Your data.
Your training.

Effective date: 22 September 2026

This policy explains how Train Athlete handles information in its Android app and on this website.

Who is responsible

TRAIN ATHLETE LIMITED, company number 17468775, registered in England and Wales, is the controller for the processing described here. Registered office: 4 Hill Top Road, Newmillerdam, Wakefield, England, WF2 6PY.

Write to TRAIN ATHLETE LIMITED, 4 Hill Top Road, Newmillerdam, Wakefield, England, WF2 6PY. Mark the envelope for Train Athlete Support or Data Protection, as appropriate.

Accounts and Google sign-in

Supabase Auth provides anonymous and Google-linked account identity for authenticated exercise-demonstration access. If you choose Google sign-in, Google and Supabase process the account identifier, email and profile information returned through that connection. Train Athlete stores the session and account summary in app-private storage; it does not receive your Google password.

Google sign-in is not a workout backup. Your local training records are not uploaded by linking an identity. Signing out does not delete those records.

Workouts, profile and progress

Saved workouts, programmes, completed sessions and sets, personal records, goals, notes and your training profile are stored locally on your device. They may include the name, goals and training details you enter. The app calculates progress from available records. The current public-release configuration does not offer remote workout sync.

Health Connect

With the permissions you select, Train Athlete can read supported exercise sessions, distance, speed, heart rate and active calories from Health Connect. Activity identity, timing, source and available summary values may be retained locally; detailed samples can be read when you open an activity insight. With separate write permissions, completed exercise sessions and distance can be written to Health Connect. Written session data can include the title, notes, timing, activity type and device metadata.

Permissions are optional and can be revoked in Health Connect. Disconnecting does not erase already imported local copies or the source record. A separate app control removes imported copies. Source data may be incomplete or unavailable; charts and zones are fitness information, not diagnosis or treatment. The app does not request route/location, sleep or medical-record permissions in the reviewed release manifest.

Private photos and videos

Personal media and its metadata are stored locally. Files may be selected with Android’s picker or captured into app-private storage. Public community upload is disabled in the current release. Personal photos and videos are excluded from manual training backups; copies held elsewhere must be managed separately.

Supabase and demonstrations

Authenticated requests resolve authorised exercise demonstrations through Supabase. The service returns time-limited delivery URLs; downloaded media may be cached in app-private storage. Network and hosting providers process request information needed to deliver and protect those services. Licensed demonstration media is not part of your training backup.

Website and operational data

This website has no sign-up form, advertising tracker, analytics SDK or embedded third-party media. Fonts and images are served with the site. The reviewed Android build has no third-party app analytics or crash-reporting SDK. Hosting, authentication and delivery providers may still handle IP addresses, request metadata and operational logs.

Backup and export

Automatic Android backup is disabled. Through Account → Privacy & Data, you can create a passphrase-protected encrypted training archive using Android’s document picker. It contains saved workouts, programmes, completed training and sets, goals, manual records and the training profile, plus an ownership marker where applicable.

The archive excludes imported Health Connect activities, personal media, active sessions, credentials, provider connections, entitlements and demonstrations. You choose the destination and control exported copies. Saving a file to a cloud drive is manual export, not continuous sync. The passphrase cannot be recovered by Train Athlete.

Hybrid Planner plugin — ChatGPT and Codex

Train Athlete Hybrid Planner is a separate skills-only plugin which can use a user’s stated exercise goal, experience, number of training days, time, equipment, sport emphasis, language, units and voluntary summary of a recurring training week to generate general training plans and review. These details are supplied within the ChatGPT/Codex host, not through this website or the Android app. Do not include your health records, diagnoses, account credentials, precise location or other sensitive personal information.

The reviewed skills-only package has no Train Athlete-operated remote MCP server, prompt collection API, advertising tracker or plugin analytics endpoint. Its optional deterministic script uses supplied planning constraints in the execution environment provided by the host; it does not transmit them to a Train Athlete service. Train Athlete does not independently receive full ChatGPT/Codex conversations merely because someone uses the plugin. The ChatGPT/Codex platform separately processes conversations and may retain them under its applicable notices, terms and account controls. Check your host account’s privacy controls to manage that data.

The plugin does not access mobile app accounts, Health Connect records, exercise logs, photographs or purchases. If you independently contact Train Athlete Support about the plugin, the correspondence you provide is processed for handling that enquiry under the applicable support/rights arrangements described here; do not enclose private prompts or sensitive fitness data. Train Athlete does not operate a plugin-user plan database. Any host-platform storage, retention or deletion is controlled separately by that platform.

Questions or privacy requests about information held by Train Athlete can use the approved support route; questions about information retained by ChatGPT/Codex must use the host’s relevant controls. This section does not assert that Train Athlete controls ChatGPT’s storage or grant it access to your conversations.

Purposes and legal bases

Account identifiers and optional Google profile information are used to create and operate your account and deliver authenticated exercise demonstrations because this is necessary to provide the service you request. Security and operational request information is used for Train Athlete's legitimate interests in operating, protecting and troubleshooting the service, balanced against your rights. Optional Health Connect information is handled locally only after you deliberately enable the relevant access; where it is health information, Train Athlete relies on your explicit consent. You can withdraw that consent by revoking the permission and removing imported copies, without affecting processing already carried out. Rights and deletion requests are handled to meet legal obligations and protect account holders.

Recipients and international transfers

Cloudflare provides website hosting, DNS and security services. Supabase provides account authentication, server-side account deletion and authorised demonstration delivery. Google provides optional sign-in and Android's Health Connect service. These providers receive only the information needed for their role; Train Athlete does not sell personal information. Provider operations may involve processing outside the UK. Where UK transfer rules require a safeguard, Train Athlete relies on the applicable UK adequacy regulations or contractual transfer safeguards made available through the provider arrangements. You may write to the Data Protection contact for more information about the safeguard relevant to your information.

Retention and deletion

Local training remains on your device until you remove it using available controls or Android app-storage removal. Sign-out or permission revocation is not deletion. Exported backups and records held independently by Google, Health Connect or another source require separate action.

With a current authenticated account, use Account → Privacy & Data → Delete Train Athlete account. The server deletion service removes the Supabase account, known owned server assets where applicable, and linked server records. It does not erase local workouts. The account-deletion guide explains the in-app path and the off-app request process.

Local training and imported activity copies remain on your device until you remove them using the app or Android controls. Server account information is kept while the account is active and is removed from active systems without undue delay after a verified deletion request. Operational and security logs, cached delivery records and residual backups are kept only for the provider's documented service period or for as long as reasonably necessary to investigate security, prevent abuse, meet legal obligations or resolve a request, then deleted or anonymised. Retention is reviewed when providers or product functions change.

Your rights and choices

Depending on applicable law and circumstances, you may have rights to access, correct, erase or restrict processing, receive portable information, object, or withdraw consent where processing relies on it. Rights and exceptions are assessed for each request. You may raise concerns with the UK Information Commissioner’s Office.

To make a privacy-rights request, write to the registered office and mark the envelope 'Data Protection Request'. Include your name, any email linked to the account or the Train Athlete account identifier if available, the right you want to exercise and a safe postal address for the response. Do not send a password, access token, backup passphrase or health record. Train Athlete may ask for proportionate information to confirm identity and normally responds without undue delay and within one month after receiving any information reasonably needed to verify identity. If a request is complex or several requests are made, the response period may be extended as permitted by law and you will be told within the first month.

Changes and contact

This policy should be reviewed when the product, providers or processing change.