Privacy policy

Your account. Your name, your email address, a hash of your password (scrypt, salted; the password itself is never stored), your time zone, and your settings such as lb or kg and the effort default.

Your training. What you log: exercises, workouts, sets (weight, reps, effort, times), gyms, splits and their days, and any notes you write. Notes are free text, so they hold whatever you put in them.

Security records.

• Failed sign-in attempts: the email address that was typed and the IP address, kept for up to one day, to slow down password guessing.
• Rate-limit events (for example sign-ups, password reset requests and saves): the kind of event and an IP address, email address or account id, kept for up to two days, to stop abuse.
• The time your account was last active.
• Single-use links for confirming an email address or resetting a password, stored only as a hash until they are used or expire.

Setrung sets one cookie: a signed session cookie that keeps you signed in. It is essential to the service. There are no advertising cookies, no analytics cookies and no third-party trackers.

Setrung keeps some things in your browser so it works with a weak signal: the workout you are logging (local storage, until it has synced), a copy of the screens you last opened (the browser's cache), and which one-time notes you have dismissed. Signing out or deleting your account removes them from that device, so sign out when you are done on a shared one.

• To run your log: show your history, work out suggestions, trends and weekly sets.
• To sign you in and keep your account secure.
• To send account emails (confirming your address, resetting a password). No marketing email.
• To keep the service working and prevent abuse.

Your training is visible only to you. It is not shared with other users, and it is not sold or used for advertising. Josh Sussman can technically reach the database to run and fix the service, and looks at individual data only when you ask for help or to deal with abuse.

These providers process data on our behalf, only to provide their service:

• Vercel: hosting. Requests to the site pass through it, and it keeps its own short-lived request logs, which include IP addresses.
• Neon: the Postgres database where accounts and training data are stored.
• Resend: sends account emails (confirming your address, resetting a password). It receives your email address and the message.
• GitHub: stores the encrypted database backups (below).

These providers may store and process data in the United States and other countries. We may also disclose information when the law requires it.

Your account and training data are kept until you delete them or delete your account. Failed sign-in records are removed after about a day and rate-limit events after about two days. The database is backed up once a day; each backup is encrypted and deleted after 30 days, so data you delete can remain in a backup for up to 30 days.

• Export. Account → Export everything downloads all of your data as one JSON file.
• Correct. You can edit your name, email, settings, and any workout or exercise in the app.
• Delete. Account → Delete account removes your account and every row that belongs to it. This cannot be undone.

Depending on where you live, you may have further rights over your personal data, such as asking for a copy or objecting to a use. Write to us and we will help.

Setrung is not directed at children. Do not use it if you are under 13, or under 16 if you live in the European Union or the United Kingdom. If you believe a child has made an account, write to us and we will remove it.

If this policy changes, the new version will be posted here with a new effective date. If the change is significant, we will say so in the app or by email.

Questions or requests about your data: jsussman35@gmail.com.