask for a portable copy of data you provided.
• You can separately accept or withdraw each health-data purpose in the app. Access, portability and deletion requests remain available after withdrawal, and an existing bodyweight entry can still be deleted in the app.
• To exercise any right, contact the support address published on the platform. We normally respond within one month.
• You can complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.

9. Changes

We will publish changes here. If a health-data purpose or its wording changes, the previous consent is not carried forward: the affected processing remains off until you read the new notice and make a fresh choice.