Privacy Policy

Last updated: September 18, 2026

Rust Strength is operated by Rhett Lindell ("we", "us"). This policy explains what we collect, why, and what you can do about it.

We built this app to collect as little as possible. We do not sell your data, we do not show ads, and we do not use analytics or tracking SDKs.

1. Information we collect

You give us directly

• Email address and password. Required to create an account and sign in. We also use your email address to send you a one-time code to confirm it when you sign up, and another if you ask to reset your password, and for nothing else. Your password is never stored by us in readable form — it is hashed by our authentication provider, Supabase, and we never see it.
• Username and display name. Your account starts with a randomly generated handle (for example lifter_7f3a91). It contains nothing about you. You may change it, and only after you choose your own handle do you become findable by other users.
• Bodyweight (optional). Used only to work out the load on bodyweight and assisted exercises, such as pull-ups or an assisted dip machine. You can leave it blank; assisted exercises then ask for it before you log them.
• Training data. Exercises, weights, reps, how long you held timed exercises such as planks, RPE, sets, workouts, presets, planned sessions, rest days, and the gyms and machines you name.
• Activity data. Activities you log such as runs or sports, their duration, and — only if you choose to enter them — distance, step count, and calories burned.
• Preferences. Units (lb/kg), your target rep range, and the equipment you usually have available.
• Reactions. If you react to a friend's session in the feed, we store which post you reacted to and which reaction you chose.
• Reports you file. If you report another user, we store who you reported, the reason, and anything you type.

Created automatically

• Timestamps. When workouts and activities start and end, so the app can show durations, streaks and history.
• A random account identifier. Used to link your data to your account.
• A record of your agreement. When you accept the Terms and Privacy Policy and confirm your age, we store which version you accepted and when. We store that you confirmed your age, never your date of birth.
• Server logs. Our hosting provider records standard technical information, including IP addresses, to operate and secure the service.

What we do NOT collect

We do not collect your real name, phone number, precise or approximate location, photos, videos, contacts, microphone or camera data, advertising identifiers, biometric data, government identifiers, or payment information.

The only device permission the app can ask for is notifications, and only if you switch on "Alert when rest is over" in your profile. That alert is scheduled on your phone by your phone. No push token or device identifier is created, and nothing about it is sent to us. You can turn it off in the app or in your phone's settings at any time.

2. Health and fitness information

Training data, bodyweight, and calories burned are health-related information. Some state laws — including Washington's My Health My Data Act — treat this category as especially sensitive.

We use it only to run the features you see: showing your history, estimating your one-rep max, suggesting your next weight, and calculating your stats and trophies.

We do not sell it, share it for advertising, or use it for any purpose other than operating the app. It is visible to another person only where you have chosen to share it (see Section 4).

3. How we use information

• To create and secure your account
• To store and show your training history
• To calculate estimated one-rep max and suggest weights
• To calculate stats, streaks, trophies and the weekly body chart
• To run the friends feature you opt into, including the feed and reactions
• To work out your XP, level and badges from the totals above
• To review reports of abuse
• To keep the service working and secure

We do not use your information for advertising, profiling, or automated decisions with legal effects.

4. What other people can see

The social features are opt-in. Until you choose a username and add a friend, nobody can see anything.

• Anyone signed in can search usernames and display names — but only for accounts that have chosen their own handle. Nothing else is visible.
• Accepted friends can see your username, display name, trophies, badges, level, streak, consistency, total workouts, total volume, total reps and sets, total time trained, activity totals, how many friends you have, your per-exercise personal bests, the dates you worked out, and whether you log in pounds or kilograms (so totals can be compared fairly).
• The leaderboard ranks you and your accepted friends by current streak, total weight lifted, workout time, consistency and activity time. It uses only the figures listed above, and only you and your accepted friends appear on it.
• Accepted friends also see a summary of each session in the feed (see below).
• Nobody can see your email address, bodyweight, notes, planned sessions, rest days, or the individual sets inside a workout. Rest days you mark do keep your streak going and count toward your consistency, so those two figures reflect them, but the days themselves are never shown to anyone.

The friend feed

When you finish a workout or log an activity, a summary of it appears in the feed of the friends you have accepted. A summary is:

• the name of the session or activity, and when it happened
• how long it lasted
• total weight moved, sets and reps
• which exercises you did, by name
• how many personal records you set
• for an activity, its distance if you recorded one

The individual sets are never shared — not the weight, reps or RPE of any single set, and not your notes.

Friends can react to a post. You see how many of each reaction a post received, but not who left them.

You can switch this off. In Profile, under "Sharing with friends", turn off "Show my sessions in the feed" and your sessions stop appearing for everyone immediately. The rest of the friends features keep working.

You can remove a friend or block someone at any time. Blocking removes any existing friendship and hides you from each other in search.

5. Who we share with

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

We use two service providers:

| Provider | What it does | What it receives |

|---|---|---|

| Supabase | Database, authentication and hosting | Your account credentials and all app data described above |

| Google (Gmail) | Sends password reset emails | Your email address and the one-time code, only when you ask to reset your password |

Each processes this on our behalf under its own security and privacy terms. We may also disclose information if legally required, or to investigate abuse or protect someone's safety.

We use no analytics, advertising, crash-reporting, or tracking services.

6. Where information is stored

On our provider's servers. On Supabase's hosted infrastructure, in the United States. Data is transmitted over encrypted connections (HTTPS/TLS) and access is restricted at the database level so that, by default, you can only read and write your own rows.

On your own phone. So the app keeps working in a gym with no signal, a copy of your recent training is stored on your device, along with anything you log while offline that has not reached the server yet. That copy lives in the app's private storage, which the operating system keeps separate from other apps and protects with your device passcode. It is deleted when you sign out, when you delete your account, and when you delete the app.

7. How long we keep it

We keep your data while your account exists. When you delete your account, your data is deleted immediately and permanently — see Section 8. The offline copy on your phone is cleared at the same time, and deleting the app removes it too. Backups and server logs held by our provider may persist for a short period afterwards under that provider's retention schedule.

8. Deleting your account and data

You can delete your account from inside the app: Profile → Privacy & legal → Delete account.

This permanently deletes your account, profile, workouts, sets, activities, rest days, presets, planned sessions, gyms, machines, custom exercises, friendships, blocks, badges, reactions you left, and reports you filed. Deleting a workout or activity also removes the reactions other people left on it. It cannot be undone and we cannot restore it.

You can also download everything we hold about you first: Profile → Privacy & legal → Download my data.

If you cannot access the app, email ruststrengthsupport@gmail.com from your account's email address and we will action it.

9. Your privacy rights

Depending on where you live, you may have the right to know what we collect, access a copy, correct it, delete it, and not be discriminated against for exercising these rights. California residents have these rights under the CCPA/CPRA.

We do not sell or share personal information, so there is nothing to opt out of.

The in-app export and delete tools satisfy access and deletion immediately. For anything else, contact ruststrengthsupport@gmail.com. We will not treat you differently for asking.

10. Children

Rust Strength is not intended for children under 13. You must confirm you are at least 13 to create an account. We do not knowingly collect information from children under 13. If you believe a child under 13 has created an account, email ruststrengthsupport@gmail.com and we will delete it.

11. Security

Passwords are hashed by our authentication provider and never stored in readable form. All traffic uses HTTPS/TLS. Database access is restricted per-user by row-level security. Your session, and the offline copy of your training described in Section 6, are stored in the app's private storage on your own device and are cleared when you sign out.

No system is perfectly secure, and we cannot guarantee absolute security.

12. Changes

If we change this policy materially we will update the date above and ask you to accept the new version in the app.

13. Contact

Rhett Lindell

ruststrengthsupport@gmail.com