Privacy Policy
Last updated: August 24, 2026
DR. DUMBBELL is a workout tracker for people following a structured strength program. This policy explains what data the app collects, how it is used, and the choices you have. It applies to the web app and the iOS app.
What we collect
Account information. When you sign in with Google or Apple, we receive your email address, name, and profile picture from the sign-in provider. If you create an account with an email address and password instead, we store your email address and the name you provide; your password is hashed and managed by our authentication service (Supabase) and is never stored in readable form.
Workout data. The data you create as you use the app: programs you save, workout sessions you complete, and the sets, reps, weights, and notes you log.
Push notification tokens. If you enable notifications in the iOS app, we store the device token Apple assigns to your device so notifications can be delivered to it.
Logs and diagnostics. Our servers keep operational logs of API requests — including your IP address and basic request metadata — used for security, rate limiting, and debugging. If the app encounters an error, technical details (such as device model, OS version, and the error itself, associated with your user ID) may be sent to our error-monitoring service to help us fix bugs.
How we use it
Your data is used solely to provide the app's functionality — signing you in, tracking your progress, and syncing your workout history across devices. We do not sell your data, share it with third parties for marketing, or use it for advertising. The app contains no ads and no third-party advertising or analytics trackers.
Where your data lives
Your data is stored and processed by a small number of infrastructure providers acting on our behalf:
- Supabase — database hosting (PostgreSQL) and email/password authentication.
- Vercel — application hosting and server request logs.
- Sentry — error monitoring and diagnostics.
- Upstash — rate limiting on sign-in endpoints, which briefly processes IP addresses.
- Google and Apple — sign-in, if you choose them. We do not send your workout data to either.
These providers process data only to run the service; none of them may use your data for their own purposes.
Cookies
The web app sets a single encrypted session cookie to keep you signed in. There are no advertising or cross-site tracking cookies.
Data retention and deletion
We keep your data for as long as your account exists. You can permanently delete your account and all associated data at any time from Settings → Delete Account in the app — deletion is immediate. You can also request deletion by emailing graves.saul@gmail.com — we will remove your data within 30 days.
Children
The app is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If this policy changes, we will post the updated version here and revise the date at the top of the page.
Contact
Questions about this policy can be sent to graves.saul@gmail.com.