Privacy Policy
Effective November 2, 2026
Lifters Club (lifters.club) is run by TPS Collective Inc. (株式会社TPS Collective), a company in Tokyo, Japan. We are responsible for the personal data described here (the "controller"). This policy says what we collect, why, who handles it, how long we keep it, and what you can do about it. Questions: contact@lifters.club.
What we collect
From Google (or Apple, when it is offered) when you sign in: your name, email address, profile picture link and account ID. We never see your password.
If you sign in with a code sent to your email (when it is offered): your email address, and when each code was sent and used. There is no password; the code works once and expires after 10 minutes.
What you tell us: your name and photo, birth year, sex, height, units, goal weight, your answers to the setup questions (goal, experience, days and time to train, where you train and your equipment), and any sore or injured areas you choose to avoid.
What you log: workouts and sets (exercise, weight, reps, and whether a set hurt), body weight and body fat (with an optional note), the plans you build or a coach builds for you, the targets a coach sets for your next workouts, with any short note (weight, reps and sets for an exercise), and plans you share or add from someone else's share code. If you let a coach log workouts for you, the workouts and sets they log for you too, with a note of who logged each set. If you connect a coach, the notes they write about your workouts. Exercises you add yourself, for what our library doesn't have: a name, the kind (weights, bodyweight or cardio), whether it is done one side at a time, the main muscle and, if you add one, a photo. Your phone makes the photo smaller and removes the location and other camera details stored in the file before it is uploaded, and we check again that none are left.
Collected automatically: your IP address and browser type, which our providers record when you sign in and with each request, for security and to keep the service running. We use no advertising or tracking tools. Only if you allow it, Google Analytics also counts your visits; see Analytics below.
Health-related data
Body weight, body fat, notes on your body log, sore or injured areas and sets marked as painful can say something about your health. We treat them as sensitive: we ask for your explicit consent when you start using Lifters Club, use them only to build your plan, suggest your next weights and show your progress, and never sell them or use them for advertising.
Please don't write diagnoses or medical conditions in body log notes. We don't need them to build your plan.
You can withdraw this consent at any time by deleting your account, or by writing to us. Because the plan and progress features depend on this data, withdrawing means we can no longer provide the service to you.
Residents of Washington, Nevada and other US states with consumer health data laws: see our Consumer Health Data Notice at lifters.club/health-data.
Why we use it, and our legal basis
To run your account and the service you asked for: building your plan, suggesting your next weights, showing records and progress, saving sets you log offline, and sharing with a coach you connect. For people in the EU, UK and similar places, the legal basis is that this is needed to provide the service (GDPR Art. 6(1)(b)).
Health-related data: your explicit consent (GDPR Art. 9(2)(a); under Japan's Act on the Protection of Personal Information, your prior consent).
Google Analytics: your consent, given by choosing Allow (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies). You can withdraw it at any time.
Security, preventing abuse and fixing errors: our legitimate interest in keeping the service safe (GDPR Art. 6(1)(f)). Meeting legal obligations, such as answering lawful requests: GDPR Art. 6(1)(c).
Your birth year is used only to work out your age. We do not sell or rent your data, show ads, profile you for marketing, or use your data to train AI models. We make no decisions about you by automated means that have legal or similarly significant effects; the training suggestions follow fixed rules and you can always change them.
Who can see it
Only you, unless you connect a coach or share a plan. If you connect a coach, they see your name and photo, your plans and your logged sets (including sets you marked as painful), and can edit your plan and set targets for your next workouts. Your birth year, sex and height, and your body log (weight, body fat and notes), stay hidden from them unless you choose to share them with that coach. If you coach someone, they see only your name and photo, and so does anyone who opens an invite link you created while it is still valid. You can stop sharing or disconnect a coach at any time from your profile. A coach you connect also sees the exercises you add yourself and their photos, and can add or change them for you.
A coach can also write your workout log, but only if you turn on "Let them log workouts for you" for that coach in your profile; it is off unless you do. They can then start workouts for you and add, change or delete their sets, as you can, and each set they add shows their name. They still can't change anything else of yours except your plan and your targets. Turning it off, or disconnecting the coach, stops it straight away.
A coach you connect can write notes about your workouts: feedback on a session, and a note on an exercise, sometimes with a reason (form, fatigue, too heavy, pain or other). You see every note on your calendar; none are hidden from you. Only the coach who wrote a note can change or remove it, and only while you are connected; after you disconnect a coach you can still read their notes, and they can no longer read or change them. A coach can also paste a summary of your training into an AI tool; see "Coaches and AI tools" below.
When you finish a workout you logged yourself, each coach you are connected with gets an email, unless they turned these emails off: your display name, the session's name and date, and how many sets and exercises. There are no weights, reps, pain marks, body data or notes in it, and none for a workout your coach logged for you. It is sent through Resend (see the table below). If you coach someone, we use your email address to send you these emails; you can turn them off on your Coaching page or with the link in any of them.
Plans you share. When you share a plan, anyone who has its code or link can see that plan, without signing in: its name, days, exercises, sets, reps, rest and minutes, and your display name unless you untick "Show my name with it". They can add a copy to their own account and change it. Nothing else of yours is shared: not your photo, body data, workouts, sets or email. Exercises you added yourself show by name only and are not copied; their photos are never shared. The code shows the plan as it was when you shared it. You can stop sharing at any time from your plan, and the code stops working straight away; copies people already added stay in their accounts. When you add someone else's shared plan, we keep their display name with your copy ("From …"), and they see nothing of yours.
Providers who run the service for us under contract (processors). They may use the data only to provide their service to us:
| Provider | What they do | Where the data is |
|---|---|---|
| Supabase Pte. Ltd. (Singapore), part of Supabase, Inc. (USA) | Database, sign-in and photo storage | Stored in Tokyo, Japan. Supabase staff and its sub-processors in other countries, mainly the US and Singapore, may access it to run and support the service. |
| Cloudflare, Inc. (USA) | Runs the website and passes requests to the database; forwards email sent to contact@lifters.club | Handled in the Cloudflare data center nearest to you, which may be in another country; short-term logs may be kept in the US or other countries. |
| Google LLC / Apple Inc. (USA) | Sign-in. They are responsible for your Google or Apple account under their own privacy policies. | Their own data centers. |
| Resend (Plus Five Five, Inc., USA) | Sends the sign-in code email, if you sign in with your email, and the email a coach gets when their client finishes a workout. It receives the recipient's email address and the message: the code, or, for a coach's email, the client's display name, the session's name and date, and the number of sets and exercises. It keeps a delivery log (address, time, status) for up to 30 days. | Sent from Tokyo, Japan (Resend region ap-northeast-1). Resend keeps its logs and account data in the United States, where its own sub-processors also are. |
| Google LLC (USA) | Google Analytics, only if you allow it: counts visits and pages as described under Analytics. It receives no name, email, account ID or anything you log. | Google's data centers, mainly in the United States. |
Coaches and AI tools
A coach you connect can copy a summary of your training as text and paste it into an AI tool of their choice, such as Claude, to help plan your next workouts. The summary holds your display name, your current plan, the targets they set and whether you hit them, your workouts and sets from the last six weeks, your estimated maximum lifts over time and your best lifts, your weekly sets per muscle, changes to your plan with the reasons given, and the coach's own notes about your workouts (which they write, and which can mention fatigue or pain).
It never includes your email address, account ID, birth year, sex, height, body log (weight, body fat and notes), or which sets you marked as painful.
When a coach pastes it, the AI service receives it under its own terms and the coach's account with that service. It may be handled outside Japan, and we don't control how it is kept or used. Our promise not to use your data to train AI covers us, not the AI service your coach chooses: ask your coach which tool they use and how it treats what they paste. Our Terms allow a coach to use your data only to coach you and to keep it confidential.
If you don't want this, don't connect a coach, or disconnect them at any time from your profile.
Analytics
We use Google Analytics 4, a service of Google LLC, to learn how many people visit Lifters Club and which pages they use, so we can see what to improve. It runs only if you allow it: the first time you visit, we ask, and until you choose Allow the Google Analytics script is not loaded at all and nothing is sent to Google.
If you allow it, your browser sends Google: the pages you open, with codes, links and IDs in the address replaced by placeholders (a shared plan is sent as /p/:code/, an invite as /invite/:token/) and with everything after ? or # removed; the site you came from, cut to its address (for example https://www.google.com/); your browser, device type, screen size and language; and a random ID kept in the _ga cookies, so repeat visits can be counted. Google uses your IP address to work out an approximate location (country and city) and, by its own description, does not log or store IP addresses in Google Analytics 4.
We never send your name, email address, account ID, page titles, or anything you enter or log. Google signals and all advertising features are turned off, so the data is not used for ads or linked to your Google account by us. Google Analytics keeps the event-level data for 2 months (totals in its standard reports, which say nothing about any one person, are kept longer); the _ga cookies last up to 13 months, and we ask you again after a year.
You can change your answer at any time with Cookie settings at the bottom of any page. Choosing Don't allow there deletes the Google Analytics cookies. You can also block Google Analytics on every site with Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout), or by blocking cookies in your browser. How Google uses data from sites that use its services: https://policies.google.com/technologies/partner-sites.
Data sent to other countries
We are based in Japan and our database is in Japan. Because our providers are based in the United States and Singapore and Cloudflare works worldwide, your data may be handled in the United States, Singapore and the country of the Cloudflare data center serving you.
The United States has no single federal privacy law like Japan's or the EU's; protection comes from sector and state laws and from contracts. Singapore has its Personal Data Protection Act. Each provider has data processing terms that require security measures and limit use to providing the service, including the European Commission's standard contractual clauses for data from the EU and UK. Cloudflare, Resend and Google (for Google Analytics, only if you allow it) also state that they comply with the EU-US Data Privacy Framework.
Data from the EU and UK to Japan is covered by the European Commission's and the UK's adequacy decisions for Japan. Under Japan's Act on the Protection of Personal Information (Art. 28), we keep these providers under arrangements that meet the required standards, and on request we will tell you more about them.
How long we keep it
While your account exists. When you delete your account, your profile, plans, logs, profile photo, exercise photos and consent records are erased from the live database straight away, and from backups within 30 days.
Server logs (time, address requested, IP address, errors) are kept by our providers for a short time, at most 30 days, unless needed to investigate abuse. Emails you send us are kept as long as needed to answer them and for our records.
We keep a record of when you agreed to these terms for as long as your account exists, so we can show what you agreed to.
How we protect it
Every database table is locked so each account can read only its own rows and what a connected coach or client is allowed to see, and the website checks this again on every request. Connections are encrypted (HTTPS), data is encrypted at rest by our providers, and the session cookie can't be read by page scripts.
Staff access is limited to the people who run Lifters Club. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
Your rights
Wherever you live, you can: see and correct your data in the app; download all of it as a file (Profile, Your data); delete your account and everything in it (Profile, Delete account); disconnect a coach; and withdraw consent for health-related data by deleting your account.
You can also write to contact@lifters.club to ask for a copy of your data and how we use it, to correct or erase it, to restrict or object to how we use it, to stop us using it or sending it to others, or for anything else in this policy, including our address and the name of our representative director. We may ask you to confirm the request from the email address on your account. We answer within 30 days, and never charge for a reasonable request.
People in the EU and UK may also complain to their local data protection authority. In Japan, you can contact the Personal Information Protection Commission. US residents have the rights their state gives them; we don't sell or share personal information for advertising, and we don't discriminate against anyone for using their rights.
Age
Lifters Club is for people aged 16 and over, and you confirm this when you start. It is not meant for children. If we learn that someone under 16 has an account, we will delete it. If you think a child has given us data, write to us.
Changes
If we change this policy in a way that matters, we will update the date at the top and ask you to read and agree to the new version in the app before you continue. Earlier versions are available on request.
Contact
TPS Collective Inc. (株式会社TPS Collective), Tokyo, Japan. Email: contact@lifters.club. We read and answer every request about your data.