Privacy Policy

Last updated: October 12, 2026

SETR is a gym training app. It needs your training data to do its job — suggesting the right weight for the right set — and nothing else. This page describes exactly what is collected, why, and what you can do about it.

This page is a translation of the French version, which prevails in the event of any discrepancy.

1. Who is responsible for your data

The data controller, within the meaning of the GDPR, is:

For any question about this policy or your data: privacy@setr.app.

2. The data SETR collects

2.1 Account

You create an account with Sign in with Apple, Google Sign-In or an email address and password. SETR receives your email address and a unique account identifier. Your password is never stored in plain text: Supabase only keeps a one-way hash of it, from which it cannot be recovered. If you use Apple's “Hide My Email” option, SETR only receives Apple's relay address and never has access to your real address.

2.2 Profile

Entered by you at sign-up, all optional: display first name, age, height, weight. They are used only to personalize the display and weight suggestions. Your answers to the starting questionnaire (goal, training frequency, experience) are used to build your program.

2.3 Training

The heart of the app: the sets you log (exercise, weight, reps, date), your custom cycles, your position in the current cycle, and your per-exercise settings (rest time, number of sets, plate setup).

During a workout, the app tells the server that one is in progress (start time, iPhone or Android). This signal is deleted when the workout ends, is abandoned or is paused.

2.4 Settings

Notification preferences, end-of-rest vibration, and other app options.

2.5 Technical

If you allow notifications, two tokens tied to your device may be stored. The first is used exclusively to remotely close the rest timer shown in the Dynamic Island when the app can no longer do it itself; it is deleted as soon as the timer ends. The second, stored with your device's system (iOS or Android) and the app's language, is used to send you the notifications that come from our servers: a payment problem with your subscription, SETR announcements and, if you use the social network, what happens there for you (follows, kudos, comments, workouts shared by the accounts you follow, messages, groups). It is deleted when you sign out or delete your account.

2.6 Subscription

Payment is handled by Apple or Google if you subscribe from the app, and by Stripe if you subscribe on setr.app: in every case, SETR never sees your payment details. To know whether your subscription is active, SETR relies on RevenueCat, which receives your SETR account identifier (a random identifier), the purchase information sent by the store or by Stripe (product, dates, trial period, renewals, country) and technical data (app and operating system version, IP address). For a purchase made in the app, RevenueCat receives neither your name nor your email; for a purchase on setr.app, RevenueCat and Stripe receive your email address, needed for the order and the receipts, and Stripe your payment details. SETR itself keeps the status of your subscription (plan, origin, dates).

If you use a promo code, SETR stores the code and the date you used it, and asks RevenueCat to unlock the corresponding access.

2.7 Calendar (optional)

If you turn the option on, SETR creates a “SETR” calendar on your phone and adds your planned workouts to it. These events stay in your device's calendar, and in your iCloud or Google account if that calendar is synced there. SETR doesn't read your other events.

2.8 Social network (optional)

None of the following exists until you create a social profile. If you create one, SETR stores: your username, display name, avatar (a color and a pictogram, never a photo), bio, whether the profile is private or public, and the date on which you accepted the rules and declared being 16 or older; who you follow, who follows you and pending requests; the accounts you block; the reports you send, with a copy of what was displayed at the time of the report; and the workouts you choose to share (exercises, sets, weights unless you hide them, personal records, duration), with the text you add to them and the layout you pick. To these are added the kudos and comments you leave on shared workouts, and the notifications these actions create for the person concerned (follow request, new follower, kudos, comment, group invitation).

Your performance is part of your social profile: there is no setting to share it or not. The people who can see your shared workouts — your followers if your profile is private, all signed-in members if it is public — also see figures computed from your entire training history, not just the workouts you shared: number of workouts and volume for each of the last eight weeks, consistency, heaviest weight per exercise with its number of reps, and the number of days since your last workout. These figures are also used to compare you with them, and to list you in your followers' leaderboards. Hiding your weights removes weights and volume from them. Keeping your profile private limits them to the followers you approved; to stop showing them altogether, you have to leave the social network.

Your friends — the people you follow and who follow you — also see, at the top of the Social tab: whether you are training right now and for how long, when your last workout of the past seven days ended, with its number of sets and the muscle groups worked (never your weights, your reps or the names of your exercises), and whether your plan has a workout scheduled today. For that last point, the app stores on our servers the days of the coming week on which a workout is planned: dates only, without the name or the content of the workout. Your other followers see none of this, even if your profile is public. There is no setting to hide it: to stop showing it to someone, unfollow them or remove them from your followers; to stop showing it altogether, you have to leave the social network.

If you use messaging, SETR stores the messages you exchange with a friend — a person you follow and who follows you back — and the cycles you send them. Only the two of you read them in the app. They are not end-to-end encrypted: they are stored on our servers, and the publisher only looks at them to handle a report, which then keeps a copy of the reported message. A message you delete is erased for good; only the “message deleted” mark remains.

If you join a group (by invitation, which you accept or decline), its members see your name, username and avatar, along with your number of workouts and your volume for the current week — and nothing else from your history. If you hide your weights, your volume is not shown to the other members but counts toward the group total. The collective total of each past week stays in the group's history for as long as the group exists. Leaving the group ends this sharing. Each group has a chat: the messages you write there are read by its members, and by them only. Like private messages, they are not end-to-end encrypted, and the publisher only looks at them to handle a report. You can delete your messages, and the group's owner can remove those of other members: they are then erased for good. If you leave a group without deleting them, they stay in its chat until the group disappears or you leave the social network.

Your profile is private by default. If you make it public, all signed-in members can follow you without asking and see your shared workouts, which then appear in the app's “Everyone” feed, as well as your performance. Private or public, your profile (username, name, avatar, bio) may be suggested to other members — for example those who follow you, who follow the same people as you, or who share a group with you. No profile can be viewed on the web.

If you publish a cycle by link, anyone with that link, even without an account, sees on setr.app the cycle (its names, workouts and exercises) along with your name, username and avatar. You can delete the link at any time: it then no longer leads anywhere.

Your age, height, weight, email address, notes and the set-by-set detail of the workouts you haven't shared are never visible to other users.

2.9 Bugs and suggestions

If you send feedback from Settings → Bug or suggestion, SETR stores your message, its type and the screen concerned, and automatically attaches some technical information: app version, phone system and version, language, and the status of your subscription. No training data is attached. The feedback is forwarded by email to the publisher, with your email address so that they can reply to you.

3. Why, and on what legal basis

4. What SETR does not do

• No ads are shown and no advertising SDK is included.
• No third-party behavioral analytics, audience measurement or crash reporting tool is included.
• No data is sold, rented or transferred to third parties for commercial purposes.
• No tracking of your activity outside the app.
• No access to your contacts, location, microphone, camera or photos. The calendar is only used if you turn the option on, and only to write to the “SETR” calendar.

5. Who else sees your data

Only the technical providers needed to run the app. They act as processors, on instruction, and are not allowed to use your data for their own purposes.

The only exception, and only if you decide so: the social network. If you create a social profile, other signed-in users see your username, display name, avatar and bio; your followers — or all signed-in members if your profile is public — see the workouts you share and your performance (see 2.8). Your friends also see whether you are training right now, when your last workout ended, with its number of sets and its muscle groups, and whether you have one planned today. Your comments are visible to everyone who can see the workout you commented on; your kudos is notified to the author, and others only see the count. Your private messages are read only by the person you write to, and those of a group by its members. The publisher reads reports and what they target, in order to handle them.

6. Where your data is stored

Your SETR database is hosted by Supabase in the eu-north-1 region (Stockholm, Sweden): your account data, sets, cycles and settings do not leave the European Union. This website is hosted by Hostinger (European Union).

Apple, Google, RevenueCat, Stripe, Expo and Cloudflare may process some technical data outside the European Union, under the European Commission's standard contractual clauses.

7. How long it is kept

• Account and training data — as long as your account exists.
• After account deletion — erased within 30 days at most, backups included.
• Notification tokens — the rest timer's is deleted at the end of each rest timer; the one for other notifications, when you sign out or delete your account.
• Subscription data at RevenueCat — deleted along with your account. Apple, Google and Stripe keep your purchase and payment history under their own rules and legal obligations.
• Bugs and suggestions, promo codes used — for as long as your account exists.
• Social network — your profile, your follows, your shared workouts, your kudos, your comments, your private conversations, your group messages, your group memberships and your cycle links are deleted as soon as you leave the social network or delete your account. Reports are kept for 12 months at most. The workout-in-progress signal is deleted when the workout ends; planned workout days are replaced each time your plan is updated and never cover more than a week.

8. Your rights

The GDPR gives you the right to access your data, correct it, erase it, restrict its processing, object to it, and receive a portable copy in a machine-readable format.

Most of these can be exercised directly in the app: your profile and settings can be changed at any time, and account deletion is available in Settings. For anything else, email privacy@setr.app — reply within 30 days.

If you're not satisfied with the answer, you can file a complaint with the CNIL, the French data protection authority.

9. Deleting your account

You can delete your account from the app, in Settings, which erases all of your data. A web procedure is also available: delete my account. Note: deleting your account does not cancel your subscription: it is managed in your Apple or Google account or, if you subscribed on setr.app, through the management link you received by email.

10. Security

Communication between the app and the servers is encrypted in transit (TLS). Data access is isolated per account at the database level: row-level security rules ensure an account can only read or modify its own data. Session tokens are stored in the operating system's secure keychain, never in plain text.

What you post on the social network can only be read by others through functions that check, on every call, who is entitled to see it.

11. Minors

SETR is not intended for children under 13 and does not knowingly collect their data. Between 13 and the age of digital consent in your country (15 in France, 16 in several EU countries), a parent's or legal guardian's permission is required. If you find that a child under 13 has created an account, email privacy@setr.app: the account will be deleted.

The social network is reserved for people aged 16 or older.

12. Changes

This policy may change. The date of the last update is shown at the top of this page, and any substantial change will be announced in the app before it takes effect.

13. Contact

Questions, requests to exercise your rights, reports: privacy@setr.app.