Privacy policy

Information we collect

• Account information: email, display name, user ID, role, account status, and account creation time.
• Authentication information: passwords received for verification and stored only as bcrypt hashes; authentication tokens and session state; and password-reset token hashes and timestamps.
• Training information: workout dates, lifts, weights, sets, reps, target and perceived RPE (rating of perceived exertion), and set style.
• Programs: program names, spreadsheet and grid content, formulas stored as text, formatting, dimensions, merged cells, and program history.
• Custom lifts and coaching: custom lift data, fallback relationships between lifts, and coach/athlete relationship status and timestamps.
• Derived information: per-user trained models and associated scaling and feature metadata derived from that user’s training data.
• Request information: application and Fly.io logs may contain URLs, status codes, and client-address information.

The application uses browser storage for authentication and session state and user preferences.

How we use information

PRONAX uses this information to manage accounts and authentication, provide password recovery, store and use training records and programs, support coaching relationships, and produce training predictions.

The next PRONAX release is planned to introduce optional Strength Profiles: current-strength baselines for squat, bench press, and deadlift. Strength Profiles are not yet available. When introduced, this information can support your own training experience independently of the optional population-model program below. Entering strength baselines does not authorize their use for shared-model training or research.

Prediction models run within PRONAX application infrastructure. No external AI provider receives workout or program data.

PRONAX has no advertising or analytics/tracking SDKs, no HealthKit integration, and no payment collection. It does not deliberately collect location information; request logs may still include client-address information as described above.

Optional research: PRONAX Population Model

PRONAX is researching a shared machine-learning model that would be trained using voluntarily contributed athlete training data. The goal is to help new athletes receive useful predictions before they have enough personal training history. Eventually, the system may combine population-level knowledge with an athlete’s personalized model. This is a research and development initiative; the population model has not yet been deployed.

Your choice: Participation will be voluntary and separately authorized through an affirmative, in-app consent process. PRONAX will require your explicit opt-in before using your data for shared population-model training or research. Registering, accepting this Privacy Policy, logging workouts, or entering one-rep maxes does not constitute consent. Existing and future training records may be included only when covered by your explicit consent. Declining or deferring participation will not remove existing PRONAX features or prevent normal account use. This consent is separate from the athlete-specific training and predictions PRONAX already provides.

Information involved: With your explicit consent, the optional program may use relevant training information to train, evaluate, validate, and improve shared prediction models, including:

• Exercise and lift identities and variations.
• Workout dates and training history.
• Weight lifted, sets, and repetitions.
• Target and reported RPE (rating of perceived exertion).
• Estimated or tested squat, bench press, and deadlift one-rep maxes.
• Historical strength-baseline information, when available.

Account names and email addresses are not intended to be model-training features. Internal consent administration may still link participation records to athlete accounts. This does not mean that research data is fully anonymous.

Internal use: Contributed training data is intended exclusively for PRONAX’s internal model research, development, training, evaluation, and improvement. PRONAX does not intend to:

• Sell contributed athlete training datasets.
• Publish identifiable individual training histories.
• Provide these datasets to outside organizations for their independent AI training.
• Use these contributions for unrelated advertising or data-broker purposes.

These restrictions are distinct from ordinary hosting, storage, and other processing by infrastructure providers operating on PRONAX’s behalf, as described under “Service providers” below.

Withdrawal: Athletes will be able to withdraw permission through an accessible mechanism. This mechanism has not yet been implemented. Withdrawal will stop new use of your data for shared-model training and research. It will not necessarily reverse training already completed or remove your contribution from previously trained models; PRONAX does not promise automatic model unlearning.

Coaching access

Authorized coaches can access an athlete’s identity, training history, custom lifts, readiness and fatigue information, predictions, and program history. They can also upload, edit, rename, and activate the athlete’s programs.

Removing a coaching relationship prevents future server access through that relationship. It cannot retract information a coach has already viewed or copied.

Service providers

• Fly.io: application hosting, persistent files, logs, snapshots, and deployment infrastructure.
• Neon: PostgreSQL database hosting and recovery copies.
• Resend: transactional password-reset email delivery. Password recovery sends the recipient’s address and reset-email content through Resend.
• Recipient email providers: receive and store password-reset messages.

Data storage and retention

Application information is stored in the hosted database and persistent files. Authentication and session state and preferences are also stored in the browser. Logs, snapshots, and database recovery copies may contain information outside the live application records.

Backups, provider records, and previously sent emails may persist according to provider and recovery retention. This policy does not specify fixed retention periods for those copies.

Retention details for the planned optional population-model program remain unresolved, as described in the population-model section.

Account deletion

Self-service account deletion removes your live application database records and coaching relationships. It also attempts immediate deletion of your stored model and data directory. Failed filesystem cleanup is retried.

Account deletion does not guarantee immediate deletion from every backup or external provider. Backups, provider records, previously sent emails, and information another person has already viewed or saved may persist. Removing your account cannot retract those personal copies.

The current account-deletion process described above does not establish how separate research copies or previously trained shared models would be handled under the planned population-model program. Those details require a decision before publication, as described in the population-model section.

Security

Passwords are received for verification but stored only as bcrypt hashes. Password-reset tokens are stored as hashes with timestamps. Authentication uses JSON Web Tokens (JWTs) and session state. A coach’s server access to athlete information depends on an authorized coaching relationship.

Changes to this policy

Updates to this policy will appear on this page with a revised “Last updated” date.

Contact

For questions about privacy or account deletion, use the contact details on the support page.

[email protected]