Lifterclub privacy policy
Version 2026-11-13.1-draft. Effective date: not yet in effect.
Draft. This policy is not yet in effect, and may change before it is. It has not been reviewed by a lawyer.
Lifterclub is a workout and food log. You can log by typing a sentence in the app or by telling an AI assistant you've connected. This policy says what we collect, why, who else handles it, how long we keep it, and what you can do about it. It also says where the service doesn't yet do something you might expect.
The short version:
- Your workouts and meals are treated as health data, and we store them only with your explicit consent.
- We don't sell your data, we don't show ads, and we don't use third-party analytics.
- When you log by sentence, the text goes to Google's Gemini model to be read. So does a meal photo you choose to send, which we never store.
- You can download your log from Settings and delete your account from your account page, whenever you like. See how.
1. Who is responsible for your data
Lifterclub is run by Virtual Vendors LLC, which is the controller of your personal data under data protection law.
- Postal address: Virtual Vendors LLC, PO Box 007, Butler, MO 64730, USA
- Privacy contact: privacy@lifterclub.com
Lifterclub is offered to people in the United States. We don't offer it in the European Economic Area, Switzerland or the United Kingdom, and we have no establishment or representative there. If you use it from there anyway, we'll still honour the rights in section 10.
2. What we collect
| What | Details | Where it comes from |
|---|---|---|
| Account | Email address, name, Google account ID, year of birth, units, time zone, calm mode setting | Google, when you sign in, and you |
| Workouts (health data) | Exercises, sets, reps, loads, effort ratings, durations, distances, dates and times, titles, notes, personal records worked out from these, the words you used for an exercise, which app or assistant logged each workout, and, for an app that keeps its own copy, its ID for the record | You, apps you connect, and files you import |
| Programs you follow (health data) | Which library program you're following and since when, the version, exercises you swapped, starting weights you enter, any of your routines you use with it, which workouts you said were part of it, and programs you asked not to be suggested. We compare those workouts with the plan and work out suggested weights when you look, and store neither. Suggesting a program from your workouts uses a fixed calculation on your own server-side data: nothing goes to an AI model for it | You and apps you connect |
| Training profile and routines (health data) | Goals, equipment, injuries or limitations, training days, saved routines, and exercises you create | You and apps you connect |
| Meals (health data) | What you ate, the words you used for it, the food it was matched to, how much (and your part of a shared dish), when, the time zone you ate in, when it was logged, titles, your own name for the meal and notes, who recorded it (you, a professional on your behalf, or an app), how sure an app said it was of an item, the nutrition values counted from the food, which app or assistant logged each meal, and the words you taught to mean a food. Nutrition values come from the public food catalogue and foods you add. A meal described in a sentence, or shown in a photo you choose to send, goes to Gemini to be read; nothing else about a meal goes to an AI model. We never store the photo, and the foods and amounts read from it are marked as estimates until you change them. A packaged food you log by its barcode is named by the barcode, with the name and values Open Food Facts gave | You and apps you connect with access to your meals |
| Nutrition targets (health data) | The targets you set yourself: a nutrient, a minimum, maximum or amount to aim for, per day or per meal, the days they apply, who set them (you, a professional you work with, or an app's suggestion you accepted) and any note. We work out from your meals whether each was met, under or above when you or an app asks; that isn't stored. We never set or suggest a target | You and apps you connect with access to your meals |
| Foods you add | The name, nutrition values and serving sizes you enter for a food of your own, from its label. Only you see it. It isn't a record of what you ate | You and apps you connect with access to your meals |
| Imported files | Exports from other apps (Strong, Hevy, Strava, Garmin and others), their file names, and a preview of what's in them | You |
| Consent records | Which consent you gave, its version, and when you gave or withdrew it | You |
| Connections | Apps you've allowed and the permissions you gave them; names of your personal keys, and when they were created and last used. Keys, tokens and session secrets are stored only as hashes | You and those apps |
| Technical data | Browser description (user agent), when you were last active, network address, the addresses requested, and error details | Your device |
Goals, limitations and notes are free text, so please only write what you're happy for us to store. We don't ask for your photo, and the service doesn't send email.
On your device: a session cookie keeps you signed in for up to 30 days, and a short-lived cookie protects the Google sign-in step. Your browser also stores your name, email address and units, so the app opens without signal, your live workout and unsent sets, so they survive losing signal, and import progress and a few display choices. Signing out clears these from the browser. We use no advertising or tracking cookies.
3. Why we use it, and our legal basis
If you're in the EEA or UK, the GDPR requires us to name a legal basis for each use.
| Purpose | Legal basis |
|---|---|
| Storing and showing your workouts, profile, routines and the programs you follow; working out records and progress; reading your sentences and meal photos; importing files; giving connected apps what you've allowed | Your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)) |
| Showing how many people follow a library program, as a rounded public number, if you opt in | Your separate explicit consent, "Count me in this program's public total" (Art. 6(1)(a) and Art. 9(2)(a)), which you can withdraw at any time |
| Running your account: sign-in, settings and connected apps | Providing the service you asked for (Art. 6(1)(b)) |
| Checking you're old enough | Providing the service (Art. 6(1)(b)), and our legitimate interest in keeping children's data out of it (Art. 6(1)(f)) |
| Security, limiting abuse, fixing faults, suspending accounts, and keeping an audit log of staff actions | Our legitimate interest in keeping the service safe and working (Art. 6(1)(f)) |
| Counting totals to run the service: sign-ups, workouts and imports per day, and how often the AI step succeeds. These hold no text or user IDs | Our legitimate interest in running the service (Art. 6(1)(f)) |
| Meeting legal duties | Legal obligation (Art. 6(1)(c)) |
We don't make decisions about you by automated means that have legal or similarly significant effects. Gemini only turns your words, or a meal photo you send, into structured data. Every number it returns from your words must appear in what you wrote; what it reads from a photo is shown to you as an estimate, and nothing is saved until you check it.
4. Health data and your consent
Workout and meal logs can reveal things about your health, so we treat them as special-category data under GDPR Article 9. When you first sign in, we ask for your explicit consent in a checkbox that is off by default. We record the version you agreed to and when. The current version is 2026-11-12. Version 2026-11-09 was the first to name meals, and 2026-11-12 the first to name meal photos: if you agreed to an earlier one, we ask again before you log a meal or send a photo, and what your consent already covers carries on meanwhile.
Without consent your account still works, but it stays read-only: nothing can be logged, parsed or imported, and health-related profile fields can't be changed.
You can withdraw at any time on your account page, which is as easy as giving consent. Here's what happens when you do:
- Logging, sentence reading and imports stop, and you can still read and delete what's there.
- Imports waiting to run are stopped.
- Your existing data is not erased automatically. If you also want it gone, delete your account.
- Withdrawing disconnects every app and revokes every personal key. You can still read and export your own log in the app, and you'd reconnect them after allowing it again.
- It doesn't undo anything done before you withdrew.
Being counted in a program's public total is a separate choice, off unless you turn it on, on the program's page or in Settings. Turning it off, or withdrawing health-data consent, takes you out at the next weekly update.
5. Who else handles your data
Lifterclub uses one sub-processor, Google, which handles data for us under its Google Cloud terms and its Cloud Data Processing Addendum. The developer sandbox at lifterclub.runmighty.dev also uses DigitalOcean, under its terms and Data Processing Agreement, to run its service and hold its database.
| Service | What it does | Where |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Cloud Tasks, Cloud Scheduler, Secret Manager, Cloud Logging) | Hosts the service, database, uploaded files and logs | United States (Iowa, us-central1) |
| DigitalOcean (Droplets, Managed PostgreSQL), developer sandbox only | Runs the sandbox's service and holds its database and logs. Its uploaded files and Gemini stay at Google | United States (New York, nyc3) |
| Gemini on Google's Vertex AI | Reads workout and meal sentences, meal photos you send and pasted training plans, and turns them into structured data | Any Google region (we use Google's global endpoint) |
What goes to Gemini: only the text you type or paste into sentence logging (of a workout or a meal) or routine parsing, or that an app or assistant sends to be read as a sentence (such as the log_text and log_meal_text tools, or a sentence sent to our nutrition agent), plus our fixed instructions. We don't add your name, email, account ID or history. Whatever you write is sent as written, so a name or an injury in your sentence goes too. Forms, gym-mode sets, imports, assistants' structured logging and meals logged item by item don't use Gemini.
Meal photos: a photo you send from the Food page, or that an app, assistant or AI agent sends for you (such as the log_meal_photo tool or our nutrition agent), goes to Gemini with any words you add and our fixed instructions. The app shrinks it on your device first. Our server holds it in memory while Gemini reads it, then drops it: we don't store it, log it or put it in your export. To answer a repeated request without reading the photo twice, we may keep a fingerprint of it (a hash, from which the photo can't be rebuilt) for a day. Whatever the photo shows goes to Gemini too, so leave out faces, papers and anything else you don't want sent. A photo can only be sent under the consent that names photos.
What Google does with it: Google's terms say it won't use this data to train its models without permission. Google can cache requests and responses for up to 24 hours to answer faster; we've turned that caching off for Lifterclub. It's still on in the developer sandbox at lifterclub.runmighty.dev, which shares its Google Cloud project with other apps. Google may also keep some data for limited periods to monitor abuse, so we can't promise zero retention at Google.
Barcode lookups: when you or an assistant look up a packaged food by its barcode, our server asks Open Food Facts, an open food database, for that product. Only the barcode is sent, from our server, so Open Food Facts doesn't learn who asked. Scanning one in the app uses your camera on your device: the picture never leaves it, only the digits read from it. It isn't our sub-processor: it holds nothing of yours. We keep its answer in memory for up to an hour, and in your log only in a meal you log with it.
Google sign-in: when you sign in, Google tells us your email address, name and account ID, and that your email is verified. Google acts for itself in this step, under its own privacy policy.
6. Connected apps and AI assistants
You can connect AI assistants and other apps over our MCP server, REST API or nutrition agent (A2A, for other AI agents), either by approving them on a consent screen or with a personal key you create. These apps aren't our sub-processors. You choose them, and they use your data under their own terms. Anyone can register an app, and we don't review them, so only allow ones you trust.
- Depending on the permissions you approve, an app can read and change your workouts, meals and profile. MCP connections and personal keys can do all of it, or only read; meals need the consent that names them before anything can log one.
- An AI agent you connect to our nutrition agent reaches your meals and foods only, never your workouts or profile. Each piece of work it hands us is a task holding its messages and our replies, which we keep for 24 hours after the task last changed so it can follow up (section 8).
- Once an app has read your data, what it does with its copy is up to its own policies. Disconnecting stops further access, but we can't recall or delete that copy.
- You can see connected apps and keys, disconnect apps and revoke keys on your account page. Each workout and meal records which app logged it, and your activity page shows every call each app and key made in the last 90 days, deliveries included.
- An app you've connected can ask to be told when your log changes. We then send it, at the address it gave, the kind of change and the record's ID, never the content, until you disconnect the app or withdraw consent.
- We don't yet give you a log of what each app read or changed, or when.
We share your data with nobody else, except where the law requires it, or to a successor if the business is ever sold. In a sale, this policy would continue to apply until you're told otherwise.
7. What our staff can see
A small number of named administrators can use an admin console, which requires a recent Google sign-in. It shows account information, not the contents of your log:
- Shown: your email and name; sign-up and last-seen dates; account status and role; your consent's version and date; browser descriptions and dates of your sessions; names and dates of your keys and connected apps; how many workouts and imports you have, the date of your latest workout, and each import's source, status, counts and error category.
- Not shown: workouts, sets, notes, profiles, goals, routines, which programs anyone follows, file names or import previews. Automated tests check this.
- The one exception: an exercise name nobody recognised is shown to help improve the catalogue, but only once five or more different people have typed the same words, and never with who typed it.
Administrators can suspend accounts, end sessions and revoke keys and connected apps. Every change made in the console, and every look at one person's details, is recorded in an audit log that can't be edited. The log holds IDs, the action taken and any reason given, but no email addresses.
The console isn't the only technical route to the data. People who administer our Google Cloud project could reach the database directly, and the audit log above doesn't cover that. We only do so when it's needed to keep the service running, to act on your request, or to meet a legal duty.
8. How long we keep it
| Data | How long |
|---|---|
| Account, workouts, meals, foods you add, nutrition targets, profile, routines, programs you follow and consent records | Until you delete your account |
| A meal you delete | Hidden from you and every app straight away; you can restore it for 10 minutes. It's kept in the database, and in your export, until your account is deleted. Ask us if you want it erased sooner. A meal item you delete is removed straight away |
| A workout you delete | Hidden from you and every app straight away, but kept in the database until your account is deleted, when it's erased with everything else. Ask us if you want it erased sooner |
| A set or exercise you delete | Removed from your log straight away. A copy stays in an undo record for 10 minutes, and that record is cleared within a day |
| Uploaded import files | Deleted when the import finishes, fails or is cancelled. Unfinished previews are cancelled after 24 hours, and anything left is removed from storage after 8 days |
| Import records (file name, preview, totals) | Until your account is deleted |
| Saved results of recent writes (used to avoid duplicates) | 24 hours, then cleared within a day |
| Nutrition agent tasks (the messages an AI agent sent our nutrition agent and our replies, including the meal logged) | 24 hours after the task last changed, then cleared within a day. Gone with your account. The meal itself stays in your log |
| Sign-in sessions and app tokens | Sessions expire after 30 days, access tokens after 1 hour and refresh tokens after 30 days. Expired records are cleared within two days |
| Sign-in rate-limit counters (keyed by network address) | Cleared after about a day |
| Server logs | 30 days. They can include network addresses and the addresses requested. We don't log what you logged |
| Database backups | 14 days (7 in the developer sandbox) |
| App activity log (which connected app or key made which call, naming which record, and when; never what it read or wrote) | 90 days, then deleted within a day. Gone with your account |
| Admin audit log | 2 years, then deleted within a week. It stays after an account is deleted, with only an unlinked ID left |
9. International transfers
Lifterclub is run from the United States and your data is stored there, so if you use it from elsewhere your data leaves your country. Sentences and photos sent to Gemini can be processed in any region where Google operates. US law may not protect your data in the same way as the law where you live.
Because we don't offer Lifterclub outside the United States (section 1), we don't rely on a transfer mechanism such as the EU-US Data Privacy Framework or standard contractual clauses. If that changes, we'll update this section before we offer it anywhere else.
10. Your rights and how to use them
Everyone can do the following, wherever they live:
| To | Do this |
|---|---|
| See your data | Look in the app, or read it through the API or a connected app |
| Correct it | Edit workouts, meals and your profile in the app. Ask us about anything you can't edit |
| Withdraw consent | Use your account page |
| Disconnect an app | Use your account page |
| Get a copy of your data | Download your log from Settings in the app, free, as often as you need (up to 10 times an hour): as JSON in the Open Workout Schema, with your routines, profile, program runs, meals, the foods you've added, your nutrition targets, imports, consent history and the workouts and meals you've deleted, or as a spreadsheet (CSV) of the sets you've logged |
| Delete your account and everything in it | Use your account page. You'll confirm it's you with Google and type your address. It happens straight away and can't be undone |
To write to us, use privacy@lifterclub.com, or write to the postal address in section 1. Please write from the email address on your account, or we may need to check it's really you. Requests are free, and you won't be treated differently for making one. If your account is suspended you can't sign in to do these yourself, so write to us. Deleting your account erases it from our database at once, including workouts you'd deleted, and you see a confirmation on screen. Copies in backups age out within the backup period above, any import file left in storage within 8 days and server logs within 30. Only the admin audit log stays, with an unlinked ID and no address (section 8).
If you're in the EEA or UK, you also have the right to access, correct, erase, restrict or move your data, and to object to uses based on legitimate interests. We'll answer within one month, or tell you why we need longer. You can complain to your local data protection authority; in the UK, that's the Information Commissioner's Office.
If you live in a US state with a privacy law, you may have similar rights to access, correct, delete and move your data and to appeal our decision. Use the same contact address.
11. Consumer health data: Washington and similar state laws
This section is our consumer health data privacy policy under Washington's My Health My Data Act, and it also applies to people covered by similar laws such as Nevada's.
- What we collect: workouts, personal records, meals, the foods you add and your nutrition targets, your training profile (including goals and injuries or limitations), routines, imported activity data, and anything health-related you write in notes.
- Why: to store and show your training and food log, work out your records and progress, read your sentences and meal photos, import your files, and give connected apps what you allow. We don't use it for advertising.
- Public program totals: if you opt in, you're counted in a program's public follower number. We show no number below 50, round every number down (50, 100, 500, 1,000, 5,000+) and update it weekly, so the number doesn't reveal whether any one person follows a program. We count only people who opted in and logged a workout for the program in the last 90 days.
- Where it comes from: you, apps you connect, and files you import.
- What we share, and with whom: the data above, only with apps you choose to connect and at your direction. Google handles data for us as a processor. We have no affiliates that receive it, and we do not sell it.
- Your rights: to confirm whether we hold your data and access it, including a list of everyone we've shared it with; to withdraw consent; and to have it deleted, including by those handling it for us. Use the methods in section 10; you don't need a new account to make a request.
- Timing: we'll respond within 45 days. If we need up to 45 more, we'll tell you why within the first 45. Backups are cleared within the period in section 8.
- Appeals: if we decline a request, you can appeal by writing to the same address, and we'll reply in writing within 45 days. If we deny your appeal, you can complain to the Washington Attorney General.
12. Minimum age
You must be 16 or older to use Lifterclub. We ask for your year of birth when you sign up, and don't verify it. Because we only ask for the year, someone turning 16 later this year can join. If you're too young we won't complete your sign-up, but the email address and name Google gave us stay on an unfinished account until it's removed. If you think a child has signed up, write to us and we'll delete the account.
13. No sale, no ads
We don't sell your personal data or share it for advertising. The service has no ads, ad trackers or third-party analytics.
14. Security
Connections use HTTPS. Keys, tokens and session secrets are stored only as hashes, and the app's requests for your log are limited to your account. Each part of the service runs under its own limited account. No service is perfectly secure, so we can't promise that nothing will ever go wrong. If a breach affects you, we'll tell you and the authorities where the law requires it.
15. Changes to this policy
When we change this policy, we'll publish the new version here with a new version number and effective date before it applies. If we want to collect new kinds of health data or use it for a new purpose, we'll ask for your consent first. We'll add planned features to this policy when they're ready, not before.