Privacy policy

Setkord (“Setkord”, “we”, “us”, or “our”) provides a strength-training log application. Setkord is free at launch and coming soon to iPhone. This Privacy Policy explains what personal data we collect, why we collect it, and the rights you have over it.

The controller of your personal data is the Setkord team, operating from the United Kingdom. For any question about this policy or your data, contact us at [email protected].

• /Account information: your email address and, optionally, your name.
• /Authentication data: a securely hashed password, or your Google account identifier if you choose to sign in with Google.
• /Training data: the exercises, sets, weights, reps, and notes you log, the routines you build, and the personal records calculated from that data.
• /Preferences: your chosen units, theme, text size, and contrast settings.
• /Subscription and billing status: whether you are on a free or paid plan, and its current status. Payments are processed by Apple through the App Store (in-app purchase) - we never receive or store your card details.
• /Anonymous product analytics: aggregated usage data, collected via TelemetryDeck, that is not tied to your account or identity.

• /To provide and operate Setkord: store and display your training data, calculate progress and personal records, and keep your preferences in sync across sessions.
• /To authenticate you and keep your account secure.
• /To process billing and maintain accurate subscription records, for any paid plan.
• /To contact you about your account, such as password resets and important service notices.
• /To understand aggregate, anonymous product usage and improve Setkord.
• /To comply with our legal obligations, such as retaining billing records.

Where the GDPR applies to you (for example, if you are in the EU or UK), we rely on the following legal bases:

• /Contract: processing needed to provide the service you signed up for, including your account, training data, and preferences.
• /Legitimate interests: securing the service, preventing abuse, and understanding anonymous usage patterns.
• /Consent: where you opt in to an optional feature, such as signing in with Google.
• /Legal obligation: retaining billing records to meet tax and accounting requirements.

We do not sell your personal information, and we do not share it with advertisers. We share data only with service providers (“subprocessors”) who help us run Setkord, each given only the access needed to perform their function:

• /Apple - subscription billing and payment processing via the App Store (in-app purchase).
• /Resend - delivery of transactional email, such as password resets and account notices.
• /Hetzner - hosting of our servers and databases.
• /Google Drive - encrypted, off-site storage of our database backups. Backups are encrypted before they leave our server, so their contents are not readable by the storage provider.
• /Cloudflare - content delivery network, DNS, and security.
• /Google - optional sign-in with a Google account, if you choose that method.
• /TelemetryDeck - privacy-first, anonymous product analytics.

We may also disclose information where required by law, or to protect the rights, property, or safety of Setkord, our users, or others.

Setkord uses a single essential session cookie to keep you signed in (via NextAuth). We also store your theme, contrast, and text-size preferences in your browser’s local storage so they persist between visits. We do not use advertising or cross-site tracking cookies.

We keep your account and training data for as long as your account exists. When you delete your account, this data is removed. Billing records are retained for approximately 7 years to meet financial and legal obligations. Analytics data is anonymous and is not linked to your account, so it is not affected by account deletion.

Depending on where you live, you have the right to:

• /Access the personal data we hold about you.
• /Correct inaccurate or incomplete data.
• /Delete your data - available in-app from Profile, or by emailing [email protected]. Deletion is permanent.
• /Export your data (data portability) - Setkord includes a built-in data export feature so you can take your training history with you.
• /Object to or restrict certain processing.

California residents (CCPA/CPRA): We do not sell your personal information, and we have not sold it in the preceding twelve months. You have the right to know what personal information we collect, to request its deletion, and to not be discriminated against for exercising your rights.

To exercise any of these rights, use the relevant control in the app (Profile) or email [email protected]. We may need to verify your identity before acting on a request.

If you are in the UK and believe we have not handled your data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Setkord is operated from the United Kingdom, and our subprocessors operate in a number of countries, including the UK, the EU/EEA, and the United States. Where we transfer personal data across borders, we rely on the transfer mechanisms recognised by the relevant privacy laws (for example, the UK International Data Transfer Agreement and EU Standard Contractual Clauses), and we require our subprocessors to protect your data to a standard consistent with this policy.

Setkord is not directed to children. It is not intended for use by anyone under 13 (or under 16 in the European Economic Area and the United Kingdom), and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.

We may update this policy from time to time. When we do, we will update the “Last updated” date above, and for material changes we will notify you by email or through the app.

Questions, requests, or complaints about this policy or your data: [email protected]. We aim to respond within a reasonable time.