Privacy Policy

1. Overview

Liftw (“we”, “us”) provides a workout tracking application. We treat training logs, body metrics, and related account information as sensitive personal data — similar in spirit to other health and fitness information. This policy explains what we collect, why, and how we protect it.

2. Data we collect

• Account data — name, email, and password hash (we never store plain-text passwords).
• Training data — workouts, sets, exercises, notes, goals, and optional body measurements you choose to log.
• Technical data — standard server logs (e.g. IP, timestamps) needed to operate and secure the service.
• Optional integrations — if you create an API key for AI / MCP tools, usage of that key is associated with your account so you can revoke access.

3. How we use data

We use your data to:

• Provide the core product (log, history, progress views)
• Authenticate you and keep your account secure
• Power optional features you enable (e.g. analysis published back to your dashboard via your API key)
• Maintain, debug, and improve reliability of the service

We do not sell your personal training data to advertisers.

4. Privacy & security of health-related training data

Gym and body data can reflect health and lifestyle. We take that seriously:

• Access control — your workouts are private to your account by default.
• Encryption in transit — connections to the app use HTTPS/TLS.
• Encryption at rest — database hosting (e.g. Neon) encrypts data at rest; production traffic is served over encrypted channels (e.g. Vercel).
• Secrets — passwords are hashed; API keys are stored as hashes, not recoverable secrets.
• Least access — optional AI tools only see what you authorize with a key you control.

No system is perfect. We continuously improve practices, but you should still use a strong unique password and protect any API keys you generate.

5. Sharing

We share data only with infrastructure providers required to run Liftw (hosting, database, authentication infrastructure), under contractual and technical safeguards. We may disclose information if required by law.

6. Retention & deletion

We retain account and training data while your account is active. You may request deletion of your account and associated data by contacting us through the channels listed on the product site. Backups may persist for a limited period after deletion.

7. Your choices

• Update account details while signed in
• Revoke MCP / API keys at any time from the app
• Stop using optional AI integrations

8. Changes

We may update this policy as the product evolves. Material changes will be reflected by the “Last updated” date on this page.

9. Contact

Questions about privacy: reach out via the contact method published with the live Liftw deployment or the project maintainers.