Privacy policy

TRN/LOG (trnlog.app) is a strength-training log that plans your next week from what you actually lifted. It is run by David Pastor, an individual based in Costa Rica (“we”). This policy explains what we collect, why, who else receives it, and the choices you have. Questions: privacy@trnlog.app.

The short version:

• We collect what the app needs to log your training and plan the next week.
• We do not sell your data and we do not show ads.
• AI features are optional; turning them off changes nothing about your plan.
• Assistants such as ChatGPT or Claude can read your training only if you connect them and press Allow.

What we collect

Account. Your email address and password (stored only as a secure hash). When you sign in we keep a session record, which can include your IP address and browser details, to keep you signed in and to protect the account.

Former waitlist. While sign-up was by invitation, we kept the email address and language of people who asked for an invite. When sign-up opened we emailed each of them once to say so and deleted the list.

Training data. What you enter or log in the app:

• Your profile: units, bodyweight, experience level, gym equipment, language, avatar and your device’s time zone (so the weekly summary arrives on your Sunday evening).
• Weigh-ins and body measurements you choose to log, such as waist, arms or body fat, and whether you’re losing, maintaining or gaining.
• Your routines, training blocks and the weekly targets the app sets.
• Workouts and every set: weight, reps, reps in reserve and time.
• How sessions felt: readiness, pump, effort, soreness and joint pain ratings.
• Movements you choose to avoid, notes you write, and exercises you create.
• Progress records, levels and titles the app awards.

Some of this, such as bodyweight, body measurements, soreness, joint pain and the movements you avoid, can say something about your health. We use it only to run the app and plan your training, and we treat it with the same care as the rest of your data. You choose whether to enter it.

Voice and text logging. If you log a set by voice, the recording is sent for transcription and then discarded; we do not store audio. If you type a set, the text is processed the same way.

Notifications. If you turn on rest-timer alerts, we store the push subscription your browser gives us so we can send them.

Usage analytics. We use PostHog to understand how the app is used and to catch errors: pages viewed, buttons used, and events such as starting or finishing a workout, recorded as counts and workout identifiers rather than their contents. Before you sign in, analytics keep no visitor identifier on your device. We keep campaign tags (source, medium, campaign and content) in local storage for a 30-day attribution window, and a pending-signup marker for a seven-day confirmation window in the same browser. These records contain no email, password or sign-in token. Referral attribution is classified by service without adding the referring page address to these campaign records. We also strip automatic referrer addresses and search keywords from analytics events. After you sign in, analytics use your account ID (never your email), stored in a cookie and local storage. We do not record your screen or sessions. We remove sign-in links, invite emails and password-reset codes from page addresses before anything is sent.

Payments. If you subscribe, Polar, our payment provider and merchant of record, collects your payment details, billing address and tax information. We never receive your card number. Polar tells us your customer ID, plan, subscription status and renewal dates, which we keep to know whether your account is subscribed.

Emails we send. We keep a copy of each email we send you (the confirmation when you sign up, password resets, the end-of-trial report and the weekly summary if you get it by email) and whether it was delivered. The weekly summary can be turned off in Settings or with the link at the bottom of each one.

How we use it

• To provide the app: log workouts, sync them across your devices, and work out your next week’s sets and targets. That plan comes from the app’s own rules, not from AI.
• To run optional AI features you choose to use (below).
• To manage your subscription and free trial.
• To send the emails and notifications described above.
• To keep the service secure and prevent abuse, including rate limits.
• To understand usage and fix problems.

Where privacy law requires a legal basis: we rely on performing our agreement with you to run the app, on your consent for optional features such as AI, notifications and connected assistants, and on our legitimate interests for security and analytics. Health-related details are used only because you choose to provide them for your training.

AI features

AI is optional and never sets your weights, sets or reps. When you use an AI feature, only what that feature needs is sent:

• Voice or text logging: the recording or text, plus the exercise and your units and plate setup.
• Exercise swaps: the exercise, the reason you give (which may mention pain), and possible replacements.
• Week explanations: the week’s decisions and the ratings you gave, but not your notes or bodyweight.
• Routine ideas: the goal, days per week and equipment you describe.

These requests go through OpenRouter to OpenAI models, and through TypeSafe for exercise matching and swaps. They process the request under their own terms and privacy policies.

Connected assistants (ChatGPT, Claude and others)

You can connect an AI assistant to TRN/LOG. Nothing is shared until you sign in and press Allow on our consent screen, which names the assistant. The connection is read-only: the assistant can read your current block, day plans, recent workouts, sets per muscle, exercise history, and your account ID and email. It cannot log, change or delete anything. What the assistant then does with that information is governed by its provider’s privacy policy. You can disconnect it at any time in Settings → Account and data → Connected assistants, which ends its access at once, or in the assistant’s own settings.

Who else receives data

We use these services to run TRN/LOG, including third-party services your browser contacts directly:

• Cloudflare: hosts the website and app.
• Convex: our database and backend, where your account and training data are stored.
• Resend: sends our emails.
• Polar: takes subscription payments as merchant of record, under its own privacy policy for the purchase.
• PostHog (United States): usage analytics and error reports.
• OpenRouter and OpenAI; TypeSafe: the optional AI features above.
• Your browser’s push service (for example Google, Apple or Mozilla): delivers notifications you turn on.
• GitHub: exercise photos are loaded from a public GitHub repository, so GitHub sees your device’s IP address when they load.
• Product Hunt: the badge image in the public landing footer loads from Product Hunt, which receives your IP address and browser details when it loads. We do not send the referring page address with that image request. If you follow the badge link, Product Hunt’s privacy policy applies to that visit.

We do not sell or rent your personal data, and we do not share it for advertising. We may disclose data if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the service, in which case this policy continues to apply.

Cookies and data on your device

We use cookies to keep you signed in and, after you sign in, for analytics as described above. The app also keeps a copy of your recent workouts on your device so you can train offline; that copy stays after you sign out until another account signs in on the same device. On a shared device, clear the site’s data in your browser settings after signing out.

How long we keep it

• Account and training data: for as long as you have an account. Deleting your account removes it within 30 days, usually at once.
• Copies of emails we sent: 90 days.
• Payment and invoice records: kept by Polar for as long as tax and accounting law requires, including after you delete your account.
• Analytics and service logs: at most 12 months.

Your choices and rights

• Export: Settings → Account and data downloads every logged set as a CSV file, and your weigh-ins and measurements as their own file. For a full copy of everything we hold, email us.
• Correction: most details can be edited in the app; for anything else, email us.
• Deletion: Settings → Account and data → Delete account removes your account and all your training data. You can also email us to ask.
• Optional features: you can stop using AI features, turn off notifications, and disconnect assistants at any time.

Depending on where you live, including Costa Rica (Law 8968 on the Protection of Persons regarding the Processing of their Personal Data), the EU, the UK and California, you may have further rights: to access, correct, delete or port your data, to object to or restrict its use, and to withdraw consent. Email privacy@trnlog.app; we answer within 30 days. You may also complain to your data protection authority; in Costa Rica, that is PRODHAB (Agencia de Protección de Datos de los Habitantes).

International transfers

Our providers may process data in the United States and other countries. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.

Children

TRN/LOG is not intended for anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Security

Data is encrypted in transit, passwords are hashed, and access to the app’s data is checked on every request. No system is perfectly secure, so please use a password you don’t use elsewhere.

Changes

If we change this policy, we will update the date above, and for significant changes we will tell you in the app or by email before they take effect.

Contact

David Pastor, Costa Rica. Privacy requests: privacy@trnlog.app. Support: hello@trnlog.app.