Your data

Privacy policy

SupaSet is a workout log made by Rishi Garg. This policy explains the data used by the iPhone app and this website.

Effective 3 November 2026 · Contact: [email protected]

Logging on your iPhone

You can log workouts without an account. Workouts, saved routines, programs, equipment settings, notes, weigh-ins and body measurements are stored on your iPhone. Exporting a CSV or sharing a workout sends the information you choose to the destination you select.

Optional account and backup

If you sign in with Apple or Google, SupaSet uses your account identifier, email address and profile details you provide, such as your display name and profile photo. Apple may supply a private relay address. Supabase provides account authentication, database storage and file storage for SupaSet.

Account backup and sync store your workout history, notes, saved workouts, programs, exercise and equipment settings, custom exercises and their photos, training preferences, weigh-ins and body measurements. Account and installation identifiers help keep devices in sync, enforce service limits and protect access. Account data is linked to your SupaSet account.

Progress photos

Front, side and back progress photos are kept in an encrypted vault on this iPhone, protected by its passcode or biometrics. The vault is excluded from device backups and does not sync to your account. SupaSet removes photo metadata such as location and device information when it prepares these images. Profile photos and custom exercise photos are separate and may sync with your account.

Saving a progress photo to Photos creates a copy outside the vault. Sharing or exporting information is your choice. Sign-out or an account switch explains when the local vault will be erased and offers the chance to save copies first.

Apple Health

Apple Health is optional. With your permission, SupaSet writes finished workout times and reads or writes body weight and waist circumference. You can control access in iOS and turn these features off in SupaSet.

Health weight and waist readings are read on this device rather than copied to your account. One exception is a Health-derived bodyweight saved with a completed workout: that number becomes part of the workout history and may sync or be included in training information sent to the assistant. Health and fitness information is not used for advertising, marketing or data brokerage.

Optional AI features

On-device Apple Intelligence features process their input on your iPhone. The online assistant is separate: it requires sign-in, Pro and consent before use, and can be turned off in Settings → AI.

When you use the online assistant, your questions and the training information it looks up pass through SupaSet’s server to OpenAI. This can include exercises, dates, weights, reps, records, notes, saved workouts, programs, equipment places and a workout’s captured bodyweight. Progress-vault photos are not sent to the assistant. SupaSet does not give the assistant your account email or display name as training context.

SupaSet keeps service usage counts and operational status information, rather than storing the contents of assistant questions and replies on its server. Requests use OpenAI’s API with application-state storage disabled. OpenAI does not use API data for model training by default and may retain content for abuse monitoring for up to 30 days, with exceptions described in OpenAI’s data controls. The assistant’s consent screen asks you to confirm you are 18 or older or have a parent or guardian’s permission.

Usage analytics

The app sends anonymous counts of how it is used, so we can see which parts work and which need fixing. For example: which onboarding screens are skipped, when a workout is started or finished, how many sets it had, its length rounded to five minutes, whether the assistant answered, and which screens are opened. Each event also includes the app version, device model, iOS version, language, time zone, network type (Wi-Fi or cellular), your App Store country, your units, whether you have Pro and whether you are signed in.

These events never include your name, email address, account or IP address, and never include exercise or workout names, weights, reps, notes, measurements, photos or anything you type, including assistant questions and replies. They are not combined with your account, sold or used for advertising.

PostHog processes these events on its EU Cloud in Frankfurt, Germany. PostHog discards IP addresses and does not look up location. Events carry a random identifier that the app replaces every 12 months, and PostHog keeps events for up to seven years. Analytics are on by default; turn them off in Settings → Data & Privacy → Share usage data. The app then stops sending events and forgets its identifier.

Subscriptions

Apple handles subscription payments. SupaSet uses purchase and subscription information to determine whether Pro is active; SupaSet does not receive your payment-card details. Managing or cancelling a subscription is done through your Apple Account. Deleting SupaSet data does not cancel a subscription.

This website and support

This website is hosted by Cloudflare. Serving and securing requests involves technical information such as IP addresses, browser details and request logs under Cloudflare’s privacy policy. The website has no advertising trackers or analytics scripts. The contact form opens a draft in your own mail app and sends nothing until you choose to send it.

If you email support, Rishi Garg receives your email address, message and any attachments you include through Gmail. Please avoid sending passwords, purchase credentials or health information that is not needed to explain the issue.

Retention and your choices

Local data remains on your device until you remove it or use an action that clears it. Synced account data is retained to provide your account and backup until it is deleted or no longer needed, subject to necessary security, legal and backup retention. Support correspondence is kept as needed to handle your request.

You can export workout history and the body log from Settings → Your data, edit or delete logged entries, delete progress photos, disable the assistant, turn off usage analytics, and revoke Health, camera, Photos or notification permissions through iOS. To request account deletion, a copy of account data or another privacy request, email [email protected] from the account’s email address. We may need to verify ownership before acting. Deletion requests include account data and uploaded account photos; copies you have exported or shared must be managed at their destination.

Service providers and changes

The services described here may process information outside your country. SupaSet uses that information to provide requested features, protect the service and respond to support. SupaSet does not sell your personal information or use it for cross-app advertising tracking.

Material changes to this policy will be reflected on this page with a new effective date. If the assistant asks to send additional kinds of information, its consent screen asks again before that use.