Privacy policy

Effective 20 September 2026. Last updated 24 October 2026.

The short version

TrainHere works fully offline. An account is optional, and nothing is uploaded until you create one.
Progress photos never leave your device. There is no cloud photo storage to leave them in.
Health data read from Apple Health or Health Connect stays on your device too. It is never sent to our backend.
Usage statistics are off unless you explicitly allow sending limited product events to PostHog in the EU.
There are no ads, no advertising identifiers, no automatic screen recordings or crash-reporting SDKs, and nothing is sold or shared for marketing.
TrainHere Plus is paid to Apple, Google or, on the web, Link by Stripe. We never see your card; we keep only the state of your subscription.
You can export everything as a file, and delete your account and its data, from inside the app.

Who is responsible

TrainHere is made and operated by FreeBase Software, a Danish sole proprietorship (enkeltmandsvirksomhed) owned by Mikhail Klimenko and established in Denmark, CVR 45234207. FreeBase Software is the data controller for the processing described here.

Privacy questions and data-rights requests: privacy@trainhere.app. Anything else: support@trainhere.app.

What stays on your device

TrainHere is built offline-first: your training is recorded on the device and works with no network and no account. Some of what it holds is only ever on the device, by design, and does not become part of an account even when you have one.

Progress photos. Photos you take or choose stay in the app's own storage on that device. They create no server record, no uploaded file and no event. They are not included in an account export, because they are not in the account. Deleting the app deletes them, so keep your own copy if they matter to you.
Health data. Body weight, and — if you turn it on — sleep and resting heart rate read from Apple Health or Health Connect are used on the device to keep your measurements in step and to suggest where a readiness check-in might start. They are not transmitted to our backend.
Reminders and app state. Scheduled training reminders and local app preferences stay on the device. Local diagnostics remain local unless you export them. Optional Coach-ready alerts use the delivery settings described below. Separately, usage analytics you enable upload selected events and a device identifier to PostHog EU, as described below.

What an account stores

Signing in is optional and supports training backup/sync, Coach history and Plus purchases. Signing in alone does not permit uploading training or health information. Only after your separate, explicit training-sync permission are the following categories stored on our backend with Supabase, primarily in the EU, under owner-only access rules:

Your profile — the name you give it, your goal, experience and training schedule — your preferences, and your equipment selection.
Your programs and every saved revision of them, including programs you wrote yourself.
Completed and in-progress workouts: exercises, sets, loads, repetitions, recorded effort, timestamps, and any notes you write.
Body measurements you log, such as weight and waist.
Custom exercises you create.
Which recommendations you accepted or adjusted, so progression stays consistent across devices.
If you use the optional AI coaching: each request you made and the answer it returned, the action, when it ran, whether it succeeded, and what you decided about each proposal, so an answer outlives the phone that asked for it and every device knows whether a change was applied. See Optional AI coaching.
Your consent records, including whether product statistics are on.
Your email address and the identifier from Apple or Google if you sign in with them, plus a record of each device registered to the account.

Account data is stored with Supabase on infrastructure in the European Union. Traffic is encrypted in transit. A device you remove from the account can no longer write to it; its local copy of your data keeps working offline on that device.

Signing in

Three ways in, all optional:

Email link. We send a one-time sign-in link to your address through Resend, using its Ireland sending region. Resend processes the address, message content and delivery result on our behalf and stores that data in the United States. The sending region does not determine where email data is stored.
Sign in with Apple. Apple tells us an account identifier and the email address you choose to share, which may be Apple's private relay address.
Sign in with Google. Google tells us an account identifier and your email address. Google's own privacy policy covers what Google does with the sign-in.

We do not receive or store your password for any of these.

Optional AI coaching

Coaching is optional. After your separate, explicit OpenAI permission, each action you request sends the context described on its screen through our server to OpenAI in the United States to generate an answer. API data is not used for training by default. We disable response-state storage; this does not remove abuse-monitoring logs, which may contain requests and answers for up to 30 days, with legal or safety exceptions. We do not claim Zero Data Retention approval.

What a coaching request contains:

The program or exercise the action is about, and the relevant part of our exercise catalog.
A bounded four-week summary of completed workout dates and exercise performance: load in kilograms, repetitions and recorded effort. Reviews and progress questions may also include selected completed working sets.
Your readiness status, schedule, equipment, and any optional movement preferences, equipment limits or training background you enter, where the action needs them.

If you enable automatic reviews, selected training cycles are reviewed after workouts sync, including while TrainHere is closed. A training month covers four cycles and may last longer than four weeks. Requests contain bounded records for the reviewed period and limited comparison workouts; missing coverage is identified. Automatic reviews do not send raw readiness ratings. They use the shared review allowance, save the answer, and never apply program changes without your confirmation. You can turn them off; stopping future requests requires the setting to reach your account online.

Saved fields automatically excluded from coaching requests:

Your notes.
Your body measurements.
Health data from Apple Health or Health Connect.
Photos.
Your name, email address or account identifiers.

Text you enter for a Coach request is sent as entered and is not automatically redacted. Do not include names, contact details or medical records. Permission is independent of training sync, analytics, operating-system health access and buying Plus.

If the coach needs more context than it was given, it may ask for one of a fixed set of additional fields. The app shows you what is being asked for and sends nothing until you agree.

We keep each request and the answer it returned with your account, readable only by you, so you can come back to an answer on any device and apply or decline it there; what you decide is kept with the account too. We also record which model answered and how many tokens the request used, so the cost of a feature can be measured. All of it is included in your export and deleted with your account. Withdrawing OpenAI permission also deletes the active cloud request/answer history and stops future requests; it cannot recall a request already transmitted. Accepted program changes and device copies remain.

Purchases

TrainHere Plus is bought with an account. The payment itself is handled by whoever you pay; we never receive or store card numbers or bank details.

In the iPhone or Android app you pay Apple or Google, which process the payment under their own privacy policies. We confirm those purchases through RevenueCat: the app gives RevenueCat your account identifier, and RevenueCat processes it together with the store's purchase record on our behalf.
On the web you pay Link, Stripe's merchant-of-record service, and Stripe processes the payment. As the seller, Link collects what the sale needs — your email address, name, billing address, payment method and the tax that applies — and is responsible for that data under Link's and Stripe's privacy policies. We create a Stripe customer for your account that carries only your account identifier, so the purchase can be matched to you.

With your account we store what the store reports about your subscription: which store, its status, the plan, when it renews or ends, any grace period or refund date, whether it will renew, and — for web purchases — the Stripe customer identifier. Our server asks the store for this itself and decides from it whether Plus is active. We also keep a list of the store notifications already handled, with only each notification's identifier and type, so none is processed twice. Your data export includes what each store reported.

Optional product statistics

Off by default. If you turn them on, the app records coarse events about how the product is used — that a workout was completed, that a recommendation was accepted or adjusted, which reason the app gave — alongside a random installation identifier, the app version, the platform and the calendar day. Durations and completion are recorded as ranges rather than exact values, and no loads, repetitions, notes, measurements, health data or photo material can enter them; that boundary is enforced by tests.

Uploads require new consent to policy product-metrics-v2. Earlier consent covered local recording only and does not enable uploads. Recommendation reasons and training ranges remain local; uploads contain only the limited product facts described below.

Connections the app makes on its own

Update check. On launch the app asks Expo's update service (u.expo.dev) whether a newer version of its JavaScript exists, sending the runtime version and release channel. No account or training data is in that request.
Sync. Only when you are signed in, and only for the categories listed above.
Coach-ready alerts. If you enable Coach result notifications and allow notifications in your operating system, we store your device's push address, language, time zone, quiet hours and pause setting with your signed-in session. Expo Push Service and Apple or Google deliver a generic ready alert containing a saved-job identifier, without review text or workout details. Push addresses expire after 30 days without refresh and are removed on sign-out, device removal or account deletion. Delivery settings and receipts are included in your account export; restoring an export does not enable alerts. Offline preference changes reach the service after reconnection.
Exercise videos. An exercise guide offers a button that opens a YouTube search in your browser. Nothing opens without your tap, and the link carries the exercise name and a neutral technique word — nothing about you.
The website. Serving trainhere.app through Cloudflare means your IP address and request are processed to deliver the page and keep the service secure.

There are no advertising SDKs, no third-party analytics SDKs, no crash-reporting SDK and no advertising identifier in the app.

Marketing website analytics

If basic usage counts are enabled for your app release, screen openings and button availability and presses are counted separately from detailed analytics. Each request contains only a registered screen or control name, the count type and a count. Our Cloudflare collector stores daily totals, without account, device or session identifiers, individual event records or training content. Cloudflare processes connection metadata, including the IP address needed to receive a request. Counters are kept only in app memory; your opt-out preference is saved on this device. Turn Basic usage counts off in Settings → Privacy. Browser Do Not Track and Global Privacy Control also disable these counts. Daily totals older than 90 days are removed by scheduled cleanup. This mode remains disabled until its release-specific privacy and infrastructure review is complete.

Separately, optional app usage analytics sends named screen visits, button availability and presses, basic product actions, timestamps, app version, platform and a random device identifier to PostHog EU only after you opt in. It sends no account identity, entered text, training values, measurements, health readings, photos or screen recordings. PostHog processes network requests, including an IP address to receive them; geographic enrichment is disabled. The queue is capped at 500 events. Events older than seven days never upload and are discarded when the app next records an event. Turn detailed usage analytics off in Settings → Privacy to stop collection and clear the queue. Turning it off does not delete events already sent. Contact support for deletion using the device identifier shown in Settings → Privacy. The previous device-only diagnostics consent does not authorize uploads. See PostHog's privacy policy.

Public marketing pages use Cloudflare Web Analytics to count visits and understand page performance and referral sources. This service does not use analytics cookies or browser storage and does not track people across websites. Cloudflare processes requests to deliver the service; see its privacy policy.

We do not load this analytics script on the web app, account screens, import screens, waitlist responses or legal pages. We send no account identifiers, training records, photos, form fields or custom events to it. Pages with query strings or unrecognized fragments, sensitive referrers, and browsers sending Do Not Track or Global Privacy Control are excluded. The app's optional telemetry setting is separate and unchanged.

Optional website launch waitlist

The marketing website may offer a separate launch waitlist. Only if you explicitly agree, it stores your email address, consent version and signup/expiry dates in a separate Cloudflare D1 database to send a public-launch email. It does not create an app account or receive training data. See the waitlist privacy notice for retention, abuse prevention and withdrawal. Core training never requires joining.

Why we are allowed to process this

Processing	Legal basis (GDPR)
Running the app on your device, without an account	Training stays on your device; we do not receive it. Network/service metadata is described separately.
Account, sync, backup and restore	Account service: Art. 6(1)(b). Optional training/health sync: explicit consent, Art. 6(1)(a) and Art. 9(2)(a) for health information.
Sending sign-in links	Performance of a contract, Art. 6(1)(b)
Optional AI coaching you request	Explicit consent, Art. 6(1)(a) and Art. 9(2)(a) for health context, plus the action you request.
Selling and checking a TrainHere Plus subscription	Performance of a contract, Art. 6(1)(b)
Optional product statistics	Consent, Art. 6(1)(a) — withdrawable at any time
Health data on your device	Your explicit permission, given to the operating system and to us, Art. 9(2)(a)
Keeping the service secure and preventing abuse	Legitimate interests, Art. 6(1)(f)

Training sync and OpenAI each require their own versioned choice in the app. Declining either leaves free offline training available. Operating-system health permission does not grant cloud permission. Account exports include your permission records; importing an export cannot grant permission.

How long things are kept

Data	Kept for
Your account data	Until account deletion; synced training and Coach history are also deleted from active storage when you withdraw their respective permission.
Subscription records	Until you delete the account; deleting it does not cancel the subscription itself
List of handled store notifications	Kept to prevent double processing; your account identifier is removed from it when the account is deleted
Deleted account rows	Removed immediately when the deletion runs
Records of deleted items, kept so other devices delete them too	90 days, then purged
Backups containing deleted data	Daily Supabase backups use a seven-day recovery window; removal from backups happens as snapshots age out, rather than immediately. Restored data must be purged before the service resumes.
OpenAI abuse-monitoring logs	Up to 30 days by default, with legal or safety exceptions; separate from TrainHere's active account history.
Training-sync and OpenAI permission evidence	Version, purpose, platform and server-recorded grant/withdrawal dates remain until account deletion.
Deletion receipt	Kept as evidence that the deletion happened, with no identifier for you in it
Optional usage analytics received by PostHog EU	Up to one year, then deleted; ask support to delete them sooner using the device identifier shown in Settings → Privacy
Anything on your device	Until you delete it, reset the app, or remove the app

Account deletion is immediate and irreversible: there is no grace period from which a deleted account can be recovered. Export first if you want to keep anything. Account deletion does not automatically erase independent processor logs, anonymous analytics or records the payment provider must keep. Contact us for processor-specific erasure; we will explain any applicable retention obligation.

Your rights

Under the GDPR you may ask for access to your data, correction, erasure, a portable copy, restriction of processing, and you may object to processing based on legitimate interests. Several of these are buttons rather than requests:

Access and portability. Settings → Manage data → export gives you a complete JSON copy, and a readable CSV.
Correction. Saved workouts, sets and measurements are editable in the app.
Erasure. Settings → Account → delete account purges the backend copy; the same flow asks what should happen to the local copy. Resetting local data is separate and always available.
Withdrawing consent. Settings → Privacy provides separate withdrawal controls for training sync, OpenAI and product statistics. Confirmed training-sync withdrawal deletes active cloud training and stops uploads on all devices; OpenAI withdrawal deletes active Coach history and stops future requests. Device training remains. If confirmation fails, processing is paused on this device and you must retry; the app explains that other devices may still process data. Turn off local health access separately in your phone's privacy settings. Withdrawal does not change the lawfulness of processing before withdrawal.

For anything you would rather we did by hand, write to privacy@trainhere.app. We respond without undue delay and within one month; if a lawful extension is necessary, we explain it within that month. If you think we have handled your data badly, you can complain to the Danish Data Protection Agency, Datatilsynet, or to the supervisory authority where you live.

Data outside the EU

Primary account storage with Supabase is configured in the EU. Resend sends sign-in emails from Ireland and stores email data in the US. This does not mean every processor, support operation or subprocessor is EU-only. OpenAI processes permitted Coach requests in the US; RevenueCat in the US verifies in-app purchases, and Stripe may process web payment information in the US. Cloudflare, Expo and other service providers may also use global infrastructure. Provider data processing terms include applicable transfer safeguards such as the European Commission's standard contractual clauses. Contact us for the applicable recipient and safeguard details.

Children

TrainHere is intended for adults aged 18 and over. We do not knowingly collect data from them. If you believe a child has created an account, write to privacy@trainhere.app and we will remove it.

Security

Traffic is encrypted in transit. Every account row is protected by database-level access rules that make it readable and writable only by its owner, and the keys that could bypass those rules exist only on the server. A device you remove is refused further writes. No system is perfect, and this is a small operation — if something looks wrong, tell us at privacy@trainhere.app.

Changes

When this policy changes materially, the app will say so before the change affects you, and the date at the top will move. Changes that would send somewhere new anything that is device-only today will ask for your consent first.