Privacy policy

What data IronTrack keeps, where it goes, and the choices you have.

The short version

• Without an account, your workouts, nutrition log and profile stay on your device. I don't receive them.
• With an account, they're stored so they can sync between your devices. Only your account can read them.
• There are no ads, no analytics and no tracking scripts in the app or on this site. I don't sell or share your data for marketing.
• You can export your data at any time, and delete your account yourself from the app.

Who is responsible for your data

IronTrack is run by Suman Kumar Raj, an individual developer in India. For your personal data I'm the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023, and the "controller" under the EU and UK GDPR. Contact me about anything in this policy at irontrack.privacy@gmail.com.

This policy covers the hosted app at track-sr-8532.vercel.app and this website. IronTrack's code is open source; if you use a copy hosted by someone else, that person is responsible for your data there.

What the app keeps on your device

Everything you enter is saved in your browser's storage (IndexedDB and localStorage) on your device: your training plan, logged sessions, nutrition log, body weight, profile details and settings. This is what lets the app work offline. If you don't create an account, this data never leaves your device. Clearing your browser's site data, or uninstalling the app, deletes it.

What I collect if you create an account

• Account details: your email address and password. The password is stored only as a secure hash; I can't see it.
• Profile: the name, age, sex, height, weight, activity level, goals and profile photo you choose to enter.
• Training data: your plans, exercises, presets and every session you log (sets, weights, reps, RIR, notes, sleep and energy entries).
• Nutrition data: food and water entries, body weight logs, meal plans and your own foods.

Some of this, such as body weight, nutrition, sleep and the notes you write, is about your health. You choose what to enter, and the app works without most of it. I use it solely to show you your workout and nutrition analytics and to sync it between your devices. It's never used for advertising, profiling or anything else.

If you email me

If you send feedback or a question, for example with the app's Send feedback button, I receive your email address and whatever you write. I use it only to reply and to improve IronTrack, and I'll delete the conversation if you ask.

Why I use it

• To run your account and sync your data between your devices.
• To send the emails the app needs: confirming your address and resetting your password. No marketing emails.
• To keep the service secure, for example by blocking bots on the sign-in form.

I process your data with your explicit consent. When you create an account, you tick a box confirming you're 18 or older and agreeing that IronTrack stores the fitness and health data you log to sync it across your devices. The app saves when you agreed and to which version of this policy. You can withdraw consent at any time by deleting your account.

Services that process data for IronTrack

• Supabase stores your account and synced data and handles sign-in.
• Brevo delivers the app's account emails (address confirmation and password resets), so it processes your email address and the content of those emails. Brevo routes the links in those emails through its own servers and may record whether an email was opened and its link clicked; I use this only to check that emails are delivered, never for marketing.
• Vercel hosts the app and this website. Like any web host, it processes your IP address and browser details to serve pages and keep short-lived logs.
• Cloudflare Turnstile runs the security check on the sign-in screen. It processes your IP address and browser signals to tell people from bots.
• Google Fonts serves the app's fonts, so your browser sends Google your IP address when it downloads them.

These providers may process data outside India, including in the United States and the European Union. Each is bound by its own privacy and security commitments.

How long I keep it

Your synced data is kept until you delete it or your account. When you delete a workout session or log entry, the cloud keeps a small marker with the item's ID, without its contents, so the deletion reaches your other devices. Accounts whose email address is never confirmed may be deleted automatically after 7 days. When you delete your account, it and all your synced data are deleted right away; copies in the providers' backups expire on their normal schedule.

Your rights

You can:

• Get a copy of your data. Use Settings → Export Full Backup in the app, or export your history as JSON or CSV.
• Correct it. Edit your profile and entries in the app at any time.
• Delete your account and data. In the app, open Profile → Delete account and type DELETE to confirm. Your account and everything synced to it are deleted immediately, and the app clears them from that device. If you can't sign in, email irontrack.privacy@gmail.com from the address you signed up with and I'll delete it within 30 days.
• Withdraw consent, or ask any question about your data, by emailing the same address.
• Nominate someone to exercise these rights for you if you die or become unable to, as the Digital Personal Data Protection Act allows.

Grievance Officer

For the purposes of the Digital Personal Data Protection Act, 2023, the Grievance Officer for IronTrack is Suman Kumar Raj, reachable at irontrack.privacy@gmail.com. Grievances about your personal data will be acknowledged within 48 hours and resolved within 30 days.

If you're not happy with the outcome, you can complain to the Data Protection Board of India. In the EU or UK, you can complain to your local data protection authority.

Security

Connections use HTTPS. In the database, row-level security lets each account read and write only its own rows. Passwords are stored hashed. No system is perfectly secure; if a breach affects your data, I'll tell you and the authorities as the law requires.

Children

IronTrack accounts are only for people 18 and older, and creating one means confirming that you are. The app can be used without an account at any age; that data stays on the device, and I never receive it. If you believe someone under 18 has created an account, email me and I'll delete it.

Changes to this policy

If this policy changes, I'll update the date at the top. For important changes, such as using your data in a new way, I'll also tell you in the app before they take effect.

Contact

Suman Kumar Raj, Grievance Officer · irontrack.privacy@gmail.com