Privacy Policy

Fibral is a strength-training logger and coaching app. This policy covers the Fibral mobile app, this web dashboard, and the API behind them.

The data controller is [To be completed: legal entity name and company number] of [To be completed: registered address]. You can reach us at [To be completed: privacy contact email address].

Almost everything here is something you typed or something you logged. Fibral does not buy data about you, and it does not track you across other apps or websites.

• Account. Your email address, the name you give, and a password stored only as a hash. Optionally your sex and birth year, which are used to place your lifts against strength standards. If you sign in with Google or Apple, we store the account identifier and tokens that provider returns instead of a password.
• Sign-in sessions. A session token, its expiry, and the IP address and browser or device user-agent of the sign-in.
• Training data. Your workouts and every set in them: exercise, load, reps, reps in reserve, timestamps, and which programmed day they belong to. Your programs and their version history, tracked lifts, training-max changes, skipped and completed days, and your body-weight log with dates.
• Preferences. Units, time zone, rest timers, effort scale, available plates and bar weight.
• What you tell the coach. Your intake answers: training days per week, which weekdays, how long a session can run, the equipment you have, your experience, your goals and target lifts, any target date, exercises you like and dislike, your maxes, your body weight, your injuries and physical limitations in your own words, any free-text notes, and any existing program you paste in.
• The lifter context document. A page of prose the coach maintains about you so it does not forget what you said. It is written by the model, and you can read and rewrite it at any time.
• Coach conversations. Every message you send the coach and every reply, kept on the thread.
• AI run records. For each program generation, coach turn or substitution: the inputs it was given, the internal tool calls it made and what they returned, and the program or reply it produced. These exist so a bad recommendation can be investigated rather than guessed at.
• Usage counts. How many AI calls and tokens your account used this month, so the service can enforce its limits. Counts only, no content.
• Subscription state. If and when Fibral is sold as a subscription: your entitlement, its status and expiry, which store it came from, the product identifier, and the event record the store’s billing provider sends us. Fibral never sees or stores your card details; the app stores handle payment.
• Two activation timestamps. When you signed up and when you logged your first ever set. Nothing about the set itself.

Some of what Fibral holds is health and fitness data, and it is treated as the sensitive category it is. Specifically: your body weight and its history, your sex and age, the loads and efforts you lift, and the injuries, pain and physical limitations you describe to the coach.

It is collected for exactly one purpose - producing and adjusting your training program, and answering your questions about your own training. It is not used for advertising, it is not sold, and it is not shared with anyone outside the processors listed below.

Where the law treats this as a special category of personal data, we rely on your explicit consent, given by entering it or by connecting Apple Health. You can withdraw that consent by deleting the entries, disconnecting Apple Health, clearing the relevant lines from your context document, or deleting your account.

Fibral’s coach runs on OpenAI’s API. It is the only model provider Fibral uses. Requests are made from Fibral’s servers, never from your phone or browser directly.

What is sent. Depending on what you are doing, a request can contain your intake answers, your lifter context document, a summary of your logged training (session counts, how often you train, typical session length, the equipment that appears in your log, your estimated one-rep maxes and the sets they were estimated from, and your most-used exercises), your body weight and its trend, your injuries and pain notes in your own words, any program text you pasted in, and the messages in the coach conversation.

What is never sent. Your name, your email address, your password, your account identifier, your IP address, your device details, your location and your time zone are not placed in any prompt and are not attached to any request. The request carries no field that identifies you to the provider. Your sex and birth year are read on our side to compute a strength level, and it is that computed level, not the two values, that the model sees.

Free text is sent as you wrote it. Fibral does not redact or anonymise the words you type. If you put your name, your gym, your coach, your medical history or anything else identifying into a note, an injury description or a chat message, it is sent exactly as written. If you would rather it did not leave, do not type it.

Research papers in Fibral’s science library are processed through the same provider when they are ingested. That path handles published literature only and carries no user data.

Fibral is deliberately built on a short list. Each of these is a processor acting on our instructions, not a party we sell anything to.

• Railway hosts the API, this website, and the Postgres database and Redis instance behind them. In practice this is where your data lives.
• OpenAI runs the model, as described above.
• Cloudflare sits in front of the API as a network shield and, on the sign-up form, provides the Turnstile human check. It receives your IP address and basic request metadata, and for the human check, signals about your browser. Turnstile is designed not to fingerprint or track you across sites.
• Resend sends account email such as address verification and password reset. It receives your email address and the contents of that message.
• RevenueCat reconciles subscription state with the app stores. It receives an account identifier and the store’s billing events. It does not receive your training data.
• Apple and Google handle app distribution and payments, and provide sign-in if you choose it. Their handling of a purchase is governed by their own policies, not this one.
• Sentry, when enabled, receives crash reports. Those reports carry an error type, a redacted message and a stack trace, and deliberately carry no user identifier, email, cookie, request header or request body.
• A product-analytics endpoint, when enabled, receives counts of things like “an intake turn happened”. Your account appears in those events only as a truncated one-way hash of your user id, and no content is included. [To be completed: name the analytics vendor once one is chosen, or delete this bullet]

Fibral’s research library is built from public scientific sources (Europe PMC, Crossref, Unpaywall and PubMed Central). Nothing about you is sent to them.

We will disclose your data to someone else only where we are legally required to, or where it is necessary to establish or defend a legal claim. If Fibral is ever sold or merged, your data may transfer with it, and you will be told before that happens.

Fibral uses one cookie: the session cookie that keeps you signed in. It is set by the API when you sign in and cleared when you sign out.

There are no advertising cookies, no analytics cookies, no third-party tracking scripts, and no pixels. The fonts on this site are served from our own domain, so loading a page does not tell anyone else you were here.

• Your account and training data are kept for as long as your account exists. Your training history is the point of the product, so nothing in it is aged out or deleted on a schedule.
• Coach conversations, intake answers and AI run records are kept for as long as your account exists, because the coach reads its own history to stay consistent with what it already told you.
• Your timeline. Fibral keeps a timeline of every change made in the app, by you, your coach or your other devices, including the values before and after each change, so you can see and restore your history. It is kept for as long as your account exists, included in your data export, and deleted with your account. Deleting a workout, a body weight entry or a line of your notes leaves its record on your timeline until you delete your account.
• Sign-in sessions expire on their own and are removed.
• Everything is deleted when you delete your account, as described below.
• Database backups lag deletion by their own retention window: [To be completed: backup retention period at the database host]. Deleted data disappears from backups when that window rolls over.

You can delete your account yourself, from Settings in the app or from Settings on this dashboard. No email, no support ticket, no waiting.

Deletion takes two steps on purpose: confirming issues a short-lived, single-purpose token that the delete request must carry, so one stray or forged request can never wipe an account.

Deleting your Fibral account does not cancel a subscription bought through Apple or Google. Cancel that in the App Store or Play Store, or it will keep billing.

You can export everything Fibral holds about you as a single machine-readable file, from Settings. It contains your own rows - workouts, sets, programs, body weight, settings, intake answers, coach messages and your context document - and it lists anything deliberately left out, so an absence is visible rather than silent.

Export is available on the free tier. It is not a paid feature and it is not rate-limited beyond what stops it being abused.

Depending on where you live, you have some or all of the following rights. Where a right can be exercised in the product, it is, because a right you have to email someone about is a right with friction on it.

• See what we hold. Export, above. The context document - the one piece of your record that Fibral wrote rather than you - is readable in the app in plain prose, along with a log of when each line was written.
• Correct it. Training data is editable in the app. The context document is directly rewritable: if the coach believes something wrong about you, you fix the sentence.
• Delete it. Account deletion, above.
• Take it elsewhere. The export is a structured file, not a PDF.
• Object or restrict. Contact us and we will act on it.
• Complain. You can complain to your data-protection authority: [To be completed: lead supervisory authority, if one applies].

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. There is nothing to opt out of, because it does not happen.

To exercise anything that is not a button in the app, write to [To be completed: privacy contact email address]. We will respond within [To be completed: response window, e.g. 30 days].

For anyone covered by the UK or EU GDPR, the legal bases are:

• Performing our contract with you - your account, your training data, your programs, and the coach. Without these there is no product.
• Your explicit consent - the health data described above.
• Our legitimate interests - keeping the service up and secure, stopping automated account creation and abuse, and understanding at an aggregate level whether new users get to their first workout.
• Legal obligation - tax and accounting records for purchases.

Our processors are located in [To be completed: list of processing regions]. Where data leaves the UK or EEA, the transfer relies on [To be completed: transfer mechanism, e.g. Standard Contractual Clauses].

Traffic is encrypted in transit. Passwords are stored hashed, never in plain text. Every query that reads training data is scoped to the account that owns it, and the API refuses to start in production with a default secret in place. The public API sits behind a network shield, and account creation is rate-limited per address with a human check.

None of that is a guarantee. No service can promise a breach will not happen. If one does and it affects you, we will tell you and the relevant authority as the law requires.

Fibral prescribes training loads and is not designed for children. It is not intended for anyone under 16, we do not knowingly collect data from anyone under 16, and if we learn that we have, we will delete the account. If you believe a child has signed up, write to [To be completed: privacy contact email address].

When Fibral changes what it collects, what it sends to the model, or who processes it, this page changes with it, and the date at the top moves. If a change materially affects you, we will tell you in the app before it takes effect rather than quietly reposting the page.

Questions about this policy, or about anything Fibral holds about you: [To be completed: privacy contact email address], or by post at [To be completed: registered address].

Our data protection officer or representative, where one is required: [To be completed: DPO or Article 27 representative, or a statement that none is required].