Privacy Policy

Account information. When you register, we collect your email address and a password (stored as a salted hash — we never see your plain-text password).

Workout data. Exercises, sets, reps, weights, session timestamps, personal records, and plan details you log in the app.

Usage data. Streak counts, XP totals, level history, and in-app navigation events used to improve the product. We do not sell this data.

Waitlist email. If you join the waitlist on our website, we collect only your email address to notify you at launch. No further data is collected at that stage.

Device and log data. Basic device information (OS version, app version, crash logs) collected automatically to diagnose issues. No advertising identifiers are collected.

We use the information we collect to:

• Provide, maintain, and improve the SweatStreak app and website.
• Calculate your streaks, XP, levels, and personal records on-device and sync them to your account.
• Send you a single launch notification email if you joined the waitlist (you can unsubscribe at any time).
• Send transactional emails (password reset, account security notices) — no marketing without explicit consent.
• Diagnose crashes and fix bugs using aggregated, anonymised crash reports.

We do not use your workout data for advertising purposes.

Your data is stored on secured cloud servers (MongoDB Atlas on AWS). We use industry-standard encryption in transit (TLS 1.2+) and at rest. Access tokens expire after 15 minutes; refresh tokens expire after 7 days and are rotated on every use.

Passwords are hashed with bcrypt before storage. We never store plain-text credentials.

On-device storage. When you log workout sets — online or offline — SweatStreak temporarily stores that data in local device storage (AsyncStorage) before uploading it to your account. This local copy is protected by your device's operating system and is not accessible to third parties through SweatStreak. Once data has successfully synced, the local copy is cleared. If you uninstall the app or sign out before syncing completes, this local data is permanently deleted from the device and cannot be recovered.

While we take reasonable precautions, no system is perfectly secure. If you believe your account has been compromised, contact us immediately at support@sweatstreak.com.

While your account is active. We retain your account, workout, and profile data for as long as your account remains active. There is no automatic deletion of active-account data.

When you delete your account (Profile → Settings → Delete Account), the following happens:

• Identity information — your name, email, password, Google/Apple sign-in identifiers, and active sessions are anonymised or cleared immediately, so this information can no longer identify you or be used to sign in.
• Body metrics — your body metric profile and full weight/measurement history are deleted immediately.
• Workout templates, plans, exercise stats, streak record, and XP totals — deleted immediately.
• Workout session history (exercises, sets, reps, weights) — disconnected from your identity immediately, then permanently deleted by our daily maintenance process, typically within 24 hours.
• Feedback and bug reports you submitted — anonymised immediately: the user ID, name, and email tied to the submission are removed. The message content itself may be retained afterward for product improvement or to complete an in-progress support/bug investigation, but it is no longer linked to you.
• A minimal, anonymised record of your former account (no name or email) is kept for up to 30 days as an audit trail, then permanently deleted.

Data with its own retention schedule, independent of account deletion. The following are deleted automatically on a fixed schedule measured from when each individual item was created — not from when you delete your account:

• Notifications — deleted 90 days after creation.
• XP transaction history — deleted 2 years after each transaction.

Backups. Our database runs on MongoDB Atlas's Free/M0 tier, which does not offer Cloud Backup or point-in-time recovery, and we do not currently use any other automated backup service. This means there is no separate long-term backup copy of your data outstanding beyond the retention periods described above.

Logs. Our hosting provider, Render, retains application and infrastructure logs for up to 7 days for operational and security purposes (for example, diagnosing outages or investigating abuse). These logs may incidentally contain fragments of request data, such as an email address, if that request triggered an error; they are used only to operate and secure the service and are deleted automatically after 7 days.

We do not sell your personal data. We share information only in these limited cases:

• Service providers. Named third-party processors listed below, each bound by a data processing agreement.
• Legal requirements. If required by law, court order, or to protect the rights and safety of users.
• Business transfer. In the event of a merger or acquisition, your data would transfer to the new entity subject to this policy.

Shared workout cards and stories you choose to export and post on social media are shared at your discretion. We have no control over third-party platforms once content leaves the app.

We use the following sub-processors. Each receives only the minimum data required for its stated purpose.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data.
• Export your workout data in a machine-readable format.
• Withdraw consent for any processing based on consent.

To exercise these rights, email us at support@sweatstreak.com. We will respond within 30 days.

To delete your account and all associated data from within the app, go to Profile → Settings → Delete Account.

The SweatStreak mobile app does not use cookies. The promotional website (this site) uses only technically necessary session storage — no advertising cookies, no third-party tracking pixels.

SweatStreak is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal data, contact us and we will delete it promptly.

We may update this policy from time to time. When we make material changes, we will notify registered users via email and update the effective date at the top of this page. Continued use of the app after the effective date constitutes acceptance of the updated policy.

Questions or concerns about this policy? Reach us at: