Privacy policy

Who is responsible

LogEveryLift is run by Morten Victor Nordbye, a private individual in Oslo, Norway, who is the data controller for the personal data described here. Contact: [email protected]. There is no company behind the app and no data protection officer.

What we collect

• Account: your name, email address and password. The password is stored only as a salted scrypt hash.
• Profile, if you fill it in: gender, year of birth, height, body weight, training goals and experience level, and your body weight history.
• Training: workouts, sets, reps, weights, durations, distances, heart rate zones, effort ratings (RIR/RPE), missed sets, how you felt and your readiness score, personal records, programs, training cycles and any notes you write.
• AI Setup: the plans you build, the change you ask for and your answers to check-ins.
• Social: friends, friend requests, nudges, reactions, programs you share and invite links you create.
• Feedback you send from the app.
• Technical: for each signed-in device, the IP address and browser user agent, kept with the login session. IP addresses also appear in the server log when login or sign-up is rate limited.
• Connected AI assistants: if you connect an assistant such as Claude or ChatGPT through the app's MCP server, the connection and its access tokens.

Body weight, heart rate, readiness, how you felt and free-text notes can reveal things about your health. We treat all of it as health data under GDPR Article 9 and process it only with your explicit consent, which you give when you create your account.

Why, and on what legal basis

• Running the app for you (account, training log, programs, progression suggestions, friends): the agreement between us, GDPR Article 6(1)(b), and for health data your explicit consent, Article 9(2)(a).
• Security (sessions, rate limiting, stopping abuse): legitimate interest in keeping the service and your account safe, Article 6(1)(f).
• AI editing in AI Setup: a separate consent you are asked for before the first use, Article 6(1)(a) and 9(2)(a).
• Feedback: legitimate interest in improving the app, Article 6(1)(f).

There is no advertising, no analytics, no tracking and no selling or sharing of data for marketing. Your data is not used to train AI models by us.

Progression suggestions (the weight or reps to try next) are calculated automatically from your logged sets. They are training suggestions only and have no legal or similarly significant effect on you.

Where the data is and who else sees it

The app and its database run on hardware the controller owns, in Norway. Only the controller has access to it. The following services also receive data:

• Cloudflare (USA) sits in front of the site for TLS and protection against attacks. All traffic, including your IP address, passes through it. Transfers to the USA rely on the EU-US Data Privacy Framework and Cloudflare's standard contractual clauses.
• Google Drive stores an off-site copy of the backups. The backups are encrypted before they leave the server, and Google does not have the key.
• OpenRouter and the AI model providers it routes to, only if you opt in to AI editing. What is sent: an age band (not your birth year), gender, goals, experience level, what you picked (training days, equipment, session length, muscles to prioritise and joints to spare), the names of the exercises available to you including custom ones, the draft plan, and up to 200 characters of the change you typed. Your name, email, body weight, weights lifted and training history are not sent. The app uses free models, and providers of free models may store requests and use them to train their models. They can be outside the EEA, including the USA. You consent to this transfer when you opt in (GDPR Article 49(1)(a)), and you can stop using AI editing at any time.

Other users can find you by your name, or by your full email address if they already know it. Your email is never shown to them. Friends see your name and avatar, whether you worked out today (you can turn this off in Account), reactions and nudges between you, and programs you share with them.

Support and debugging: the controller can view the app as a given user to investigate a problem. This is used only when needed to fix something, and such a session is marked as one in the database.

AI assistants you connect yourself (MCP) can read and change your profile, body weight, programs and cycles. That provider's own privacy policy applies to what it does with the data. You can disconnect at any time.

The "Copy prompt" button in AI Setup only copies text to your clipboard; nothing is sent from our server.

How long we keep it

• Your account and everything in it: until you delete your account.
• Deleting your account removes it from the live database at once. Encrypted backups are rotated out within 90 days.
• Login sessions, with IP address and user agent: 30 days after last use.
• Server logs: 7 days.

On your device

The app sets one login cookie and one short-lived cache of it, both needed to keep you signed in. It also keeps your active workout, rest timers, unsynced changes and display settings in your browser's local storage, and caches pages so the app works offline. All of this is needed for the app to work, so we don't ask for cookie consent. Signing out clears it, apart from your display settings. There are no third-party cookies.

Your rights

• See and take your data (access, portability): Account → Download My Data gives you everything as a JSON file.
• Correct it: edit your profile, workouts and sets in the app.
• Delete it: Account → Delete Account, or delete single body weight entries and workouts.
• Withdraw consent: for AI editing, turn it off in Account; for health data, delete your account. Withdrawing doesn't affect what was done before.
• Object to or restrict processing, or ask anything about your data: email [email protected]. You'll get an answer within one month.
• Complain to the Norwegian Data Protection Authority, Datatilsynet, or the authority where you live.

Security

Traffic is encrypted with TLS, passwords are hashed, every request is checked against your account, and backups are encrypted. This is a hobby project, so security is a reasonable best effort without audits or certifications. If a breach puts your data at risk, we will tell you and Datatilsynet as the law requires.

Age

You must be at least 13 to use LogEveryLift.

Changes

When this policy changes in a way that matters, the date at the top changes and the app asks you to accept the new version. See also the terms of use.