Privacy Policy

Effective: 11 April 2026 · Last updated: 11 April 2026

1. Who we are

STRN ("STRN", "we", "us", "our") provides the STRN workout tracking application (the "App") and related website at strn.app (together, the "Service").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over your data.

If you have any questions, contact us at privacy@strn.app.

2. Information we collect

2.1 Information you provide

• Account information — when you sign in with Google, we receive your email address, display name, and profile picture from Google. You can also use the App as a guest without an account.
• Profile details — name, age, sex, height, training experience and goals, if you choose to provide them.
• Workout data — the exercises, sets, reps, weights, rest times, RPE, notes, and timestamps of the sessions you log.
• Body metrics — bodyweight, body fat %, measurements, and other metrics you enter manually.
• Activity log — non-gym activities (running, cycling, climbing, etc.) with duration and your selected intensity.
• Alcohol log — number of drinks and timestamps, if you choose to record them for recovery tracking.
• Support communications — if you email us, we keep the correspondence to help you.

2.2 Information from wearables you connect

STRN can optionally connect to third-party health services. You control which ones (if any) are linked, and you can disconnect at any time from the Recovery screen.

We only read the data types listed above. STRN also writes completed workouts (duration and estimated calories) back to Health Connect or HealthKit if you grant write permission, so other apps on your device can see your training activity.

2.3 Information collected automatically

• Device and diagnostic data — crash reports, device model, OS version, app version, and anonymized usage events used to diagnose bugs and improve the App.
• Authentication tokens — short-lived tokens used to keep you signed in across sessions.
• Push notification identifiers — if you enable notifications (rest timer, reminders), we store a device-specific token issued by Firebase Cloud Messaging.

STRN does not use third-party advertising SDKs, tracking pixels, or behavioural ad networks.

3. How we use your information

• To provide the App and sync your training data across your devices.
• To compute the recovery model — muscle readiness, CNS fatigue, training load signals, and mesocycle recommendations — based on your logged workouts and (optionally) your wearable data.
• To authenticate you and keep your account secure.
• To send workout-related notifications you have opted into.
• To diagnose crashes, debug issues, and improve reliability and performance.
• To comply with legal obligations and enforce our Terms of Service.

We never sell your personal information. We do not use your workout or health data to train third-party AI models.

4. Legal basis for processing (EEA / UK users)

If you are in the European Economic Area or the UK, we process your data:

• To perform our contract with you — providing the Service you have asked for.
• Based on your explicit consent — for optional integrations such as wearable connections and sensitive health data categories.
• For our legitimate interests — operating, securing, and improving the Service, where those interests do not override your rights.
• To comply with legal obligations where applicable.

You can withdraw consent at any time by disconnecting the relevant integration or deleting your account.

5. How we share your information

We share data only with the following categories of recipients:

• Service providers that host our infrastructure. We use Google Firebase (Authentication, Firestore, Cloud Functions, Hosting, Cloud Messaging) to run the App. Your data is stored on Google's infrastructure under their security controls.
• Integrations you connect. When you link Whoop, we exchange OAuth tokens with Whoop. We do not share your STRN-internal data with Whoop unless you explicitly enable a sync.
• Health Connect / HealthKit. Data exchanged with these platforms stays on your device. STRN never uploads raw Health Connect or HealthKit samples to our servers — we only store computed daily summaries linked to your account.
• Authorities or other parties when legally required. We will disclose personal information if required by law, subpoena, or to protect the rights, property or safety of STRN, our users or the public.
• Successors to our business. If STRN is involved in a merger, acquisition, or asset sale, your data may be transferred, subject to the same commitments made in this Policy.

We do not share your data with advertisers, data brokers, or marketing networks.

6. International transfers

Your data may be processed in countries outside your own, including the United States (Firebase's default region). Where personal data is transferred out of the EEA, UK, or other jurisdictions with data-transfer restrictions, we rely on the safeguards provided by our service providers (for example, Google's Standard Contractual Clauses).

7. How long we keep your data

• Account and training data — for as long as your account is active. If you delete your account, we delete your data from our production systems within 30 days and from backups within 90 days.
• Wearable data summaries — the most recent 14 days are used by the recovery model. Older summaries are retained for your history unless you delete them.
• Diagnostic logs — retained for up to 90 days, then deleted or fully anonymized.

8. How we protect your data

We use industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest on Google's infrastructure, role-based access controls, and Firebase security rules that restrict each user's reads and writes to their own data. No system is perfectly secure — if a breach affects your data, we will notify you as required by law.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate data;
• Delete your account and your data;
• Export your data in a portable format;
• Withdraw consent for optional processing;
• Object to or restrict certain types of processing;
• Lodge a complaint with your local data protection authority (for example, the UK ICO, a European DPA, or the Australian OAIC).

Most of these actions can be done from the Profile screen in the App. To submit a formal request, email privacy@strn.app. We respond within 30 days.

10. Children

STRN is not directed at children under 13 (or under 16 in the EEA/UK). If you are under that age, please do not use the App. If you are a parent or guardian and you believe your child has provided personal information to us, contact privacy@strn.app and we will delete it.

11. Sensitive data

Some of the data you can record in STRN — including heart rate, HRV, sleep, bodyweight, and alcohol consumption — may be treated as sensitive health information in your jurisdiction. We process this data solely to provide the recovery and training features you have asked for, and only with your consent. You can disconnect any wearable, remove any log entry, or delete your account at any time.

12. Third-party links

The App may contain links to third-party services (for example, the Whoop OAuth flow or the Hyrox results website). We are not responsible for those services' privacy practices — please review their policies separately.

13. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App and update the "Last updated" date at the top. Continued use of the Service after changes become effective means you accept the revised Policy.

14. Contact us

Questions, requests, or complaints? Email privacy@strn.app.