Privacy Policy
SetsPal is a workout log. It stores the training you record so it survives a new phone, and it uses that history to suggest your next set. This page says exactly what is collected, why, who else sees it, and how to delete all of it.
Last updated 30 August 2026 · Abdulladif Roble · Denmark
1. Who is responsible for your data
SetsPal is operated by Abdulladif Roble, a sole trader based in Denmark. For the purposes of the EU General Data Protection Regulation (GDPR), that is the data controller for everything described here.
Questions, requests, or complaints about your data: support@setspal.app. We answer privacy requests within 30 days, as the GDPR requires.
2. The short version
- There is no analytics SDK, no advertising identifier, no tracking pixel, and no third-party tracker in the app. Nothing is collected to profile you for advertising.
- Your data is never sold, rented, or shared with data brokers or advertisers.
- We do not read your Apple Health data. SetsPal does not request HealthKit access, location, contacts, photos, or your microphone.
- You can delete your account and everything in it from inside the app, in Settings. Deletion is immediate and permanent.
- Card details never reach us. Apple processes every payment.
3. What SetsPal collects
Everything below is data you enter yourself, or data created by using the app. There is no hidden collection alongside it.
| Category | What it is | Why we hold it |
|---|---|---|
| Account | A user ID, plus the email address and name released by Apple or Google when you sign in. If you use Sign in with Apple and choose to hide your email, we only ever see Apple's private relay address. | To identify your account and sync your log to a new device. |
| Profile | Name, date of birth, gender, height, bodyweight and preferred unit — whatever you enter during onboarding or later edit. | To size the training suggestions and to show your numbers in the units you use. |
| Training goals | Your stated goal, experience level, target training days per week, goal weight, target muscle mass and target body-fat percentage, and your chosen reminder day and time. | To build your weekly plan and to schedule the reminders you asked for. |
| Training log | Workouts, exercise names, sets, reps, weights, session start and end times, durations, and any routines you save. | This is the product. It is what the app exists to keep. |
| Body measurements | Bodyweight, muscle mass and body-fat percentage over time, when you record them. | To draw the trend charts in Insights and to keep the series across a reinstall. |
| Subscription status | Whether your subscription is active, when a free trial started, and an identifier from our payments provider. Not your card number, which we never receive. | To unlock paid features and to restore purchases on a new device. |
| Technical logs | Our hosting provider records ordinary server logs — IP address, timestamp, and the request made — when the app talks to the backend. | Security, abuse prevention, and diagnosing faults. Kept short-term by the provider. |
You can use SetsPal before creating an account. In that case the app holds a device-local anonymous session, and your log is stored against an identifier that is not linked to any email or name until you choose to sign in.
4. Health-related data and your consent
Your date of birth, gender, bodyweight, muscle mass and body-fat readings can say something about your physical condition, so we treat them as health-related data under Article 9 of the GDPR. We process them only on your explicit consent, which you give by entering them. Every one of these fields is optional — the app logs workouts without them, and you can clear them at any time in Settings.
Withdrawing consent is as easy as giving it: delete the values, or delete your account. Withdrawal does not affect processing that already happened.
5. Our legal grounds for processing
| Data | Legal basis (GDPR) |
|---|---|
| Account, training log, routines, subscription status | Article 6(1)(b) — performance of the contract. Without this data there is no app to provide. |
| Date of birth, gender, body measurements | Article 6(1)(a) and Article 9(2)(a) — your explicit consent. |
| Reminder notifications | Article 6(1)(a) — your consent, given through the iOS notification prompt and the reminder settings. |
| Server logs, abuse prevention, keeping the service secure | Article 6(1)(f) — our legitimate interest in running a service that works and is not attacked. |
6. Who else processes your data
SetsPal is a small operation and uses a handful of established providers to run. Each acts as a processor on our instructions and may only use the data to deliver its service to us.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication and server functions — the backend the app talks to. | Everything in section 3 that is stored on the server. |
| Apple | Sign in with Apple, App Store payments, and delivery of notifications. | Your Apple sign-in identifier and your purchase history. Apple's own privacy policy governs what it does with them. |
| Sign in with Google, if you choose that option. | Only the sign-in exchange. Nothing about your training is sent to Google. | |
| RevenueCat | Manages subscriptions and entitlements across devices. | Your subscription state and a subscriber identifier. No training data. |
| OpenAI | Powers exercise recognition and the training insights described in section 7. | Exercise names and workout history only — see section 7 for the exact boundary. |
Several of these providers are based in the United States. Where your data is transferred outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses, by the provider's certification under the EU–U.S. Data Privacy Framework, or both.
7. What the AI features send, and what they don't
Two features use OpenAI's API. Both are narrow, and it is worth being precise about the boundary:
- Exercise recognition — when you type an exercise we do not already know, the name you typed is sent so it can be identified and matched to the right muscle groups. Only the name is sent.
- Insights and progression — your recent training history is sent so the app can predict today's session, build a weekly plan, and suggest your next weight or rep target. That means exercise names, sets, reps, weights, dates, session durations and your saved routines.
Your name, email address, date of birth, gender and body measurements are not part of either request. Under OpenAI's API terms, data submitted through the API is not used to train its models.
The suggestions that come back are estimates produced by a model. They are not medical or professional advice — see the Terms of Use for what that means in practice.
8. What stays on your phone
- Your sign-in token is kept in the iOS Keychain, encrypted by the system and readable only by SetsPal.
- Workout reminders are scheduled locally by iOS. The reminder text is composed on your device — it is not pushed from a server, and we are not notified when one fires.
- The rest-timer Live Activity runs on your device and shows only the timer.
9. How long we keep it
Your account and its contents are kept for as long as you keep the account. When you delete it, the records above are deleted with it — the training log, routines, body measurements, profile and onboarding answers all cascade from the account row and are removed immediately, not queued for later.
Two things survive deletion, and neither is training data. Apple and RevenueCat keep records of purchases for as long as their own tax and accounting duties require, and our hosting provider's short-term server logs age out on its own schedule.
10. Your rights
Under the GDPR you have the right to ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. Exercising any of these costs nothing and will not degrade the app.
To delete everything, open Settings in the app and choose Delete Account. For anything else, write to support@setspal.app from the address on your account and we will confirm within 30 days.
If you think we have handled your data badly, you are entitled to complain to the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk), or to the supervisory authority in your own EU country. We would rather you told us first.
11. Security
Traffic between the app and the backend is encrypted with TLS. Every table holding your data is protected by row-level security, so a query can only ever return rows belonging to the account that made it. Sign-in tokens are stored in the iOS Keychain rather than in ordinary app storage.
No system is perfect. If a breach ever affects your data, we will notify the Danish Data Protection Agency within 72 hours and tell you directly where the law requires it.
12. Children
SetsPal is not designed for or directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has created an account, write to us and we will delete it. Under-18s should have a parent or guardian's agreement before subscribing.
13. Changes to this policy
If what the app collects changes, this page changes with it, and the date at the top moves. Material changes are announced in the app before they take effect. Continuing to use SetsPal after that means you accept the updated policy.