Privacy Policy

Last updated: September 24, 2026

UA Strength is a strength training tracker built for students in the Five College consortium. We take your privacy seriously. This policy describes what data we collect, how we use it, and the choices you have.

Data We Collect

• Account information: You sign in with Apple or Google. For a Google sign-in we store your Google account's ID and email address. For an Apple sign-in we store your Apple account's ID (not your Apple email address) and, once you confirm you're eligible for the pilot, the college email address you confirmed; if you used an invite code instead, we keep a record of which code you used and when.
• Workout data: The workouts, exercises, sets, reps, weights, rest times, velocity measurements, and the name of the gym you record a session at, if you record one. This data is synced to our server so you can access it across devices and on this website.
• Nutrition data: Food and supplement entries you log, including name, timestamp, and macro/dose values.
• Meal photos: If you log a meal from a photo or a written description, the photo or description is sent to our server, which asks a third-party AI model (currently OpenAI's) what is on the plate. Before a photo leaves your device, the website and the iPhone app both resize and re-encode it, which strips its location and other camera metadata; at most the day it was taken goes with it. We delete the photo, the description, and the model's estimate from our server after 7 days, and they leave our backups as those expire (see below). Nothing is added to your food log until you confirm it.
• Biometrics: The weight, height, birth date, and sex you enter, used to calculate your basal metabolic rate for the energy balance. They sync to our server with the rest of your data.
• Music (optional): If you connect Spotify, the app reads only the track that is currently playing, at the start and end of each set, and saves with that set the track's Spotify ID, title, artist, album, length, how far into it you were, and whether it was playing. These sync with the rest of the workout. Your Spotify connection stays on the device that made it and is never sent to our server.
• Apple Health data: If you allow it, we read workout summaries (type, duration, calories burned, distance), active energy burned, body mass and height, sleep analysis, resting heart rate, and heart rate variability. Those are the only Health types we ask for, and we read them only — UA Strength never writes anything back to Health.
• Friends (optional): Friends you add see a name taken from the email address on your account (the part before the @). If you also turn on sharing, they see your top set for each exercise (the exercise, weight, and reps) from your workouts in the last 90 days, and the date you last trained.
• Agents and connected apps (optional): If you create an API key or connect an app through OAuth, such as an AI assistant, whoever holds that key or connection can, within the access you gave it, read your data and add, change, or delete food and supplement entries, until you revoke it. Every change it makes is recorded on your agent activity page.
• Usage metadata: Timestamps and sync version numbers associated with your records for conflict resolution and ordering.
• IP addresses: Our server logs the IP address of each request it receives, and uses it to limit how often requests can be made.

We do not collect your GPS or other precise location, contacts, photos other than the meal photos you choose to send, browsing history, or any Apple Health data beyond the types listed above. We do not use third-party analytics or advertising SDKs.

How We Use Your Data

• To provide your workout history, charts, and cross-device sync.
• To authenticate you and secure your account.
• To email you a code when you confirm a college address for the pilot.
• To suggest what is in a meal photo or description you send, as described above.
• To show friends what you have chosen to share with them.
• To limit how often requests can be made, so the service stays available.

Who Else Handles Your Data

We do not sell or rent your data. These service providers handle parts of it for us, only for the purpose listed:

• DigitalOcean hosts our server and database, so everything stored on our server is on their machines.
• OpenAI analyses the meal photos and descriptions you send, to suggest what is in them. We send them with storage turned off (store: false), so OpenAI does not keep them as saved responses.
• Brave Search receives a search query, such as a product name, when the AI model looks up a packaged food that isn't on the dining hall menu. The model writes the query from what it sees in your meal; your photo, your account, and your description as you wrote it are not sent.
• Resend delivers the email with your eligibility code, so it receives your college email address and the code.
• Backblaze stores our nightly backups. They are encrypted before they leave our server, and the key that decrypts them is kept neither on our server nor with Backblaze.

Beyond these, your data reaches only the people and tools you choose, as described above: friends you add, and agents or apps you give access to.

Data Storage and Security

Your data is stored in a PostgreSQL database on our server. Authentication tokens are signed with JWT and stored in your device keychain (iOS) or httpOnly cookies (web). All API traffic uses HTTPS/TLS. Every night the database is backed up: one copy stays on our server for 7 days, and an encrypted copy is kept with Backblaze for up to 31 days.

When you use the app on this website, a copy of your data is also kept in your browser so the app works offline: your records, any changes that haven't reached our server yet, your email address, and, if you connected Spotify, your Spotify connection. Signing out deletes it. If your session ends without you signing out, the copy stays in your browser, and the app can still open it offline, until you sign out, sign in here with a different account, or remove it from the “Your session ended” screen.

Data Retention and Deletion

Your data is retained as long as your account is active. You can delete your account and all associated data at any time from the app (Account → Delete Account) or by contacting us. Deletion is permanent and cannot be undone — everything the account holds is removed from our server at once, including workouts, exercises, sets, reps, nutrition entries, meal photos, biometrics, imported Health data, friends, API keys, connected apps, and authentication tokens, and it leaves our backups within 31 days, as they expire. Two things stay: the record that an invite code was used, with your account removed from it, and our server's request logs, which are not deleted with an account. If your email address was added to the pilot's list of allowed addresses, it stays on that list unless you ask us to remove it.

Your Rights

You have the right to access, export, correct, or delete your personal data. To exercise any of these rights, contact us at the email below.

Children's Privacy

UA Strength is intended for college students and is not directed at children under 13. We do not knowingly collect data from children under 13.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

For privacy questions or data requests, contact: support@ultimate-analysis.com