Privacy Policy

The data controller is TrainDash — see the legal notice for who publishes this site and who hosts it. Contact for any privacy question: support@traindash.app.

Account data: your email address, your name if you give one, and authentication records. Training data: your programs, workouts, sets, loads, effort ratings, personal records and the coaching decisions made for you. Profile data: units, equipment, training days, experience level and your starting numbers.

Health data, only with your explicit consent: your readiness answers (sleep, fatigue, soreness, stress, mood), bodyweight, and anything you tell us about pain — what hurts, where, and how it responds to training.

To run the service you asked for: build your program, adapt each session, show your history, and keep your account secure. The legal basis is the performance of our contract with you, and our legitimate interest in keeping the service safe and working.

Readiness answers and anything about pain are special-category health data. We ask for your explicit consent before storing any of it, we record when you gave it, and you can withdraw it at any time from the app — withdrawal stops future processing and does not affect what was lawful before it.

If you decline, the app still works: the program runs and the logger logs; readiness simply falls back to a more conservative default rather than being personalised to you.

We host in the European Union and use four processors, each under its own data-processing agreement: Neon (managed Postgres, EU region), Vercel (application hosting), Resend (transactional email only: verification and password reset), and Stripe (payments — it receives your email address and payment details, never your training data).

We do not sell your data, we do not share it with advertisers, and the marketing site sets no cookies and loads no third-party resources. The one thing it writes is the contact form below, to us, on our own domain.

Write to support@traindash.app for the current list of processors and the agreements covering them.

The marketing site sets no cookie, loads no third-party resource and runs no analytics script. What it does have is the access log every web server keeps: for each request, the page asked for, the time, the HTTP status, the browser's user-agent string, the referring page if there is one, and the IP address the request came from.

We use it to count how many people read the site and which pages they read, which is our legitimate interest in knowing whether this site is worth writing. The raw entries are stored in the European Union and deleted after 30 days. Once a night they are folded into a daily table of counts — visits per page, per language, per source, per device — which contains no address, no user-agent string and no per-request row, and which we keep. A visitor is counted once per day using a one-way hash of the address, the browser and the date, computed while counting and stored nowhere.

Nothing here is linked to a TrainDash account, and nothing about you is followed from one site to another.

If you write to us through the contact form, we store what you send — your e-mail address, your name if you give one, the topic and your message — so that a person can read it and reply. The legal basis is our legitimate interest in answering the people who write to us.

Alongside it we keep a one-way hash of your IP address and your browser's user-agent string, to stop the form being used to send us thousands of messages. The hash is erased 24 hours after the message arrives; the message itself is deleted after 12 months.

We use your address to answer you and for nothing else: no newsletter, no marketing, and no automatic reply. Writing to support@traindash.app directly reaches the same inbox and stores nothing beyond the e-mail itself.

If you leave your address on the launch page while TrainDash is not yet open, we store that address and which language you were reading, for one purpose: to write to you once, on the day it opens. The legal basis is your consent, given by leaving the address, and you can withdraw it at any time by writing to support@traindash.app — we delete the address the same day.

Alongside it we keep a one-way hash of your IP address and your browser's user-agent string, to stop the list being filled with addresses that are not yours. The hash is erased 24 hours later. The address itself is deleted once the launch e-mail has gone out, and in any case after 12 months.

It is one e-mail. There is no newsletter, no marketing sequence, no automatic reply, and the list is never passed on or used to create an account for you.

For as long as your account exists — a training history is only useful as a history. Delete your account and it goes with it, in cascade.

Access, rectification, erasure, restriction, objection and portability. Two of them are buttons rather than requests: export downloads everything we hold about you as a JSON file, and delete removes your account and its data permanently — both from inside the app, with no email to anyone.

For anything else, write to support@traindash.app. You may also complain to the CNIL (cnil.fr) if you think we have got this wrong.

The date at the top of this page says when this policy last changed. Material changes are announced before they take effect.