Privacy Policy

This Privacy Policy applies to the Workout service operated by Kepptic, including the web application, installed progressive web app, public pages, and related support. It takes effect on the last-updated date shown above. A third-party service or site has its own privacy practices when it is outside Workout’s operation.

Workout receives the email address you submit for a magic link or an access request. When you use the service, it stores the training information you choose to enter, including programs, scheduled workouts, exercise selections, weights, repetitions, set history, personal records, and related notes.

The service may also store bodyweight and squat, bench press, and deadlift five-repetition maximums when you provide them. These values support workout features such as suggested weights. Support and feedback messages are stored when you send them. If you attach an optional screenshot to feedback, it may include any information visible on your screen, so review it before submitting.

Workout uses required session cookies to authenticate you and maintain account continuity. Secure production variants of those cookies are used on protected connections. Basic request, security, and operational logs may also be processed when needed to deliver the service, investigate failures, prevent abuse, and protect accounts.

Workout does not use advertising cookies, behavioral trackers, or third-party product analytics. It does not track your activity to build an advertising profile.

Information is used to authenticate users through magic links; provide schedules and workout sessions; calculate suggested weights; save logged work; synchronize supported offline activity; and display progress. Email addresses are also used to process access requests and invitations and to deliver relevant service communications.

Kepptic may use account, request, support, and feedback information to answer questions, diagnose problems, maintain the service, enforce limits, prevent abuse, and protect security. Body metrics supplied for suggested-weight calculations are used for that product function, not for advertising or behavioral profiling.

Resend processes email delivery for magic links, invitations, and relevant service communications. Neon Postgres stores account, workout, body-metric, session-related, support, and feedback data. Cloudflare provides application delivery and worker infrastructure. These providers process information on Kepptic’s behalf using their own infrastructure and security practices.

Feedback submissions are also mirrored as issues in a private GitHub repository used by Kepptic’s development team for triage. That mirror includes the feedback message and related metadata (such as the page and app version); screenshots are referenced from the submission rather than embedded in the GitHub issue. The repository is private and restricted to Kepptic’s team.

On-device IndexedDB stores offline caches and pending supported changes. Optional feedback screenshots are compressed on the device and stored in the database as encoded image data rather than in a public image library.

Workout caches available workout information and pending supported changes on your device so set logging can continue when reception drops. Local information may remain until it is synchronized, cleared, expired, or removed with browser or site data. Some actions still require a connection.

Anyone with access to an unlocked device or browser profile may be able to view locally stored information. Clearing browser data or uninstalling the progressive web app may remove unsynchronized changes before they reach the server. Allow pending changes to sync before clearing local storage when possible.

Workout does not sell personal or workout data and does not share it for targeted advertising. Information is disclosed only as needed to the service providers that operate Workout, when required by law, when reasonably necessary to protect users or the service, or as part of a merger, acquisition, financing, or transfer of the business with appropriate notice and continued protection.

Kepptic retains information only as long as needed to provide and secure Workout, meet legal obligations, and resolve disputes. You may request account deletion through support@kepptic.com. Kepptic may need to verify that the request comes from the account holder before acting on it.

Limited backup copies, security records, records required by law, or feedback artifacts already created with a third-party service may remain for a limited period after deletion. Server-side deletion does not automatically clear data stored in every browser profile or device. Let pending offline changes sync or clear that browser’s site data separately.

Workout uses passwordless authentication, secure session cookies in production, private worker-to-worker service routing, and reasonable administrative and technical safeguards. No online service, device, or storage system can guarantee absolute security, and Kepptic cannot promise that every incident or loss is impossible.

You may ask to access, correct, or delete account information and may request an export where one is available. Depending on where you live, additional privacy rights may apply. Submit a request to support@kepptic.com and describe the account and request clearly; identity verification may be required.

Browser controls can remove or block cookies and site storage, but required authentication and offline storage are part of how Workout works. Blocking or removing them may sign you out, remove unsynchronized changes, or prevent parts of the service from functioning.

Workout is not directed to children under 13. A person who is not old enough to consent to online services in their jurisdiction may use Workout only with any consent required from a parent or guardian. If Kepptic learns that information was collected from a child without required consent, it will take reasonable steps to delete it.

Kepptic may update this policy as Workout changes. Material updates will be communicated through the service or by an appropriate account communication before they take effect when reasonably possible. The effective version is identified by the last-updated date. Questions and privacy requests may be sent to support@kepptic.com.