Privacy Policy

Account information. When you register, we collect your email address and a password (stored as a salted hash — we never see your plain-text password).

Workout data. Exercises, sets, reps, weights, session timestamps, personal records, and plan details you log in the app. You may also add past workouts by uploading a CSV file you export from another fitness app — see Section 1b.

Usage data. Streak counts, XP totals, level history, and in-app navigation events used to improve the product. We do not sell this data.

Waitlist email. If you join the waitlist on our website, we collect only your email address to notify you at launch. No further data is collected at that stage.

Photos you upload. Optional images you choose to attach to custom exercises you create in the app. See Section 1a.

Device and log data. Basic device information (OS version, app version, crash logs) collected automatically to diagnose issues. No advertising identifiers are collected.

The app lets you create your own custom exercises for movements or machines the built-in library doesn’t include, and optionally attach one photo to each.

• We only receive an image when you deliberately select one. We do not scan or index your photo library.
• The photo is used solely to display on that exercise, inside your own account. It is transmitted over an encrypted connection and stored on Cloudflare R2 object storage (see Section 4a).
• Before storing, our server re-encodes the image to WebP, which strips embedded metadata — including any camera details and GPS / location data attached to the original photo.
• The photo is private to your account. It is not shown to other users and is not part of any social, sharing, or public feature. Our staff may access stored content only where necessary for support, security, investigating misuse, or complying with the law.
• We never use your photos for advertising, to train machine-learning models, or for any purpose beyond operating this feature, and we never sell them.
• A photo is deleted when you remove it in the app, when you delete that custom exercise, or when you delete your account. Adding a photo is always optional — a muscle-group icon is shown if you don’t.

The app lets you bring in your past workouts by uploading a CSV file that you export yourself from Strong, Hevy, or FitNotes.

• We process only the file you deliberately choose and upload. It contains your workout history — exercise names, dates, sets, reps, weights, and any workout notes you exported. We read it on our servers to create workout entries, and show you a review screen before anything is saved.
• The uploaded file is held only long enough to complete or retry the import, and is deleted once the import finishes, is undone, or is abandoned. The workouts it creates are stored like any other workout in your account (see Section 3a). A small record of each import (which app, how many workouts, when) is kept so you can undo it later.
• Not an official integration. SweatStreak is not affiliated with, endorsed by, or partnered with Strong, Hevy, or FitNotes. We do not connect to their services or access their APIs — we only read the file you export and upload. Those names are used only so you know which export file to choose.
• We never use imported data for advertising, to train machine-learning models, or sell it.

We use the information we collect to:

• Provide, maintain, and improve the SweatStreak app and website.
• Calculate your streaks, XP, levels, and personal records on-device and sync them to your account.
• Send you a single launch notification email if you joined the waitlist (you can unsubscribe at any time).
• Send transactional emails (password reset, account security notices) — no marketing without explicit consent.
• Diagnose crashes and fix bugs using aggregated, anonymised crash reports.

We do not use your workout data for advertising purposes.

Your data is stored on secured cloud servers (MongoDB Atlas on AWS). We use industry-standard encryption in transit (TLS 1.2+) and at rest. Access tokens expire after 15 minutes; refresh tokens expire after 7 days and are rotated on every use.

Passwords are hashed with bcrypt before storage. We never store plain-text credentials.

On-device storage. When you log workout sets — online or offline — SweatStreak temporarily stores that data in local device storage (AsyncStorage) before uploading it to your account. This local copy is protected by your device's operating system and is not accessible to third parties through SweatStreak. Once data has successfully synced, the local copy is cleared. If you uninstall the app or sign out before syncing completes, this local data is permanently deleted from the device and cannot be recovered.

While we take reasonable precautions, no system is perfectly secure. If you believe your account has been compromised, contact us immediately at support@sweatstreak.com.

While your account is active. We retain your account, workout, and profile data for as long as your account remains active. There is no automatic deletion of active-account data.

When you delete your account (Profile → Settings → Delete Account), the following happens:

• Identity information — your name, email, password, Google/Apple sign-in identifiers, and active sessions are anonymised or cleared immediately, so this information can no longer identify you or be used to sign in.
• Body metrics — your body metric profile and full weight/measurement history are deleted immediately.
• Workout templates, plans, exercise stats, streak record, and XP totals — deleted immediately.
• Custom exercises you created and their photos — deleted immediately, including the image files held on Cloudflare R2.
• Workout session history (exercises, sets, reps, weights) — disconnected from your identity immediately, then permanently deleted by our daily maintenance process, typically within 24 hours.
• Workout-history imports — any CSV you uploaded is already deleted once the import finishes, is undone, or is abandoned; the record of each import (source app, counts, timestamps) is deleted with your account.
• Feedback and bug reports you submitted — anonymised immediately: the user ID, name, and email tied to the submission are removed. The message content itself may be retained afterward for product improvement or to complete an in-progress support/bug investigation, but it is no longer linked to you.
• A minimal, anonymised record of your former account (no name or email) is kept for up to 30 days as an audit trail, then permanently deleted.

Data with its own retention schedule, independent of account deletion. The following are deleted automatically on a fixed schedule measured from when each individual item was created — not from when you delete your account:

• Notifications — deleted 90 days after creation.
• XP transaction history — deleted 2 years after each transaction.

Backups. Our database runs on MongoDB Atlas's Free/M0 tier, which does not offer Cloud Backup or point-in-time recovery, and we do not currently use any other automated backup service. This means there is no separate long-term backup copy of your data outstanding beyond the retention periods described above.

Logs. Our hosting provider, Render, retains application and infrastructure logs for up to 7 days for operational and security purposes (for example, diagnosing outages or investigating abuse). These logs may incidentally contain fragments of request data, such as an email address, if that request triggered an error; they are used only to operate and secure the service and are deleted automatically after 7 days.

We do not sell your personal data. We share information only in these limited cases:

• Service providers. Named third-party processors listed below, each bound by a data processing agreement.
• Legal requirements. If required by law, court order, or to protect the rights and safety of users.
• Business transfer. In the event of a merger or acquisition, your data would transfer to the new entity subject to this policy.

Shared workout cards and stories you choose to export and post on social media are shared at your discretion. We have no control over third-party platforms once content leaves the app.

We use the following sub-processors. Each receives only the minimum data required for its stated purpose.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data.
• Export your workout data in a machine-readable format.
• Withdraw consent for any processing based on consent.

To exercise these rights, email us at support@sweatstreak.com. We will respond within 30 days.

To delete your account and all associated data from within the app, go to Profile → Settings → Delete Account.

The SweatStreak mobile app does not use cookies. The promotional website (this site) uses only technically necessary session storage — no advertising cookies, no third-party tracking pixels.

SweatStreak is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal data, contact us and we will delete it promptly.

We may update this policy from time to time. When we make material changes, we will notify registered users via email and update the effective date at the top of this page. Continued use of the app after the effective date constitutes acceptance of the updated policy.

Questions or concerns about this policy? Reach us at: