Privacy Policy

Effective Date: March 17, 2026

Lift Track Gain ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our workout tracking application (the "Service"). It applies worldwide and complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Data Controller

Lift Track Gain is the data controller for personal data processed through the Service. To exercise any of your rights, contact privacy@liftrackgain.com.

2. Information We Collect

Account information — email, username, first/last name, hashed password, optional profile picture, optional bio, optional date of birth.

Health & fitness data (special category, GDPR Art. 9) — workout logs (exercises, sets, reps, weights, distance, duration), personal records, RPE scores, height, weight goals, and any notes exchanged with a connected trainer.

Subscription data — subscription tier, status, Stripe customer/subscription identifiers (no card data is stored on our servers).

Technical data — IP address, browser/device info, session timestamps, action logs, JWT auth cookies.

3. Legal Bases for Processing

  • Contract (Art. 6(1)(b)) — account creation, authentication, subscription management, service delivery.
  • Explicit consent (Art. 6(1)(a) & Art. 9(2)(a)) — processing of your health and fitness data, sharing with trainers, public profile.
  • Legitimate interests (Art. 6(1)(f)) — service security, fraud prevention, anonymised product analytics.

You may withdraw consent at any time from Settings → Privacy & Data. Because the Service cannot operate without health-data processing, withdrawal results in account deletion.

4. Your Rights (GDPR Arts. 15–22)

  • Access — download your data via Settings → "Export My Data".
  • Rectification — edit your profile and workout records at any time.
  • Erasure (Right to be Forgotten) — "Delete My Account" in Settings permanently removes all your data.
  • Portability — your export is provided in machine-readable JSON.
  • Restriction & objection — contact privacy@liftrackgain.com.
  • Lodge a complaint — with your local supervisory authority.

5. Data Retention

Active-account data is retained while your account exists. Deleted accounts are erased immediately from the live database; encrypted backups are purged within 30 days. Subscription/billing records are retained for up to 7 years to comply with tax law.

6. International Transfers

Payment processing is performed by Stripe, Inc. (USA). Transfers are protected by Standard Contractual Clauses (SCC 2021) and supplementary technical measures (encryption in transit, pseudonymisation).

7. Security

Passwords are hashed with Argon2; all transport is encrypted with TLS 1.2+. Authentication cookies are set with the HttpOnly (where possible), Secure and SameSite=Strict flags.

8. Cookies

We use strictly-necessary cookies for authentication and a small number of preference cookies (theme, weight unit) that are only set with your consent. See our Cookie Policy.

9. Changes to this Policy

We may update this policy from time to time. Material changes will be notified by email and require renewed acceptance on next sign-in.

Questions? Email privacy@liftrackgain.com.