Privacy Policy
SetLift LLC
Effective August 3, 2026 · Last updated August 3, 2026
SetLift has no analytics, no crash reporting, no advertising, and no trackers of any kind. We do not sell your data and we never will. We collect what the app needs to work — your workouts, your profile, and anything you choose to post or send — and nothing else. You can delete your account and everything in it from inside the app at any time.
- Who we are
- What we collect
- What we don't do
- How we use your data
- AI features
- Who we share data with
- Where your data lives
- Security — and its limits
- Who else can see your data
- How long we keep it
- Your rights and choices
- U.S. state privacy rights
- International users
- Children and teens
- Changes to this policy
- Contact us
1. Who we are
SetLift ("SetLift", "we", "us") is a workout tracking and coaching application operated by SetLift LLC, a California limited liability company. This policy explains what data the SetLift mobile application and this website collect, why, and what control you have over it.
This policy applies to the SetLift app and setlift.app. It does not apply to third-party services you reach from within SetLift, which have their own policies.
2. What we collect
Account information
When you create an account we collect your email address, a display name, and the date your account was created. If you sign up with email and password, we send a six-digit verification code to confirm the address; the same mechanism is used for password resets. If you sign in with Google, Google confirms your email address to us and we skip our own verification step.
You may optionally add a phone number. It is typed by you and we do not verify it. Other users cannot find you by phone number unless you switch that on — phone search is off by default, and you can turn it on or back off in your settings at any time.
Profile and fitness information
During onboarding and in your profile settings, you provide:
- Date of birth — used to confirm you meet our minimum age and to inform training recommendations
- Gender, activity level, and training goals
- Active injuries, so programming can work around them
- Equipment access and nutritional focus
- Goal weight and body metrics recorded over time
Some of this is information about your body and your health. We treat it accordingly, and we describe your specific rights over it in the Consumer Health Data Privacy Notice.
Photos, video, and audio
- Profile photo — if you upload one, it is stored in a public storage bucket. This means anyone who has or guesses the file's URL can view it, whether or not they use SetLift. Please treat your profile photo as public. See Security.
- Progress photos — these are photos of your body, stored in a private bucket that requires authentication to access. They are not shown to other users unless you deliberately share them.
- Form videos — video you record or select to review or share your lifting technique.
- Voice messages — audio you record to send to a coach or client, stored in a private bucket.
- Coach verification materials — if you apply to be a coach on SetLift, we collect a selfie and an image of your certification or identification document, stored in a private bucket, so we can confirm you are who you say you are.
Workout data
The core of the app. We store your routines, logged workouts (exercise, sets, reps, weight, duration, and timestamps), calendar events, programs and program enrolments, exercise categories, per-exercise notes, saved blocks, and templates. Personal records are calculated from your logs rather than stored separately.
Social and messaging data
If you use SetLift's social features we store your groups and the posts, comments, and reactions within them; direct messages; notifications; workouts and programs you share; your recent contacts; and coach–client relationships. Coaches can write private notes about their clients, which are visible to the coach and not to the client.
By default, other users can find you by searching for your email address. They cannot find you by phone number unless you deliberately turn phone search on.
Device permissions
SetLift asks for access to your photo library (for form videos and progress photos) and your microphone (for voice messages). Both are requested only at the point you use the feature, and you can decline or revoke them in iOS Settings — the rest of the app continues to work.
3. What we don't do
This section exists because it is unusually short in our case and we would rather be specific than vague.
- No analytics. SetLift contains no analytics SDK. Not Firebase, Amplitude, Mixpanel, PostHog, Segment, or anything comparable.
- No crash reporting. No Sentry, no Crashlytics. We do not receive automatic reports about your device or your session.
- No advertising and no ad identifiers. We do not serve ads, we do not use the IDFA, and we do not build advertising profiles.
- No behavioural tracking. We do not log what screens you visit or how you move through the app.
- No selling or sharing for advertising. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.
- No use of your health or fitness data for marketing or data mining.
4. How we use your data
We use the data described above only to:
- Operate the app — store and display your workouts, programs, and progress
- Authenticate you and keep your account secure
- Generate workouts and programs when you ask us to (see AI features)
- Deliver messages, notifications, and shared content between you and other users you have connected with
- Let coaches you have connected with view the training data they need to coach you
- Send transactional email — verification codes, password resets, and account notices
- Verify coach credentials
- Respond to your support requests
- Comply with law and enforce our Terms of Service
We do not use your data for any purpose beyond these without asking you first.
5. AI features
SetLift uses the Google Gemini API to generate workouts and programs and to import routines. When you use one of these features:
- Your typed prompt is sent to Google
- If you import a routine from a photo, the image of that workout is sent to Google
We use Gemini's paid API tier. Under Google's terms for paid services, Google does not use prompts or responses submitted through the paid tier to train its models. Google's handling of this data is governed by the Gemini API Additional Terms of Service and the Google Cloud Privacy Notice, which we encourage you to read rather than rely on our summary.
We do not send your progress photos, voice messages, direct messages, or logged workout history to Google. Only the prompt you type and, for photo import, the workout image you select.
Workouts and programs generated by SetLift's AI features are produced automatically and are not reviewed by a medical professional or certified trainer before you see them. See our health and fitness disclaimer.
6. Who we share data with
We share data with a small number of service providers who process it on our behalf, under contract, for the purposes listed. We do not sell data to anyone.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Essentially all app data — account, profile, workouts, messages, photos, audio | AWS us-east-2, Ohio, USA |
| Google (Gemini API) | AI workout and program generation, routine import | Your typed prompt; for photo import, the workout image | Google infrastructure |
| Resend | Transactional email delivery only | Your email address and the contents of the message sent to you | USA |
| Cloudflare R2 | Storage and delivery of exercise form videos | Your IP address when your device loads a video | Cloudflare global network |
| Unsplash | Stock imagery displayed in the app | No account data. Loading an image exposes your IP address to Unsplash. | Unsplash infrastructure |
We may also disclose data if we are legally required to — for example in response to a valid subpoena or court order — or where we believe in good faith that disclosure is necessary to prevent imminent harm. If SetLift is acquired or merges with another company, your data may transfer as part of that transaction; we will tell you before it does and before any new privacy policy applies to it.
7. Where your data lives
SetLift's primary data store is Supabase, running on Amazon Web Services in the us-east-2 region (Ohio, United States). Exercise form videos are stored on Cloudflare R2 and served from Cloudflare's global network. If you use SetLift from outside the United States, your data is transferred to and processed in the United States.
8. Security — and its limits
Your data is encrypted in transit using TLS, and encrypted at rest by Supabase and AWS. Access to production systems is restricted.
We would rather tell you the limits plainly than let you assume protections that are not there:
- There is no end-to-end encryption. SetLift's operator and Supabase are technically capable of reading your progress photos, voice messages, direct messages, and the private notes coaches write about clients. We do not do this as a matter of routine, but the encryption we use does not make it impossible.
- Your profile photo is stored in a public bucket. Anyone who has the file's URL can open it without signing in to SetLift. Do not use a profile photo you would not be comfortable being public.
- Session tokens are stored in the device's app storage (AsyncStorage) rather than the iOS Keychain. This is a deliberate implementation choice. It means your session token has less operating-system-level protection than Keychain storage would provide, which matters most if your unlocked device is accessed by someone else.
- No method of transmission or storage is completely secure. We cannot guarantee absolute security.
9. Who else can see your data
Beyond service providers, other people may see your data in the ordinary course of using SetLift:
- Coaches you connect with can see the training data, messages, and any progress photos or videos you share with them within the coaching relationship.
- Group members can see anything you post, comment, or react to in that group.
- People you message can see your messages, including voice messages.
- Anyone who knows your email address can find your account. Phone-number search is off unless you turn it on; if you do, anyone who knows that number can find you too.
- Anyone at all, in the case of your profile photo, as described above.
10. How long we keep it
We keep your account data for as long as your account exists. Some specifics worth stating:
- Voice messages are retained indefinitely by design — they are not auto-deleted after a period of time. They are removed when you delete your account or delete the conversation.
- Coach verification materials (selfie and certification document) are retained for as long as you hold coach status, so we can re-verify if needed.
- Progress photos and body metrics are retained until you delete them or your account.
When you delete your account, we perform a real deletion of your authentication record and associated data — not a soft flag that hides it. Backups may retain copies for a limited period before they age out. Content you posted into a shared space, such as a group post someone else has replied to, may persist in that context; contact us if you need it removed.
11. Your rights and choices
Regardless of where you live, you can:
- Access and correct your profile data directly in the app
- Delete your account from inside the app — in Settings → Account → Delete Account. This performs a genuine deletion.
- Control discoverability — turn phone-number search on or off in your settings
- Revoke device permissions for photos and microphone in iOS Settings at any time
- Request a copy of your data by emailing us
To exercise any right we cannot handle in-app, email privacy@setlift.app. We will respond within 45 days, and will tell you if we need longer.
12. U.S. state privacy rights
California (CCPA/CPRA)
If you are a California resident you have the right to know what personal information we collect and how we use it, to request deletion, to request correction, to request a portable copy, and to not be discriminated against for exercising these rights. You also have the right to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information — we do not sell or share personal information for advertising, and we do not use sensitive personal information for any purpose other than providing the app, so there is nothing to opt out of. The categories of personal information we collect are described in Section 2; the purposes in Section 4; the recipients in Section 6.
Washington, Nevada, and Connecticut consumer health data
Washington's My Health My Data Act, Nevada's SB 370, and the Connecticut Data Privacy Act give residents specific rights over consumer health data. Because SetLift collects information about your body, injuries, and physical activity, those laws apply to us. Your rights under them — including the right to withdraw consent and to have consumer health data deleted — are described in our separate Consumer Health Data Privacy Notice.
Other states
Residents of states with comprehensive privacy laws — including Colorado, Virginia, Utah, Texas, Oregon, Montana, and others — have rights to access, correct, delete, and obtain a copy of their personal data, and to appeal a denied request. Email privacy@setlift.app to exercise them or to appeal.
13. International users
SetLift is operated from the United States and your data is stored there. If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR including access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Our legal bases for processing are performance of our contract with you (operating the app), your consent (for optional features such as progress photos and phone discoverability), and our legitimate interests (security and abuse prevention). Contact privacy@setlift.app to exercise these rights.
14. Children and teens
SetLift is not intended for anyone under 13. We collect date of birth at onboarding and do not knowingly create accounts for users under 13. If we learn that we have collected data from a child under 13, we will delete it promptly — email privacy@setlift.app if you believe this has happened.
If you are between 13 and 18, please review this policy with a parent or guardian. Some jurisdictions require parental consent for users under 16; where that applies, we will obtain it before processing.
15. Changes to this policy
We will update this page when our practices change and revise the "last updated" date above. If a change is material — for example if we added analytics, changed what we send to a third party, or began processing data for a new purpose — we will notify you in the app or by email before it takes effect.
16. Contact us
Questions, requests, or concerns about privacy:
- Email: privacy@setlift.app
- Support: support@setlift.app