Privacy Policy

Data we collect

• Account data: name, email address, password hash, and sign-in session data.
• Training data: workouts, exercises, sets, reps, loads, durations, distances, notes, goals, constraints, equipment, preferred units, timezone, and user-provided training context.
• Connector data: OAuth client registrations, authorization approvals, access tokens, refresh tokens, and the single mcp:use scope needed to operate the MCP connector.
• Exercise resolution data: phrase memories and short-lived resolution evidence used to match phrases like "DLs" to the intended exercise.
• Share data: public workout share links and the workout details shown on those links, only when a user explicitly asks to create a share link.
• Operational data: standard server and security logs such as request path, timestamp, IP address, user agent, and error details when needed to keep the service reliable and secure.

How we use data

Workout Memory uses data to authenticate users, authorize MCP clients, log and correct workouts, resolve exercise names, answer training-history questions, show the web dashboard, create requested share links, prevent abuse, debug errors, and maintain the service. We do not sell personal data or serve advertising.

Sharing and processors

Your authorized AI client receives only the tool inputs and tool responses needed for the request you make. Public workout share links are visible to anyone with the link until revoked. The service is hosted on infrastructure providers, including Hetzner for application hosting and Cloudflare for DNS, TLS proxying, and edge protection. We may disclose data if required by law or to protect the service and its users.

Retention and control

• Workout, exercise, profile, and account data are kept until deleted or until you ask us to delete your account.
• Access tokens are short-lived, refresh tokens expire, and connector approvals can be revoked by disconnecting the connector in the AI client.
• Workout share links can be revoked from the web dashboard; deleted workouts also disable their share links.
• Operational logs are kept only as long as needed for security, reliability, debugging, or legal obligations.

Contact

For access, correction, deletion, export, privacy, or security requests, email [email protected].