Privacy policy

Everything below is data you type into the app or that the app needs to run. We do not buy data about you, and we do not collect anything from other sites.

• Account — your email address and a hashed password, or your Google identity (name, email, Google account id) if you sign in with Google.
• Training preferences — training days, session length, program phase, week counter, effort calibration (RIR bias), volume targets, stalls and ceilings.
• Routines — the exercises in your week, the grade and feedback the builder produced for it.
• Workout logs — for every set: date, exercise, weight, reps, effort (RIR), whether it was a calibration or failure set, and any free-text notes you add.
• In-progress session drafts — the half-finished session and rest timer, so nothing is lost if the tab closes.
• Progress and badges — badges, quests, streaks and what you have already seen, so the app does not celebrate the same thing twice.
• API keys — the name, scope and a SHA-256 hash of any key you create under Settings. We never store the key itself.
• Body weight — if you log it, it stays in your browser only (localStorage) and is never sent to our servers.
• Technical data — IP address, browser and device type, and the pages you open, in server logs and in anonymous analytics (see section 4).

Workout logs, effort data and body weight are fitness data. They are not medical records, but we treat them as sensitive: they are never sold, never used for advertising, and only ever shown to you.

• To run the service you asked for (contract): build, grade and ramp your routine, log sessions, sync across devices, export your data.
• To keep the service working and safe (legitimate interest): error tracking, abuse prevention, anonymous usage counts.
• To talk to you about your account (contract): email confirmation and password resets. We send no marketing email.

We do not profile you, make automated decisions with legal effect, or use your data to train AI models.

These providers process data on our behalf under their own data-processing terms. None of them may use your data for their own purposes.

Exercise pages also link out to YouTube searches. Nothing is sent to YouTube until you click such a link, and Google's privacy policy applies from then on.

We count page views and catch errors with PostHog so we know what breaks and what gets used. The analytics client runs in memory-only mode: it writes no cookie and nothing to localStorage, it does not record your screen, and it does not create a profile of you. Your IP address reaches PostHog's US servers with each event, which is why this counts as an international transfer (section 7).

• Account and training data — until you delete your account. Deletion removes your account and every table that references it immediately; we do not restore deleted accounts from backups.
• Session drafts — replaced as you train; stale drafts are pruned after 14 days.
• Revoked API keys — the hash stays until you delete your account so the key can never be reused.
• Server logs and analytics events — anonymous; not linked to your account and kept only as aggregate counts.
• Data in your browser — localStorage entries stay until you delete your account, clear site data, or use "Delete everything" in Settings.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, if you are in the EEA or UK, the GDPR, you can:

• Access and export — download every logged set as CSV from Settings, or via the read-only API.
• Correct — edit any set, routine or preference inside the app.
• Delete — "Delete account and all data" in Settings removes your account, every row in every table, your browser data and your analytics identity. No email needed.
• Restrict or object — write to hello@traintwice.app.
• Complain — to the UAE Data Office, or to your local supervisory authority if you are in the EEA or UK.

We answer requests within 30 days and never charge for them.

Our providers run in the regions listed in section 3. Analytics events go to the United States. Where a transfer leaves the UAE, EEA or UK we rely on the provider's standard contractual clauses or an equivalent safeguard.

Traffic is encrypted in transit. Passwords are hashed by Supabase and are never visible to us. Every database table is protected by row-level security so an account can only read its own rows. API keys are stored as hashes and can be revoked at any time.

TrainTwice is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone younger; if you believe we have, write to hello@traintwice.app and we will delete it.

When this policy changes we update the date at the top. A change that affects what we collect or who processes it is announced inside the app before it takes effect.

SEAMIO Network Websites Designing
Mushairif, Ajman, United Arab Emirates
Licence 134974
hello@traintwice.app