Privacy Policy
Information we collect
We collect the following, all of which you provide or generate by using the App:
- Account information: your email address (for sign-in and account management) and an account identifier (UUID). If you sign in with Apple or Google, that provider gives us your email address (with Apple, possibly a private relay address that forwards to you) and, if you allow it, your name; see Signing in with Apple or Google below.
- Profile information (optional): a display name; and, to tailor the App's coaching to you, your training experience level, your current training goal (building, maintaining, or cutting), your training days per week, your sex, and a goal weight (which sizes your daily protein target when it is below your current weight). Every one of these is optional, is used only to adapt the App's suggestions and defaults to you, and is never used for advertising, sold, or shared with third parties.
- How you heard about STRIATE (optional): when you create an account, the App asks how you heard about STRIATE. Your answer, and any words you type beside “Other”, are kept with your account, and skipping the question is kept as no answer. We use it only to learn which ways of finding STRIATE work. The answer itself, never the words you type, is also part of the usage event recorded when an account is created.
- Health & fitness data you enter or import: workouts, exercises, sets, reps, weights, Reps-In-Reserve (RIR), cardio time and distance, bodyweight entries (typed in, or imported from Apple Health or Health Connect if you allow it; see Connected health sources), daily step counts, daily calories eaten and cardio workouts recorded in other apps (each only ever imported from Apple Health or Health Connect, and only if you allow it), how you rate a workout (how it felt and, if you choose, the pump in its main muscles), your optional pre-workout ready check (hours slept, energy, and which muscles are still sore and how sore), and derived metrics such as per-muscle weekly volume. This is the core purpose of the App.
- Body measurements you enter (optional): girth/circumference measurements at sites such as chest, shoulders, arm, forearm, waist, thigh, hips, calf, and neck; each a number, a unit (in or cm), and a date. See Health and body data below.
- Progress photos (optional): physique photos you choose to add, private by design. See Progress photos below.
- Recovery metrics (optional): heart-rate variability (HRV), resting heart rate, and sleep duration; typed in yourself each morning, or read automatically if you choose to connect Apple Health on iPhone or Health Connect on Android. See Health and body data below.
- Health markers (optional): readings you log such as blood pressure and blood-work results (for example cholesterol, hematocrit, or liver enzymes); each a value, a unit, and a date; kept only to show you your own trends over time. See Health and body data below.
- Content you create: program and exercise names, notes and cues, and the text of any bug reports or feature requests you submit through the App, together with any optional screenshots you choose to attach to a report. See Screenshots attached to feedback below.
- Usage data: first-party feature-usage events, which features are used (for example “session saved” or “report card viewed”), each with the app version and a random app-generated device identifier so we can count unique installs. When something in the App fails, we also record a short technical error message (no longer than 140 characters) so the failure can be diagnosed and fixed. If the Android app crashes, the next time you open it, it sends us one record of the crash: the name of the error, the place in the code where it happened, the app version and build, and the time. It carries no message and nothing you typed or logged. This is how we find bugs that testers hit but cannot easily describe. These events carry no training values, no health or body data, and no contact details; error messages are produced by the App’s own code rather than by anything you type. They go only to our own database (no third-party analytics service ever receives them), they are deleted automatically after 6 months, and we use them solely to understand which features work and what breaks during the beta.
Information we do NOT collect
We do not collect your precise or approximate location (the optional gym pick reads it on your device and never sends it; see Picking your gym by location), financial information, videos (progress photos are collected only if you choose to add them; see Progress photos), audio (the optional voice-logging feature uses your microphone for speech recognition performed by your device’s own platform, but no audio is ever recorded, stored, or sent to us; see Voice logging), contacts, calendar, SMS or call logs, browsing history, a list of installed apps, or any advertising identifier. Recovery metrics and weigh-ins are values you type in yourself, or, only if you choose to connect your platform’s health service, read automatically with your explicit permission (see Health and body data). Daily step counts, daily calories eaten and cardio workouts from other apps are never typed in; each is read from your platform’s health service only if you connect it and allow that type. The App never connects to any health platform without you turning that connection on. The App ships no third-party analytics, crash-reporting, or advertising software.
How we use your information
We use your information solely to:
- provide, operate, and sync the App and your account;
- store and display the training data you enter;
- respond to bug reports and feature requests you send us;
- understand which features are used during the beta (see “Usage data” above); and
- maintain security and prevent abuse.
Health and body data
A few kinds of more sensitive data are collected only if you choose to provide them: by typing them in, or (for recovery metrics, body weight, daily steps, daily calories eaten and cardio workouts recorded in other apps) by optionally connecting Apple Health on iPhone or Health Connect on Android:
- Recovery metrics: heart-rate variability (HRV, in milliseconds), resting heart rate (in bpm), and sleep duration (in hours). You enter these yourself, typically each morning from your wearable's reading, or see Connected health sources below.
- Body weight: your weigh-ins, each a value and a date. You type these in, or see Connected health sources below.
- Daily steps: one step total per day, read only from a connected health service; see Connected health sources below.
- Daily calories eaten: one calorie total per day, read only from a connected health service; see Connected health sources below.
- Cardio workouts from other apps: the type, start and end time, and length of each cardio workout another app recorded, read only from a connected health service; see Connected health sources below.
- Body measurements: girth/circumference at sites such as chest, shoulders, arm, forearm, waist, thigh, hips, calf, and neck; each a value, a unit (in or cm), and a date.
- Health markers: optional readings you log, such as blood pressure, resting heart rate, and blood-work results (such as HDL/LDL cholesterol, triglycerides, hematocrit, hemoglobin, ALT/AST, and eGFR); each a value, a unit, and a date. These are a log for your own trends only: they do not change any training recommendation, and STRIATE does not interpret or diagnose them. It is a log, not medical advice.
Why we collect it: solely to run the App for you. Recovery metrics feed the readiness score that auto-regulates your training; weigh-ins feed your bodyweight trend and the targets built on it (for example your protein range and your target rate of weight change); daily steps show you your usual step count and set the coach’s suggestion when it suggests walking more during a cut; daily calories eaten show you yesterday’s intake and let the coach estimate your daily energy use and suggest a daily calorie target; cardio workouts from other apps show in your history and let the coach count the cardio you already do; and recovery, weigh-ins and measurements power the coaching engine and show you your own progress over time. This data is never used for advertising, never sold, and never shared with third parties.
Connected health sources (optional: Health Connect on Android, Apple Health on iOS)
If you choose to connect your platform’s health service in the App (Coach tab), Health Connect on Android or Apple Health (HealthKit) on iOS, STRIATE reads only what you approve in that platform’s permission screen, and nothing else:
- Recovery metrics (heart-rate variability, resting heart rate, and sleep duration). On Android, STRIATE also reads your heart rate as hourly averages, used only to work out a nightly resting heart rate on days your device does not record one; the hourly values themselves are not stored. Recovery readings are stored in your STRIATE account exactly like a manually entered recovery value (a manual entry for a day is never overwritten) and are used to compute your daily readiness and adjust your training recommendations.
- Body weight (your weigh-ins). Each one is stored as a bodyweight entry, marked with the app it came from, and used exactly like a weigh-in you type: your bodyweight trend and the targets built on it. If a recent weigh-in is changed or deleted in the health service, STRIATE updates or removes its copy the next time it syncs. Weigh-ins you typed into STRIATE are never changed by a sync.
- Daily steps. STRIATE reads your step count as your health service totals it (the service combines your phone and watch, so a step is not counted twice) and stores one number per day, never the individual step records. A day with no steps recorded is stored as nothing, not as zero. Step counts are used only to show you your usual daily steps and to set the coach’s suggestion when it suggests walking more during a cut.
- Daily calories eaten. If you log food in an app that writes to your health service, STRIATE reads the calories you ate as your health service totals them and stores one number per day, never the individual foods or meals. It does not read protein, carbohydrates, fat or any other nutrient. A day with nothing logged is stored as nothing, not as zero. Calorie totals are used only to show you yesterday’s intake, to estimate your daily energy use from your intake and your weight trend, and to suggest a daily calorie target in the weekly rate check.
- Cardio workouts recorded in other apps. STRIATE reads the workouts your health service holds and keeps only cardio: runs, rides, rows, swims, the elliptical, stair climbing and similar. Walks are left out (your daily steps already count them), and so is strength training. For each one it stores the type, the start and end time, the length in minutes, and the app that recorded it (on iPhone, that app’s name; never the name of your iPhone or Apple Watch). It does not store calories, distance, heart rate, route or location. Workouts STRIATE itself wrote to your health service are never read back. If a recent workout is changed or deleted in the health service, STRIATE updates or removes its copy the next time it syncs. These workouts are shown, read-only, in your history, and used only to count the cardio you already do in the conditioning load and the weekly rate check; a workout you also logged in STRIATE is counted once.
None of these readings are ever used for advertising, sold, or shared with third parties. You can revoke the App's access at any time in Health Connect (Android) or the Health app's Sharing settings (iOS), disconnect within STRIATE, and deleting your account removes every imported reading (You → Delete account, or privacy@striatetraining.com).
Writing your workouts back (optional): if your platform’s health service is connected, STRIATE can also write each workout you save to that service as a workout of the matching type (strength training for a lifting session, or the kind of cardio you logged, such as an indoor ride, a row, or a run) so your other health apps can see that you trained. Each written workout carries only its type, its start and end time, and its name (on iPhone, also its set and volume totals), and is marked as entered by you rather than recorded by a sensor, unless you wore STRIATE’s watch app for it (see below). This requires a separate write permission that your platform asks you for the first time; decline it and everything else works identically. Apart from the watch readings below, the write only ever contains that summary (never your individual sets, weights, body weight, recovery metrics, or any other data), and you can revoke the write permission at any time in Health Connect (Android) or the Health app (iOS), or delete the written sessions there directly.
With STRIATE’s watch app (optional): if you wear a Wear OS watch (such as a Galaxy Watch) or an Apple Watch with STRIATE’s watch app during a session, the watch measures your heart rate while you train, and a session with those readings is written as recorded on a watch. On Android, the watch records heart rate only for a session your phone will write to Health Connect, so it records nothing if you have not connected Health Connect; it passes its readings to the App on your phone, which writes them to Health Connect with the session. This needs Health Connect’s heart-rate write permission, which the App asks for only once your watch has recorded a session. On iPhone, your Apple Watch saves the session as a workout in the Health app itself, so the heart rate and calories it measured are kept there, together with the session’s effort score when you logged one (from the effort of your sets in a lifting session, or the effort you rated for a cardio session); the watch asks for its own Health permission the first time you use it. The heart rate your watch records during a session is never sent to our servers: it goes only from your watch to your phone and your health service. On Android, the copy your watch hands to your phone is deleted from both once the session is written to Health Connect, and a copy that was never written is deleted once it is more than two days old, the next time your phone starts a session with the watch connected.
How it's protected: it is private. It is transmitted encrypted in transit (TLS) and stored under row-level security so that only your account, and a coach you link to, can read it. STRIATE is a training and information tool, not medical advice.
Your control: you can export all of your data, and you can delete your account and everything in it at any time in the App (the gear (⚙) → Account & data → Delete account & all data). You may also email privacy@striatetraining.com to request an export or deletion. Deletion is permanent and removes your recovery, weigh-in, step, calorie, imported workout and measurement data along with the rest of your account.
Scanning a lab report (optional, on-device)
To save you typing, the App can read the numbers out of a bloodwork report you photograph or select (Progress → Body → Health markers → Scan). The image is processed entirely on your device by its on-device text recognition; the picture is never uploaded to us and never stored. It is discarded as soon as the text has been read. Nothing is saved until you review every value and tap Save, and only the values you confirm are kept (exactly as if you had typed them). STRIATE does not interpret or diagnose your results. It is a log, not medical advice.
Voice logging (optional, microphone)
The App offers an optional hands-free way to fill in a set (“225 for 8, RIR 2”). If you tap the voice button, your device will ask for microphone permission. Your speech is converted to text by your device’s own speech-recognition service (on Android this is normally performed on-device; on iPhone, Apple’s Speech framework may send the audio to Apple to transcribe it, under Apple’s own privacy policy). STRIATE never records, stores, or transmits audio, and no audio ever reaches our servers. Only the recognized text is used, and only to fill the weight/reps fields on your screen; nothing is saved until you tap the checkmark yourself. You can deny or revoke the microphone permission at any time in your device settings. Every feature except the voice button works identically without it.
Screenshots attached to feedback (optional)
When you report a bug or request a feature in the App, you may attach screenshots. This is entirely optional: reports send perfectly well without them, and nothing is ever captured automatically. You choose each image, and the App tells you before you attach them that screenshots may show your training or body data.
Each attached screenshot is resized on your device and uploaded to private storage scoped to your account, the same arrangement as progress photos. Screenshots are never public, never shared, and are used for exactly one thing: understanding and fixing the issue you reported. Alongside them we store the app version and build, your platform and operating-system version, a coarse device model, and which screen you were on, so a bug can be traced to the right build and device. Deleting your account deletes these along with everything else.
Progress photos (optional, private by design)
You can add physique progress photos to track visual change over time (Progress → Body). These exist for exactly one purpose: showing you your own before/after. They are private by design: stored in a private bucket readable only by your account (row-level security; images load through short-lived signed links), never shared with anyone (not even a linked coach), never used to train anything, never analyzed, never used for advertising, and never sold. Before upload, each photo is re-encoded on your device, which strips embedded metadata such as GPS location. You can delete any photo at any time, and deleting your account permanently removes every photo along with the rest of your data.
Picking your gym by location (optional, on your device only)
If you train at more than one gym, the App can pick which one you are at, so each machine’s weights and setup come from the right gym. This is off until you turn it on (Settings → Your gyms), and turning it on is when your device asks for location permission. The App then reads your location once, when you press Start on a workout, and never in the background. It compares that reading with the locations of your saved gyms, which are kept only on your device. Neither your location nor your gyms’ locations is ever sent to us or to anyone else: only which of your gyms you were at is saved with your workout, exactly as when you pick it yourself. Turning the feature off, removing a gym, or signing out deletes those saved locations from your device. You can deny or revoke the permission at any time in your device settings, and every feature works without it.
Legal bases (EEA/UK users)
Where the GDPR applies, we process your information to perform our contract with you (providing the App) and, where relevant, based on your consent (which you may withdraw) and our legitimate interests in securing and improving the App.
Signing in with Apple or Google
On iPhone and Android you can create your account, or sign in, with Sign in with Apple or Sign in with Google, or connect either to an existing account in Settings → Sign-in methods. You choose this; email sign-in works without either.
- What the provider shares. Apple or Google confirms who you are and gives us your email address and, if you allow it, your name. With Apple you can choose Hide My Email, and we then receive a private relay address that forwards to you. Our sign-in provider (Supabase, below) keeps the basic profile the provider shares with your sign-in record; for Google that includes a link to your Google profile picture, which the App does not use. The App offers your name as your display name, and you can change or remove it.
- Apple’s token, kept only so it can be revoked. Apple requires that deleting an account also revokes the app’s access to your Apple ID. To do that, we keep the refresh token Apple issues at sign-in, in a table only our server can read; it is never sent to the App. On Android, that same record also keeps the name Apple sends the first time, so the App can offer it. We use the token for nothing else.
- Google. We keep no Google token. To remove STRIATE’s access from your Google account as well, visit your Google Account’s third-party connections page.
- Deleting your account (or cancelling a new sign-up) revokes STRIATE’s Sign in with Apple authorization at Apple and deletes the stored token along with the rest of your account.
Apple and Google process your sign-in under their own privacy policies.
Joining the beta from this website
If you ask to join the Android beta on striatetraining.com, we store the email address you enter, when you entered it, and whether we have sent your invite. We use it for one thing: adding you to Google Play’s testing list and emailing you the link to install. We send at most two emails to that address, a confirmation and the invite, through our email provider, Resend. The address is kept in the same database as the App’s data (see below), readable only by us; it is never used for marketing and never shared with anyone else. To have it deleted, email privacy@striatetraining.com.
The iPhone beta runs on Apple’s TestFlight. When you join through the TestFlight link, Apple handles that sign-up under its own privacy policy.
Links we share
Links we post can carry a short tag saying where they were posted, such as ?c=reddit. When you open one, this website adds one to a count for that tag and day, then removes the tag from the address bar. The count holds only the tag, the date, and the number; it records nothing about you or your device.
How your data is stored and who processes it
Your data is stored in a database hosted by Supabase, Inc., our infrastructure processor, which provides authentication, database, and hosting services on our behalf. Data is protected in transit by TLS encryption and, at rest, by row-level security so that your account can access only its own data. Data may be processed and stored on servers located in the United States.
We do not share your personal data with any other third parties except as required to operate the App (as above) or as required by law.
Data retention and deletion
We keep your data for as long as your account exists. You can delete your account and its associated data at any time in the App: the gear (⚙) → Account & data → Delete account & all data. You may also request deletion by emailing privacy@striatetraining.com. Deletion is permanent, and it also revokes STRIATE’s Sign in with Apple authorization if you used it (see above).
Usage data is deleted automatically. The feature-usage events described above are kept for a maximum of 6 months: an automatic daily job permanently deletes any usage-event rows older than 6 months. We do not keep aggregated copies of deleted events.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, email privacy@striatetraining.com. We will not discriminate against you for exercising them. (California residents: we do not sell or share personal information as defined by the CCPA/CPRA.)
Children
STRIATE is intended for users 18 and older. It is not directed to children, and we do not knowingly collect data from anyone under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us data, contact us and we will delete it.
Security
We use TLS in transit and row-level security at rest, and limit access to your data. No system is perfectly secure, but we take reasonable measures to protect your information.
Changes to this policy
We may update this policy as the App evolves. We will post the updated version here and revise the effective date; material changes may be signaled in the App.
Contact
Questions or requests: privacy@striatetraining.com
This policy is provided for transparency and is not legal advice. STRIATE is operated as an independent project; business-entity details will be updated here upon formation.
← Back to STRIATE