SetsPrivacy Notice
1. Controller and contact
The controller for Sets is Mehdi Oulad Khlie, operating Sets. Privacy contact: mehdi.ouladkhlie@icloud.com.
2. Data we process
- Account: user ID, email address, authentication records and legal-document versions accepted.
- Profile: first name, last name, unique username, display name and optional avatar. Avatar files are delivered through a public storage URL, so anyone who obtains that URL may access the image.
- Training: sessions, dates, exercises, sets, repetitions, weight, RPE, cardio, incline, duration, calories, notes, templates, rest times, achievements and calculated statistics.
- Body, goals and nutrition: current and target weight, height, gender, primary fitness goal, weekly workout goal, daily step goal, body-fat percentage, foods, barcodes, portions, calories, macronutrients and custom foods. These data may constitute or reveal health-related information.
- Social: friend requests, accepted friendships, reactions, leaderboard values and push-notification subscriptions.
- Device and service: local browser storage, language/theme preferences, product-update email preference and consent record, basic request/security logs and technical information automatically received by hosting and content-delivery providers such as IP address, browser and timestamps.
The barcode camera feed stays on your device. Sets sends the detected barcode—not camera images—to a product database.
3. Why and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create an account, authenticate, synchronise data and provide requested app functions. | Performance of the service agreement (GDPR Art. 6(1)(b)). |
| Process training, nutrition, body measurements and fitness goals for logging, statistics, recommendations, future personalised features and cloud sync. | Your explicit consent (Art. 6(1)(a) and, where the information is health data, Art. 9(2)(a)). |
| Provide Social features to you and accepted friends. | Performance of the service agreement and the actions you request; explicit consent continues to cover health-related workout information. |
| Protect accounts, prevent abuse, diagnose failures and maintain service security. | Legitimate interests in operating a secure and reliable service (Art. 6(1)(f)), balanced against user rights. |
| Send occasional Sets product updates after you actively opt in. | Your consent (Art. 6(1)(a)). You can withdraw it at any time in Settings or through the unsubscribe link in every update. |
| Keep evidence of accepted legal versions and respond to lawful requests. | Legal obligations and legitimate interests in demonstrating compliance (Art. 6(1)(c) and (f)). |
Consent is not obtained through pre-ticked boxes. You can use the device-only demo instead. You may withdraw health-data consent by contacting us or deleting your cloud account. Withdrawal does not affect processing that was lawful before withdrawal.
4. Local storage and cookies
Sets uses browser storage that is necessary for login state, preferences, recovery of an interrupted workout and synchronisation, and a service worker that is used only to deliver push notifications you have opted into. Sets does not currently use advertising or behavioural-tracking cookies. Clearing site data removes device-local information; signed-in cloud data can return after login.
5. Recipients and external services
- Supabase: authentication, database, file storage and server functions. Supabase acts as a processor for the hosted Sets data.
- Resend: transactional email delivery and, only after opt-in, storage of the email address, name and subscription status for Sets product-update broadcasts.
- Accepted friends: Social can expose workout dates, exercises, sets, cardio, statistics, notes, display name and avatar to people you accept as friends.
- Open Food Facts and USDA FoodData Central: receive barcode or food-search queries and normal technical request data; Sets does not intentionally include your Sets account ID.
- Web-push providers: browser/operating-system push services receive a push endpoint and deliver reaction notifications when enabled.
- Google Fonts, jsDelivr and hosting providers: may receive normal request metadata when serving fonts, libraries or the app.
We do not sell personal data and do not use it for third-party behavioural advertising.
6. International transfers
Some providers may process request or account data outside your country or the EEA. Where GDPR transfer rules apply, Sets relies on the provider’s applicable transfer mechanism, such as an adequacy decision or Standard Contractual Clauses. Contact us for current provider and transfer details.
7. Retention
Active cloud data is generally retained while your account exists. Deleting an account removes active user-owned records through database deletion rules. Limited copies may remain temporarily in processor backups, security logs or records that must be retained by law. Legal-acceptance evidence is retained for as long as reasonably necessary to demonstrate compliance and resolve claims. Device-local data remains until you clear it, remove the app or the browser removes it.
8. Security
Sets uses authenticated connections, row-level database policies, per-user access checks and local-first isolation. No online system is completely secure. Use a unique password, protect your device and report suspected security issues promptly.
9. Your rights
Depending on applicable law, you can request access, correction, deletion, restriction, portability and objection; withdraw consent; and complain to your competent data-protection authority. Settings includes account deletion and a workout-data export. For a complete copy or another rights request, email us. We may need to verify your identity.
10. Children
Sets cloud accounts are not intended for children under 16. We do not knowingly create such accounts. Contact us if you believe a child provided personal data without valid authorisation.
11. Automated calculations
Sets calculates statistics and suggestions such as estimated 1RM, training-quality scores and recovery guidance. These support the app experience but do not produce legal or similarly significant effects and are not medical decisions.
12. Changes
Material changes receive a new version date. Cloud users will be asked to review the new version and, where required, renew consent.
13. Contact and complaints
Contact: mehdi.ouladkhlie@icloud.com. You may also complain to the data-protection authority responsible for your location.