SetsPrivacy Notice
In short. Sets is a workout and nutrition tracker. With a cloud account, your training, nutrition, body and goal data is stored on our servers so it can sync between devices. Some of this data can say something about your health, so we ask for your explicit consent before we process it, and you can withdraw that consent at any time by deleting your account.
Optional AI features send a summary of your training data (chat and live coach) or the meal photos you choose to analyse to external AI providers. Those features are off until you use them, and we tell you exactly what is sent in section 6. The device-only demo creates no account and sends nothing to our servers.
1. Who is responsible
The controller for the processing described in this notice is:
We have not appointed a data protection officer; the processing does not require one. Questions about personal data go to the address above and are answered by the controller personally.
2. What this notice covers
This notice applies to the Sets web app, the Sets iOS app and the e-mails Sets sends. It applies to two ways of using Sets:
- Cloud account. You sign in with an e-mail address, a Google account or a Discord account. Your data is stored on our servers and synchronised between your devices. Everything in this notice applies.
- Demo. No account. Data stays in your browser's storage and is deleted when you close the browser. Our servers receive only the ordinary technical request data described in section 3.6. Sections 4–7 and 10 do not apply to the demo beyond that.
3. Data we process
3.1 Account and identity
- User ID, e-mail address, password hash (e-mail sign-in) or the identity token and profile e-mail returned by Google or Discord when you sign in with those providers.
- Sign-in timestamps, session tokens and the security records our authentication provider keeps (see section 10).
- The versions of the Terms, this notice and the health-data consent you accepted, with the time of acceptance, and confirmation that you are at least 16.
- Birth year (optional; used for age-adjusted strength standards). For passwordless e-mail registration we check your date of birth once, server-side, and keep only the fact that the check passed — never the date.
3.2 Profile
- First name, last name, unique username, display name, optional avatar photo, gender, height, current and target weight, primary fitness goal, weekly workout goal, daily step goal, and preferences such as language, theme, units and time zone.
- "Last seen" timestamp: the app records when it was last opened with your account, so the operator can see whether the service is in use.
3.3 Training
- Sessions with start and end time, exercises, sets, repetitions, weight, set type, RPE, rest times, notes, templates, training blocks (mesocycles), schedule, cardio (type, duration, distance, incline, calories), stretching, warm-ups and everything Sets calculates from this: estimated one-rep max, volume, training-quality scores, recovery status, strength level, streaks, records and achievements.
3.4 Body and nutrition
- Body-weight log, body-fat log, body measurements and progress photos you upload.
- Food diary: foods, barcodes, portions, calories and macronutrients, custom foods, your food library, and meal photos you upload.
3.5 Social
- Friend requests and friendships, high-fives and other reactions, comments on shared sessions, joint sessions (participants), challenges you send or accept, weekly medals and leaderboard values derived from your training.
3.6 Technical and service data
- Push subscriptions (a browser push endpoint and keys) if you turn on notifications; the notification inbox inside the app.
- Counters of how often you used the AI features (per day and per month) and which weeks you started a live-coach session. These are counts only; the content of AI conversations is not stored by Sets.
- Your product-update e-mail choice (opted in or declined) with the time and consent version.
- Request logs kept by our hosting and backend providers: IP address, user agent, timestamps, requested URL and response status. Sets does not run analytics, advertising or tracking scripts.
- Error reports: when something goes wrong in the app, Sets records the error message, the screen you were on, the page path, your browser's user agent, the app version and — if you are signed in — your user ID. E-mail addresses, tokens and identifiers are stripped from the message before it is sent, nothing you typed is included, and the report is used only to find and fix the fault.
The barcode scanner and the meal-photo camera run on your device. For barcodes, only the detected number is sent to a product database. Meal photos leave your device only when you upload them or ask for an AI analysis (section 6).
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account, sign you in, synchronise your data between devices. | Account, profile, all logged data | Performance of a contract — Art. 6(1)(b) |
| Log, calculate and display training, nutrition, body measurements and goals; recommendations, recovery and strength estimates. | Training, body and nutrition, profile | Your explicit consent — Art. 6(1)(a) and Art. 9(2)(a) for health-related data |
| AI Coach chat, live coach suggestions and meal-photo analysis (only when you use them). | Training summary, body-weight trend, goals, session so far; meal photos | Explicit consent — Art. 6(1)(a) and 9(2)(a); the request itself is your instruction |
| Social features with people you accepted as friends. | Profile, shared sessions, reactions, comments, challenges | Contract — Art. 6(1)(b); explicit consent for the health-related content of shared workouts |
| Write finished workouts to Apple Health on iOS. | Session times, kcal | Your instruction and the iOS permission you grant — Art. 6(1)(a) |
| Push notifications and evening reminders. | Push subscription, time zone, activity summary | Consent — Art. 6(1)(a); you enable each type |
| Product-update e-mails. | E-mail, name, subscription status | Consent — Art. 6(1)(a), separate opt-in, withdrawable at any time |
| Keep the service secure, prevent abuse, enforce usage limits, diagnose failures and fix bugs. | Request logs, usage counters, security records, error reports | Legitimate interests — Art. 6(1)(f): operating a secure and reliable service |
| Operate the service: see how many accounts exist and are active, and aggregate logging volumes. | Account list, last-seen timestamps, row counts | Legitimate interests — Art. 6(1)(f): running and sizing the service |
| Keep evidence of the legal versions you accepted; respond to lawful requests. | Acceptance records | Legal obligation and legitimate interests — Art. 6(1)(c) and (f) |
Where we rely on legitimate interests we have weighed them against your rights: the data involved is limited to what operating the service requires, it is never used for advertising or profiling, and you can object (section 14).
5. Health-related data and consent
Body weight, body fat, measurements, progress photos, food intake, calorie targets, injuries or conditions you mention in notes, and training data as a whole can reveal information about your health. Under GDPR this is a special category of personal data. We process it only on the basis of your explicit consent, which you give with a separate, unticked checkbox when you register and again whenever this notice or the consent text changes materially.
Withdrawing consent. Deleting your account in Settings withdraws the consent and removes the data (section 12). Because Sets exists to process this data, we cannot offer a cloud account without it; the demo remains available without any consent. Withdrawal does not affect processing that took place before it.
Sets is not a medical service and does not use your data to make medical decisions.
6. AI features
Four optional features use an external AI model. None of them run until you press the corresponding button, each is subject to a daily or weekly limit, and Sets does not store the conversations or the model's answers beyond showing them to you. Smaller written suggestions — the line under your weekly summary, a category proposal for an exercise you typed yourself, a tip written for your day — use the same coach allowance and the same rules.
| Feature | What leaves our servers | What never leaves | Provider |
|---|---|---|---|
| AI Coach chat | Your question; a compact summary of recent training (exercises, best sets, volume trends), body-weight trend, current and target weight, goals and, when you attach it, a chosen training block. | Name, e-mail, user ID, photos, notes not related to the question, friends. | DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) |
| Live coach | The exercises in the current session, your recent history for those exercises, the sets you have completed so far, and your intake answers (goal, energy, available time). | As above. | DeepSeek |
| Meal-photo analysis | The photo(s) you select for analysis, resized on your device. | Any account information. The image is not linked to you at the provider. | DeepSeek |
| Progress-photo comparison | The two progress photos you pick for one comparison, resized on your device, with their dates, the pose you labelled them with and the body weight you logged with them. | Any account information. The photos are not linked to you at the provider, are never sent automatically, and are not stored by Sets outside your own private album. | DeepSeek |
Requests are sent from our server, not from your device, and carry no account identifier. The providers process the input under their API terms to generate the response; Sets has no control over their internal retention, so we send the minimum described above. See section 11 for the transfer situation. If you would rather that training data is never sent to an AI provider, simply do not use these features — everything else in Sets works without them.
7. Social features
Social features are limited to people you have accepted as friends. A friend can see your display name, username and avatar, the sessions you complete (date, exercises, sets, cardio, volume and any notes on that session), your reactions and comments, challenges between you, weekly medals and your position on the shared leaderboard. Nobody else can search the user list or read profiles; friend search returns only username, display name and avatar for the exact username entered. Your e-mail address is never visible to other users.
Comments and reactions you post on a friend's session are visible to that friend and to other participants of the session. You can remove a friendship at any time; shared content stops being visible to that person.
8. Apple Health and iOS
On iOS you can turn on "Write workouts to Apple Health" in Settings. When enabled, each finished strength session is written to Health as a workout with its start time, end time and, if you entered it, calories. Sets reads back from Health only the workouts it wrote itself, to avoid writing the same session twice. Sets never reads other Health data. You control this permission in the iOS Health app; data written to Health is governed by Apple's privacy terms.
The iOS app asks for camera access (barcode scanning), photo-library access (avatar, progress and meal photos) and, if you enable reminders, local notifications. It contains no advertising or analytics SDK.
9. Device storage, cookies and notifications
Sets uses browser storage (localStorage and IndexedDB) for your session, preferences, an unsent workout in progress, cached data for offline use and a local copy of photos you uploaded. These are strictly necessary for the app to work; there are no advertising, analytics or third-party cookies. Clearing site data removes device-local information; cloud data returns when you sign in again.
A service worker is installed so the app can start offline and, only if you opt in, receive push notifications. Web-push notifications are delivered through your browser vendor's push service (Apple, Google or Mozilla), which receives an anonymous endpoint and an encrypted payload.
10. Recipients and processors
We use the following processors. Each acts on our instructions under a data-processing agreement.
| Processor | Role | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Authentication, database, file storage, server functions, scheduled jobs | All cloud-account data | European Union for the database and storage; server functions run in the region closest to the request |
| Resend, Inc. | Transactional e-mail (sign-in codes, account e-mails) and, only after opt-in, product-update e-mails | E-mail address, name, subscription status | United States — EU–US Data Privacy Framework and SCCs |
| DeepSeek | AI Coach chat, live coach, written suggestions, meal-photo analysis and progress-photo comparison | Training summary and question as described in section 6, no identifiers; for a photo feature, the photo(s) you select | China — see section 11 |
| Google LLC | Optional sign-in with Google | Your Google identity token | United States / EU — EU–US Data Privacy Framework |
| Discord Inc. | Optional sign-in with Discord | Your Discord identity token and e-mail | United States — SCCs |
| Apple Inc. | App distribution, Apple Health (on device), push delivery on Safari/iOS | Push endpoint; Health data stays on your device | Per Apple's terms |
| Static hosting / CDN provider for the web app | Serving the app files | Request logs (IP, user agent, URL) | Global edge network |
Independent controllers that receive data because you use a feature: Open Food Facts and USDA FoodData Central (barcode and food-search queries, no account information), browser push services (section 9), Google and Discord as sign-in providers, and Apple Health.
The operator. The controller can see the list of accounts (e-mail, display name, sign-up date, last seen) and aggregate counts of logged data through an internal dashboard, and can query the database directly when needed to fix a problem or answer a request from you. There is no other internal access. We do not sell personal data and never share it for advertising.
11. International transfers
Your account data is stored in the European Union. Some providers process data outside the EEA:
- United States (Resend, Google, Discord, Supabase support access): covered by the EU–US Data Privacy Framework where the provider is certified and otherwise by Standard Contractual Clauses.
- China (DeepSeek, only when you use AI Coach chat, the live coach or a meal-photo analysis): there is no adequacy decision for China. The transfer relies on the safeguards in DeepSeek's API terms together with the measures Sets takes: nothing that identifies you is sent, only a compact training summary or the photo or photos you chose; the request is made by our server so your IP address is not exposed; and we do not store the exchange. Meal photos used to be analysed by Google in the United States; since the AI features run on a single model that reads both text and images, they go to DeepSeek as well, and so do the two progress photos you select for a comparison. A photo can show more than you mean it to — faces, a room, a document on the table, and a progress photo shows your body — so select what you send with that in mind. A progress photo never leaves your album on its own: it is sent only for the comparison you ask for, and the answer is a written observation that Sets does not store. Because a training summary and a meal photo are both health-related information, we ask you to use these features only if you are comfortable with that. The choice is yours every time you press the button.
You can ask us for a copy of the transfer safeguards at the contact address.
12. Retention
| Data | Kept for |
|---|---|
| Account, profile, training, body, nutrition, social data and uploaded photos | While your account exists. Deleted immediately when you delete your account: the database removes every row linked to your user ID, and the files in your avatar, progress-photo and meal-photo folders are removed in the same operation. |
| Legal-acceptance records | With the account; removed on account deletion. |
| AI usage counters and live-coach week records | With the account; the counters are per day and month and carry no content. |
| Product-update consent record at Resend | Until you withdraw it in Settings or through the unsubscribe link, after which the contact is marked unsubscribed; removed with the account. |
| Push subscriptions | Until you turn notifications off or the browser revokes the subscription; removed with the account. |
| Database backups (Supabase) | Rolling backups are retained for up to 7 days and then overwritten. A deleted account can therefore persist in a backup for at most 7 days; backups are never restored selectively to bring an account back. |
| Error reports | 30 days, then deleted automatically. |
| Server and function logs (Supabase, hosting) | Up to 7 days on the current plan; contain request metadata, never logged data. |
| Authentication audit log (Supabase) | Sign-in events are kept by the provider for up to 30 days. |
| Rights requests, breach records and correspondence with you | 3 years after closure, to be able to demonstrate compliance. |
| Device-local data (demo, cache, photos) | Until you clear site data, remove the app or the browser evicts it. Demo data is cleared when the browser closes. |
13. Security
All traffic uses TLS. Every database table is protected by row-level security so an account can only read and write its own rows; friend visibility is granted through dedicated server-side functions rather than broad table access. Photo storage buckets are private and are served through short-lived signed URLs. Secrets for e-mail and AI providers exist only on the server and are never sent to the browser. The app loads no third-party scripts or fonts. Administrative access requires a named account on a server-side allow-list. Passwords are stored as salted hashes by our authentication provider; you can also sign in without a password.
No system is completely secure. Use a unique password, keep your device locked, and report anything suspicious to the contact address — we treat security reports as a priority.
14. Your rights
You have the right to:
- Access your data and receive a copy;
- Rectify inaccurate data — most of it you can edit directly in the app;
- Erase your data — Settings → Account → Delete account does this immediately;
- Restrict or object to processing based on legitimate interests;
- Portability: receive your data in a machine-readable format — Settings offers a JSON backup of your workouts, and we provide the rest on request;
- Withdraw consent at any time (section 5 for health data; Settings for product-update e-mails and notifications);
- Lodge a complaint with a supervisory authority (section 18).
To exercise a right that the app does not cover, e-mail the contact address from the e-mail address linked to your account. We will confirm receipt, may ask you to verify that you control the account, and respond within one month (extendable by two months for complex requests, in which case we tell you why). Requests are free unless they are manifestly unfounded or excessive.
15. Age
Sets cloud accounts are for people aged 16 or older. We ask you to confirm this when you register, and for passwordless e-mail registration we verify the date of birth server-side. We do not knowingly keep accounts of younger users; if you believe a child under 16 has an account, contact us and we will delete it.
16. Automated calculations
Sets calculates estimates such as one-rep max, training-quality scores, recovery status, strength level and set suggestions, and the AI features generate text suggestions. These help you plan training; they do not produce legal or similarly significant effects on you and are not medical advice. You decide what you do in the gym.
17. Changes to this notice
When we change this notice materially — for example a new processor, a new purpose or a change to the AI features — the version and effective date above change and cloud users are asked to review the new version and, where required, renew their consent before continuing. Minor clarifications are published without renewed consent. Previous versions are available on request.
18. Contact and complaints
Privacy questions and rights requests: mehdi.ouladkhlie@icloud.com.
If you are not satisfied with our answer you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, gegevensbeschermingsautoriteit.be, or to the data-protection authority of your own country of residence. A list of EU authorities is published by the European Data Protection Board at edpb.europa.eu.