Legal

Privacy Policy

Last updated: August 10, 2026

1. Who we are

This Privacy Policy explains how Metal Strength ("we", "us", the "Service") handles personal data on the website at metalstrength.fit and in the Metal Strength apps for Android and iOS. Metal Strength is operated by an independent developer based in France, acting as the data controller for the purposes of the EU General Data Protection Regulation (GDPR). You can reach us at hello@metalstrength.fit.

2. Information we collect

a. Account information

Creating an account is optional. If you sign up with email and password, we store your email address and authentication details. If you sign in with Google, we receive your name and email address from your Google account. If you sign in with Apple (in the iOS app), we receive the name and email address Apple shares — which may be a private relay address if you choose to hide your email. Accounts and sign-in are handled for us by Supabase (see section 8).

b. Profile and body data

So the app can pre-fill your workouts and calculators and adapt what it suggests, we store the profile you set up: sex, bodyweight, height, optional age, unit preference (kg / lb), and — if you answer the optional onboarding questions — your training goals, chosen sports, training experience level and where you train (gym or home).

c. Training data you save

When you are signed in and choose to save something, we store what you entered so we can build your history, charts and badges. This can include:

• Workouts and plans you build or save from the program library, including the exercises, days, sets, reps, weights and rest times, and (for Premium) an in-progress draft so you can continue on another device
• Finished sessions you save from the rep counter: the date, the exercises, the sets you completed, reps and loads, and the session duration
• Lift entries from the strength calculator: the exercise, weight and reps, estimated one-rep max, strength tier, percentile and the date
• Bookmarked exercises and similar preferences

d. Friends

If you use Friends, we store a friend code generated for your account, an optional display name you choose (up to 24 characters), the connections you make — who asked whom, whether the request is pending or accepted, and when — and a single on/off setting recording whether you share your training. Your friend code cannot be used to look up your email address or your real name, and you are not searchable: another person can only reach you if you give them the code yourself. What a friend can and cannot see is set out in section 3.

e. Health-calculator saves

The inputs and results you choose to save from the macro and body-fat calculators — for example height, weight, age, activity level, calorie and macronutrient targets, and body-fat estimates.

f. Progress photos

If you use the progress-photo strip in Stats, the pictures you upload are stored in a private storage bucket, in a folder that only your account can read or write, together with the date you attach to each one. They are shown back to you through short-lived signed links. They are never public, never shared with other users, and never used for anything else. On mobile, adding a photo asks for camera or photo-library permission; you can decline and the rest of the app keeps working.

g. Record submissions

If you submit a lift for the community record board, we receive the video of the lift, the photo or video of the weight, the lift details and the contact details you enter. The files go to a private bucket that is not web-readable and are reviewed by us. If a record is accepted, only the record details you provided (such as the lift, the load and the name you chose) are published — never your raw files or your email.

h. Messages you send us

If you use the contact or "notify me" form, we collect the name, email address and message you submit so we can reply and (for the launch list) email you. These messages are delivered to us by email through Resend.

i. Technical & usage data

Like virtually all websites, our hosting and security providers automatically process limited technical data needed to deliver and protect the Service — for example your IP address, browser and device type, and request logs. Our bot-protection widget (Cloudflare Turnstile) also processes your IP and a token to tell humans from bots. We use this for security, abuse prevention, and to keep the Service running.

Your training, body and photo data is information you knowingly enter and it is tied to your account. We use it to show you your own history, charts and progress, and we never sell it. The one case where any of it reaches another person is Friends — which is off until you switch it on, covers training only, and is described in section 3. You can delete any entry, any photo, or your whole account, at any time.

3. Sharing with other users (Friends)

Friends is the only feature that shows any of your data to another person. It is off by default: creating an account does not switch it on, adding somebody does not switch it on, and being added by somebody does not switch it on. Nothing is shared until you turn on "Show my training to friends" yourself.

Connecting to someone takes two deliberate steps by two different people:

• You give another person your friend code, or they give you theirs — codes are not listed or searchable anywhere, so this only happens if one of you hands it over.
• The person who receives the request has to accept it. Until they do, nothing is connected and nothing is shared.

What an accepted friend can see, and only while your sharing switch is on:

• The display name you chose (or simply "Lifter" if you did not choose one)
• Which muscles you trained most, as a summary across your whole visible period
• How your training splits between lifting and cardio, including the exercises inside each

What a friend can never see, whatever your settings:

• Which days you train. Your activity calendar is deliberately never shared. A record of the days a person is reliably out of the house is a movement pattern, and accepting a friend request must not hand that over. The totals a friend sees carry no dates at all.
• The weights you lift, or any individual session
• Your body weight, body-fat logs, measurements or progress photos
• Your email address or your real name, neither of which is reachable from a friend code

This is enforced in our database, not merely in the app: the query a friend's device is allowed to run can only return per-exercise totals, so dates and loads cannot be requested even by a modified client. Turning the switch off, or removing the friend, stops the sharing immediately — either side can remove a connection at any time, without the other's agreement. Removing a friend deletes the connection record itself.

Sharing your training is entirely optional and the Service works fully without it. Because it is a choice you make about your own data, we rely on your consent for it (see section 9), and you can withdraw that consent at any time with the same switch.

4. What stays on your device

A lot of the app runs entirely in your browser or on your phone and never reaches our database:

• The strength, macro and body-fat calculators compute locally. If you are not signed in, the numbers you type are only used to draw the result on the page. They reach our servers only if you are signed in and choose to save them.
• A workout you are still building is kept in your browser's session storage so you can move around the app and come back to it. For free accounts and guests it is deleted when the app is closed. Only Premium accounts have a copy mirrored to our database so it can be restored on another device.
• Preferences such as language, theme, light/dark mode and units are stored locally.
• The exercise library, the training programs and the guides can be browsed without an account and without us recording who read what.

5. Cookies & similar technologies

We use cookies and similar browser storage for a few distinct purposes:

• Essential / sign-in: when you log in, your session is kept in your browser's local storage so you stay signed in. Without this, accounts cannot work.
• Preferences: language, theme, units and an unfinished workout, as described in section 4.
• Security: Cloudflare Turnstile may set a token/cookie to verify you are not a bot when you submit a form.
• Analytics: Google Analytics helps us understand how the site is used (pages visited, sessions). Where we enable Microsoft Clarity, it produces aggregated heatmaps and anonymised session replays of how pages are used. In the EEA, UK and similar regions these are only set after you consent.
• Advertising: Google and its partners set cookies to serve and measure ads — see section 6. In the apps there are no cookies; the equivalent role is played by your device's mobile advertising identifier, which is also covered in section 6.

Where the law requires it (for visitors in the EEA, UK and similar regions), non-essential cookies — including personalised advertising — are only used after you give consent through our cookie/consent message. You can change or withdraw your choice at any time, and you can also block or delete cookies in your browser settings. Full detail is in the Cookie Policy.

6. Advertising

Metal Strength is supported by advertising on its free tier. A Premium subscription removes all advertising from both the website and the apps.

One promise applies everywhere, and it does not change: your training data, your body measurements, your progress photos and your saved plans are never shared with any advertiser and never used to target ads. Advertisers receive no information about what you lift, what you weigh, or what you look like.

a. On the website

We use Google AdSense, a third-party advertising service provided by Google. As a result:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info/choices and youronlinechoices.eu.

b. In the Android and iOS apps

The apps show ads to free accounts through Google AdMob. To do that, the AdMob SDK processes a mobile advertising identifier — the Android Advertising ID (AAID) or, on iOS, the Identifier for Advertisers (IDFA) — together with coarse technical information such as device model, operating-system version, general region and IP address. This is what makes an ad measurable and, where you have allowed it, personalised.

• You are asked first. In the EEA, the UK and other regions where the law requires it, a Google-certified consent message appears before any ad loads, and you can change or withdraw that choice later. On iOS, personalised advertising additionally requires you to allow tracking in the App Tracking Transparency prompt; if you decline, ads still appear but are not personalised.
• You can reset or limit the identifier at any time in your device settings — on Android under Settings → Privacy → Ads, and on iOS under Settings → Privacy & Security → Tracking.
• Rewarded ads are optional. Where the app offers to unlock something in exchange for watching a short video, nothing plays unless you choose it, and declining costs you nothing you already had.
• No ads are shown during a workout, and none are shown at all until you have finished a few sessions.

For more on how Google uses data when you use our site or app, see How Google uses information from sites or apps that use its services and the Google Privacy Policy.

7. Payments & subscriptions

Where you buy Premium determines who processes the payment:

• On the website — PayPal collects and processes your payment details under its own privacy policy.
• In the Android app — Google Play billing, with RevenueCat managing the entitlement on our behalf.
• In the iOS app — the Apple App Store, likewise through RevenueCat.

In every case we never receive your full card or bank details. We store only what is needed to run your subscription: the biller, the subscription or transaction identifier, the plan, its status and its renewal dates, linked to your account. We keep transaction records for as long as accounting and tax law requires.

8. Services we use (data processors)

We rely on a small number of trusted third parties to run the Service. Each processes data only as needed to provide their function and under their own privacy policy:

• Supabase — accounts, authentication, the database holding your saved data, and the private storage buckets holding your progress photos and record submissions. Privacy policy
• Cloudflare — website and API hosting, content delivery and Turnstile bot protection. Privacy policy
• Resend — delivery of transactional and contact emails. Privacy policy
• Google — Google Sign-In, Google Analytics, Google Play billing for Android subscriptions, and advertising on the free tier: AdSense on the website and AdMob in the apps (see section 6). Privacy policy
• Apple — Sign in with Apple and App Store billing, for the iOS app. Privacy policy
• RevenueCat — subscription management for in-app purchases. Privacy policy
• PayPal — payment processing for subscriptions bought on the website. Privacy policy
• Microsoft — Clarity usage heatmaps and anonymised session replay, where enabled on the website. Privacy policy

We do not sell your personal data. Our typefaces are self-hosted, so loading a page does not send your IP address to a font provider.

9. Legal bases for processing (GDPR)

• Performance of a contract: creating your account, storing the workouts, sessions, photos and other data you ask us to save, and running your Premium subscription.
• Legitimate interests: keeping the Service secure, preventing abuse, reviewing record submissions, and responding to messages you send us.
• Legal obligation: keeping billing and transaction records that accounting and tax law require us to keep.
• Consent: non-essential cookies, analytics, personalised advertising and the reading or storing of a mobile advertising identifier in the apps (section 6), sending you launch/marketing emails you signed up for, and showing your training to friends (section 3). You may withdraw consent at any time — for Friends, by turning the sharing switch off; for advertising, through the consent message and your device's ad settings.

10. How long we keep your data

• Account, profile, training and photo data: kept until you delete it or close your account. A free-tier limit only hides older entries — it never deletes them, and they come back if you subscribe. A free account currently sees the last 90 days of saved workouts and progress photos inside the app; anything older is stored and untouched, and a data export always contains everything we hold, whichever plan you are on.
• Subscription & billing records: kept while your subscription is active, then as long as accounting and tax law requires.
• Record submissions: kept while the submission is under review and as a record of what was published; the uploaded files can be removed on request.
• Friend connections: kept until either person removes the friendship or closes their account, at which point the connection record is deleted outright.
• Contact / signup messages: kept only as long as needed to handle your request or while you remain on the launch list.
• Technical logs: kept short-term by our hosting/security providers for security and reliability.

11. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your data protection authority — in France, the CNIL.

Getting a copy of your data

You do not have to ask us. Open Dashboard → Settings → Your data and choose Download my data. We email a single archive to the address on your account, containing a complete .json file of every record we hold for you, the same training as .csv spreadsheets, and your progress photos. The .csv uses a column layout other fitness apps can import, so you can take your training elsewhere. One request per day; we keep no copy of the archive after sending it.

A free account's export covers the last 30 days of workout history and progress photos — the same period a free account can read in the app. Older records are retained, not deleted. If you want the complete copy without subscribing, email hello@metalstrength.fit and we will send it. For anything else — correction, restriction, objection, withdrawing consent — write to the same address.

Bringing data in from another app

Settings → Your data → Import from another app reads an export file you have already downloaded from another fitness app and turns it into workouts in your history. We never connect to another service on your behalf and never ask for your credentials there — you choose a file, your device reads it, and you see exactly what would be added before anything is written. We do not keep the file.

12. Deleting your data

You can delete individual items — a saved workout, a session, a lift, a progress photo — from your dashboard at any time. To delete your entire account and all associated data, open Dashboard → Settings → Delete account (available on both the website and the apps). Deletion is immediate and irreversible. If you prefer, email hello@metalstrength.fit from your account address and we will remove it for you. Full instructions, including what is deleted and what we must keep, are on the account deletion page.

13. International data transfers

Some of our providers (such as Google, Apple, Cloudflare, Supabase, RevenueCat, Microsoft and Resend) may process data on servers outside the European Economic Area. Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

14. Children's privacy

The Service is intended for a general fitness audience and is not directed to children. We do not knowingly collect personal data from children under 15. If you believe a child has provided us data, email hello@metalstrength.fit and we will delete it.

Because the Service is not directed to children, we do not knowingly serve personalised advertising to anyone we have reason to believe is a child, and ad requests are tagged accordingly. If you tell us an account belongs to a child, we will delete it rather than continue to show ads against it.

15. Mobile applications

The Metal Strength apps for Android and iOS offer the same account and the same features as the website, and this policy covers them. When you sign in, the data described in section 2 is stored in our database and storage (Supabase) so your history is available across your devices — and exactly as on the website, calculator inputs are only sent to us when you choose to save them.

The apps support native Google sign-in (and Sign in with Apple on iOS), and Premium is purchased through the platform store as described in section 7. Free accounts see advertising in the apps, served by Google AdMob using your device's advertising identifier — what that means, what you are asked, and how to turn it off is set out in section 6. Premium removes it. The apps contain no analytics trackers. Device permissions are requested only when a feature needs them — camera and photo access for progress photos and record submissions, and notifications for the rest timer — and can be refused. Apple and Google may independently collect technical information through the App Store and Google Play under their own privacy policies.

16. Security

We use reputable providers and security measures to protect your information: database row-level security so an account can only ever read its own rows, private storage buckets scoped to your user folder with short-lived signed links for your photos, encrypted connections, and bot protection. No method of transmission or storage is completely secure, but we work to keep your data safe.

17. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected here with a new "Last updated" date above.

18. Contact

Questions about this Privacy Policy or your data? Email hello@metalstrength.fit.