Privacy

Who we are

NotchLift is run by B A Thompson Ltd, registered in England and Wales (company no. 09468823), Market House, Church Street, Harleston, Norfolk, IP20 9BB. We are the data controller for the information described here.

What we store

• Account: your email address and password (stored only as a secure hash by our authentication provider). If you continue with Apple or Google instead, we receive your email address (with Apple, it can be a private relay address that forwards to you) and, if shared, your name, which starts as your display name. We never see your Apple or Google password.
• Profile: an optional display name and app preferences such as default rest time.
• Training data: the splits, workouts, exercises, sets, notes and dates you enter.
• Membership: whether you are a founding member, on a trial or subscribed, your plan, renewal date and payments (amounts and dates). If you haven’t logged a workout by the morning after signing up, we send one email to help you get started. If you tell us which days you usually train, we keep those days and, until your first workout, send a short reminder on those mornings (at most four). If a week passes without a workout, our founder sends one email asking what got in the way. Near the end of a free trial we send one reminder email, and if a trial ends without a plan, one email asking why. You can turn these reminder emails off in Profile or with the unsubscribe link in any of them.
• Your answers to our short questions (each asked once, and you can skip it): how you heard about NotchLift, how your trial is going, why you didn’t choose a plan, and the reason you give Stripe if you cancel. We use them, together with where you came from, to improve NotchLift and our advertising, and we may email you to follow up on something you wrote.
• Visits to our public pages (not the app itself): the page, the site that linked to it, campaign tags in the link (for example from an ad), your device type and country, whether the pricing section or sign-up form was opened, whether the “Try a workout” demo was opened, a set ticked in it or create account tapped from it, whether someone tapped to create an account (and, if it didn’t go through, a short reason such as “password too short”, never what was typed), and whether the page was open inside the Facebook or Instagram app. No IP address and no ID for you are stored. If you came from a campaign or another site, a small cookie remembers where from (not who you are) for up to 30 days. If you then create an account, that source is attached to your account so we can see which campaigns bring people who keep training, and the cookie is deleted. Browsers that send Global Privacy Control or Do Not Track are not counted.
• Errors: technical reports when something breaks (the error, the page and the browser). They never include your email, account, IP address or training data, and secret links (such as invite links) are blanked out.
• On your device: a workout in progress is kept in your browser’s storage so a set is never lost to a bad connection, plus cookies that keep you signed in and remember your time zone. Signing out removes the stored workout data from that device.

Why

Only to provide NotchLift to you: to sign you in, save and sync your workouts, and show your history and progress. Training logs can be considered health-related information; you choose what to record, and it is used for nothing else.

Who stores it

• Supabase hosts the database and sign-in, in the EU (Ireland).
• Vercel hosts the app; requests are handled in the EU (Dublin).
• Apple and Google confirm who you are if you choose to sign in with them; they learn that you use NotchLift.
• Resend sends account emails (confirming your address and resetting your password).
• Sentry receives the technical error reports described above, stored in the EU.
• Meta (Facebook and Instagram) receives the ad-measurement events described under Cookies, only if you accept them.
• Stripe processes payments for memberships. Your card details go to Stripe directly and never reach us; we keep only whether you are a member, your plan and renewal date, and amounts paid.

Except for Meta (see Cookies), these providers process data on our behalf and do not use it for their own purposes.

Sharing

Your data is private to your account. If you create a share link for a split, the link shows only that split’s structure and targets, never your weights, reps or history. You can revoke a link at any time. In a group workout, the people in the group see the plan, the name you choose to show them and whether you have started or finished; never your weights, reps or history.

Invites: if you join through someone’s invite link, group workout or shared split, we record that they invited you, so they can get the invite reward. They see only how many people they invited have signed up and started training, never who, and never anything you log.

Your choices and rights

• Download your data at any time: Profile → Your data → Export (spreadsheet or full JSON).
• Correct it by editing workouts, splits and your profile in the app.
• Delete your account: Profile → Your data → Delete account. Everything is removed from the live database immediately. Copies in provider backups, if any, expire on their normal schedule.
• You can also contact hello@notchlift.com with any privacy question. In the UK you have the right to complain to the Information Commissioner’s Office (ico.org.uk).

How long we keep it

For as long as you have an account. When you delete your account, your data is deleted with it.