Privacy policy

1. Who we are

This policy explains how SetForge (“SetForge”, “we”, “us”) handles personal information when you use the SetForge app on iPhone or Android (the “app”) and this website, setforge.com.au (together, the “services”). We're based in Australia and handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you live in the European Economic Area or the United Kingdom, section 12 explains your additional rights.

2. What we collect

Information you give us

• Account details. Your email address and, if you choose to share it, your name, when you sign in with Apple, Google or an email link. If you use Sign in with Apple's “Hide My Email”, we only receive a private relay address.
• Training data. Your programs, routines, workouts, sets, weights, reps, rest times, notes, custom exercises, exercise preferences and app settings.
• Profile (optional). Birth year, sex, height and training experience, which help tailor starting weights and statistics.
• Body data (optional). Bodyweight, body-fat percentage and body measurements you log.
• Progress photos (optional). Photos you choose to add, kept in private storage that only your account can access.
• Messages. What you send us when you contact support, and our replies.

Information created when you use the app

• Account and device identifiers. An account ID, and a random identifier the app creates for each installation, together with the platform and app version, so that sync can tell your devices apart and keep your data consistent.
• Subscription status. Whether your subscription or trial is active and when it renews. Payments are handled entirely by Apple or Google: we never see your card details.
• Server logs. Our servers record technical information (such as IP address, time and request type) for security and to keep the service running. Logs are kept for a limited time.

Information that stays on your device

Your coaching calculations (training maxes, next prescriptions and personal records) are computed on your phone. Reminder history, notification scheduling and the rest timer also stay on your device and are never sent to us.

Imports

If you import from Hevy with an API key, the key is used once to fetch your workouts. It's held encrypted for at most one hour, is never stored with your account and is never logged. If you upload a CSV export instead, we read it only to create your workouts.

This website

This website uses no cookies, no analytics and no third-party trackers. Our hosting provider may keep standard server logs (for example IP address and pages requested) for security.

3. How we use it

• To provide the services: create your account, sync and back up your data across your devices, and run your program.
• To provide support and respond to your messages.
• To manage your subscription status and free trial.
• To keep the services secure, prevent abuse, and fix errors.
• To meet our legal obligations.

We don't use your information for advertising, we don't build advertising profiles, we don't sell or rent it, and we don't use your training data to train AI models. If we ever want to use your information for a new purpose, we'll ask first where the law requires it.

4. Health information

Bodyweight, body measurements and progress photos can be health information, which is “sensitive information” under the Privacy Act. We only collect it when you choose to enter it, and by doing so you consent to us storing and syncing it to provide the app. You can delete individual entries in the app or delete your account at any time. SetForge doesn't read from or write to Apple Health or Google Health Connect.

5. Who we share it with

We don't sell your information. We share it only with service providers who help us run SetForge, under contracts that limit what they can do with it:

The exercise library is downloaded from our servers; no personal information is sent to its source. We may also disclose information if required by law, to protect someone's safety, or as part of a sale or restructure of SetForge (in which case this policy continues to apply).

6. Storage and overseas disclosure

Your data is stored on your device and on servers operated by Render in Singapore. Some service providers listed above may process limited information in the United States or other countries. When we disclose personal information overseas we take reasonable steps, as required by APP 8, to make sure it's handled in a way that's consistent with the Australian Privacy Principles.

7. Security

All traffic between the app and our servers is encrypted with HTTPS. Sign-in tokens are short-lived and rotated, refresh tokens are revoked if reuse is detected, and third-party sign-in tokens are stored encrypted. Access to production systems is restricted. No system is perfectly secure, but if a data breach is likely to cause you serious harm we'll notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

8. How long we keep it

• We keep your data for as long as your account is open.
• Items you delete are removed from your devices straight away and purged from our servers within 180 days (the record of the deletion is kept that long so your other devices can catch up).
• When you delete your account, it's locked immediately and every session is signed out. We then delete your account, training data, body data and photos from our servers and revoke your Apple or Google sign-in. We keep only an anonymised note that an account was deleted on a given date, with no personal information.
• Support emails are kept for up to two years after the conversation ends, unless you ask us to delete them sooner.

9. Your choices and rights

• Access and export. In the app, Settings → Export my data gives you a copy of everything (CSV and JSON). You can also ask us for a copy.
• Correction. Edit or delete any workout, measurement or profile detail in the app, or ask us to correct something.
• Deletion. Settings → Delete account, or follow the steps on our account deletion page.
• Notifications. Reminders are optional. Change their tone or turn them off in Settings → Reminders, or in your phone's settings.
• Anonymity. You can use Sign in with Apple's private relay email. Because SetForge syncs your data to an account, we can't offer a fully anonymous option.

We'll respond to requests within 30 days. We may need to confirm your identity first, usually by replying from the email address on your account.

10. Children

SetForge isn't directed at children under 13 and we don't knowingly collect their information. If you're under 18, use SetForge only with the permission of a parent or guardian. If you think a child has given us personal information, contact us and we'll delete it.

11. Questions and complaints

Contact us at support@setforge.com.au. We'll acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12. If you're in the EEA or UK

We process your information to perform our contract with you (providing the app), with your consent (optional health data, which you can withdraw by deleting it), and for our legitimate interests in keeping the services secure. You have the right to access, correct, delete, restrict or object to processing of your information and to data portability, and to complain to your local data protection authority. International transfers rely on appropriate safeguards such as standard contractual clauses.

13. Changes to this policy

We'll update this page when our practices change and change the date at the top. If a change is significant, we'll let you know before it takes effect, for example by email or in the app.