Privacy Policy

• Account: email address, an optional name, your birth year (year only — never your full date of birth, collected at sign-up for an age check), and a hashed password (we never store your password in plain text).
• Training data: the sets you log — exercise, sets, reps, weight, RPE, and timestamps — plus derived progress, streaks, and achievements.
• Settings: your unit preference and timezone (used to bucket sessions into your local day).
• Leaderboards (only if you opt in): a public display name and the consistency/PR standings derived from your training, shown to other signed-in members.
• Moderation: if you report content, we store the report (what was reported, the reason, and your account as the reporter) so we can review and act on it.
• Security: two-factor settings, and short-lived hashed codes for email/password verification. We log limited technical data (e.g. error events, rate-limit counters) to operate the service.

We do not collect payment information, and we do not run third-party advertising trackers.

To provide and secure your account; to run your log, progress, and gamification (XP, streaks, achievements); to send transactional email (verification, 2FA, and any reminders you enable); and, if you opt in, to compute leaderboard standings. Your birth year is used solely for the minimum-age gate and age cohorts. We never sell your personal data.

We process your data to perform our contract with you (running the service), on the basis of your consent (e.g. leaderboards, optional reminders), and for our legitimate interests in securing and improving the service. You can withdraw consent at any time.

Nothing about you is public by default. Leaderboards are strictly opt-in; only then do your chosen display name, your consistency %, and your personal-record count become visible to other signed-in members. Your raw weights, body data, email, and full logs are never shown to others. We use trusted infrastructure providers (database and email delivery) that process data on our behalf under appropriate safeguards; we do not otherwise disclose your data except where required by law.

We use a single, essential, encrypted session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

We keep your data while your account is active. When you delete your account, your training, gamification, and leaderboard data are removed by cascade. Verification codes are short-lived and deleted as they expire or are used.

You can access and export your training data, correct your details, and delete your account and data at any time from the account page. Depending on where you live, you may also have rights to restrict or object to certain processing and to lodge a complaint with a supervisory authority. To exercise a right we can't self-serve, contact us at the address below.

Passwords are hashed with bcrypt; 2FA secrets are encrypted; verification codes are stored only as hashes. We enforce same-origin checks and rate limiting on sensitive endpoints. No system is perfectly secure, but we work to protect your data and to limit what we collect.

We ask for your birth year at sign-up. ScoreFit's public and social features (leaderboards, and later any social features) are not directed to children under 13, and members under 13 are blocked from joining them; the private training log itself remains available. If you believe a child has provided us data in violation of this, contact us and we will delete it.

We may update this policy; we'll revise the date above and, for material changes, notify you in the app. Questions or requests: privacy@scorefit.net.