Privacy Policy
Data We Collect
Rack is a workout tracker for iPhone and Android, with a Garmin watch app, this website, and optional coaching. You can use the app as a guest; a guest's data stays on the phone.
Who we are: Rack Strength is the controller of your personal data. Contact: support@rackstrength.com.
- ●Account: email address; your name only if you give it or your Apple/Google sign-in shares it; login tokens
- ●Workouts: exercises, sets, reps, weights, rest times, timestamps, heart rate during workouts, routines, and PRs. Backed up to our servers when you are signed in
- ●Body measurements: your body-weight log, and measurements you enter such as body-fat percentage and circumferences. Backed up to our servers when you are signed in
- ●Preferences: units, rest timer, week start and similar settings, and gyms you save (a name, the equipment available, and an address or notes if you add them)
- ●Garmin: your paired watch’s identifier, data exchanged during workouts (including heart rate), and readiness data your watch shares (such as heart-rate variability), used for your readiness score on your phone. If you link Garmin Connect to send workouts there, you sign in on Garmin’s own page and we store the access tokens Garmin gives us, encrypted; your Garmin password never reaches Rack
- ●Apple Health (iPhone), with your permission: we read workouts, body weight, heart rate, distance, active energy, steps, VO2 max, date of birth and biological sex, and write completed workouts and body weight
- ●Health Connect (Android), with your permission: we read workouts, weight, heart rate, heart-rate variability, sleep, steps, distance and speed, and write completed workouts
- ●Progress photos (optional): body photos you upload in check-ins, with date, body weight if given, and pose label
- ●Coaching (optional): programs, messages and feedback, and photos you share with your coach
Workouts imported from Apple Health or Health Connect join your history like any other workout. Health data is never used for advertising or marketing, and never sold.
Profile & Training Settings
Starting October 26, 2026, if you are signed in, Rack keeps a copy of these on its servers so they come back when you reinstall or switch phones. If you see the in-app notice about this later than October 12, 2026, it starts 14 days after you see it. Until then they stay on your device only.
- ●Date of birth and biological sex (they set heart-rate zones, strength standards and cardio scores)
- ●The body weight and height on your profile (your body-weight log is already backed up, see Data We Collect)
- ●Training maxes and progression rules
- ●What Rack Knows facts, only if you turn on “Back up my facts” (see below)
Only you see them, through your own account, except the coach summary described below. They are kept while your account exists. Deleting a max, rule or fact in the app, or clearing your date of birth or sex, erases the server copy too. We keep only a note that the item was deleted, with no content, so your other devices remove it as well. Deleting your account erases all of it.
What Rack Knows facts are opt-in. They can include health information you type yourself, such as an injury, so they stay on your device unless you turn on “Back up my facts” on the What Rack Knows screen. It is off by default. You can turn it off at any time, and turning it off deletes our copy. If you have a coach, your coach sees a short summary of your top facts only if you turned on “Back up my facts”; turning it off also deletes that summary. Our lawful basis for storing them is your explicit consent (GDPR Article 9(2)(a) for any health information), given by turning the setting on and withdrawn by turning it off.
Used by AI features: if you are a Pro member and run a Training Audit, a plateau investigation or an AI program adjustment, your top facts in each area and up to five notes you typed (which may include an injury) are sent with that one request to the AI service described under AI Features. This happens only after you agree on the Training Intelligence consent screen, which is the basis for sending them. “Back up my facts” does not control it, because the facts are read from your phone.
Analytics & Crash Reports
We use PostHog (PostHog Inc., United States) to see how Rack is used and to find crashes. We use this only to improve Rack and fix problems. It is never used for advertising and never sold.
- ●Events: named actions such as opening the app, starting or finishing a workout, logging a set, viewing a screen, or seeing the paywall. Most carry only counts and durations. Some carry workout details, such as the exercise, weight and reps of a logged set, a routine’s name, a new personal record’s exercise, or the name and model of a watch or heart-rate strap you pair. They never carry your notes or What Rack Knows facts
- ●Crash and error reports: error messages and stack traces
- ●Device information: device model, operating system, app version and language. Your IP address is not stored: at most a rough location (city and country) derived from it is kept
- ●Linked to: when signed in, your Rack account ID (a random identifier, not your email or name), plus details such as your subscription tier, whether you have paired a Garmin watch, and your install date. As a guest, a random device identifier
- ●The apps do not record your screen
Turning it off: use the “Share Usage Analytics” switch in the app's Settings. It stops the app's usage events and crash reports. Two things continue, because Rack needs them to work: service records from our server linked to your account ID (a workout syncing, a subscription or trial starting, changing or ending, a failed payment, an account deletion), and the app asking PostHog which features are switched on for your account or device, using your account ID (or a random device identifier as a guest), which records no usage.
On your first visit we ask whether you want to help improve Rack, with “Allow” and “No thanks” as equal choices. Until you choose, nothing is loaded, recorded or stored, and no request goes to PostHog.
- ●If you allow: PostHog records page views, clicks and errors, your browser and device, and a rough location derived from your IP address, linked to a random identifier stored in your browser (and to your account ID if you sign in). On our public marketing pages only, it may also record your visit as a session recording, with all text and typed input masked and no browser console logs. The signed-in web app, the founding-member page and the coach payment page are never recorded. Claim codes, account IDs, email parameters and ad click IDs are hidden in the web addresses PostHog records
- ●If you choose “No thanks”: PostHog still receives usage events (page views, clicks, errors), but without cookies, without storing anything in your browser, and never linked to your account. PostHog groups them using a one-way hash of your IP address and browser that it rotates regularly, so your visits cannot be followed over time. No session recordings
- ●Vercel Web Analytics counts page views without cookies and without storing anything in your browser, whatever you choose
- ●Changing your choice: use “Privacy choices” at the bottom of our public pages (including this one), or “Share usage analytics” in your account settings, which applies to the browser you set it in, at any time
- ●Strictly necessary storage, set whatever you choose: your sign-in session, temporary sign-in (OAuth) state, your light/dark theme and view settings, and your consent choice itself
You can also ask us at support@rackstrength.com to delete your analytics data. When you delete your account, we ask PostHog to delete your analytics profile, events and recordings.
AI-Powered Features & Data Sharing
Rack Pro members can use optional AI-powered Training Intelligence features (plateau investigation, program adjustment suggestions, and the Training Audit). These features are opt-in and require your explicit consent before activation. Nothing, including your What Rack Knows facts and notes, is sent until you agree on the Training Intelligence consent screen; for any health information in your notes, that agreement is your explicit consent (GDPR Article 9(2)(a)). You can withdraw it at any time by turning Training Intelligence off in Settings.
- ●Exercise names, sets, reps, and weights from recent workouts
- ●Workout dates and session duration
- ●Volume trends and progression data (up to 12 weeks)
- ●Muscle group training load and frequency
- ●Readiness scores (if available)
- ●For the Training Audit, plateau investigation and program adjustments: your top What Rack Knows facts and up to five notes you typed, which may include an injury
Your name, email, account ID, and other personal identifiers are never included in AI requests.
Workout data is sent through Rack's secure server to Amazon Web Services (AWS Bedrock), where it is processed by an AI language model (Anthropic Claude) in AWS's EU regions. This is a third-party AI service.
- ✓Data is encrypted in transit (TLS) between your device, our server, and AWS
- ✓Our server does not store the request. AWS does not share it with Anthropic, and may keep it for a limited time only to detect abuse
- ✓Your data is not used to train, fine-tune, or improve any AI models
- ✓AI requests are not linked to your identity on the AI provider's side
- ✓AWS Bedrock's data protection policies prohibit using customer inputs for model training
Connecting AI Assistants (MCP)
Rack Pro members can connect a third-party AI assistant (such as Anthropic Claude, OpenAI ChatGPT, or Cursor) to their Rack account through the Model Context Protocol (MCP). This is optional and user-initiated: you explicitly connect a client and authorize access over OAuth before any data is shared, and a connected assistant can only ever access your own data.
- ●Read your exercises, routines, completed workouts, and progression history, and the body weight and height on your profile
- ●Create a custom exercise on your behalf
- ●Propose routine changes, which you confirm before they are saved
- ✓Access is granted only after you sign in and approve it via OAuth (PKCE); there are no API keys to share
- ✓Each connection is scoped to your account and is individually revocable at any time
- ✓Rack passes a per-connection token to your AI client; it is not your password or login
- ✓Once connected, the AI assistant is a separate third party that handles your data under its own privacy policy
You can disconnect an AI assistant at any time from within that assistant, which immediately revokes its access to your Rack data.
What We Never Do
Storage & Security
- ●On your device: workouts and settings are stored on your phone
- ●Our servers: account, workout, profile and coaching data are stored in a PostgreSQL database hosted in the United States, encrypted at rest (AES-256) and in transit (TLS)
- ●Photos and videos: stored on Cloudflare R2, encrypted at rest and served only through authenticated links that expire after 15 minutes. They are never public
Progress Photos & Sensitive Data
- ●Voluntary only: photos are never taken or uploaded automatically
- ●Visible only to you and your coach. No one else, including Rack staff, looks at them unless required by law or to investigate a report of abuse
- ●Kept while your account is active. You can delete any photo, or all of them, at any time
- ●Never used for AI training, analytics, advertising, or anything other than showing them to you and your coach
- ●EU/UK residents: body photos in a coaching context may be special category data under GDPR Article 9. We process them based on your explicit consent, requested before your first upload. You can withdraw it by deleting your photos and turning the feature off
Third Parties
We use these companies to run Rack. Each processes data only to provide its service to us.
- ●PostHog (PostHog Inc., US): product analytics, crash reports, website session recordings with your consent (see Analytics above)
- ●Vercel (Vercel Inc., US): hosts this website and counts page views without cookies (Vercel Web Analytics)
- ●Railway: hosts our server
- ●Neon: our PostgreSQL database
- ●Cloudflare R2: stores progress photos and form-check videos
- ●Amazon Web Services (AWS Bedrock) / Anthropic: opt-in AI features only
- ●Resend: sends our emails
- ●Stripe: payments for coaching
- ●Apple: App Store purchases, Sign in with Apple, push notifications, Apple Health
- ●Google: Google Play purchases, Sign in with Google, Android push notifications (Firebase Cloud Messaging), Health Connect
- ●Garmin: the Connect IQ watch app, and Garmin Connect if you link it to send workouts there
- ●Strava: only if you connect it, to sign in or to send your workouts (and a photo, if you add one) there
- ●AI assistants you connect via MCP: only if you connect one
We do not use Google Analytics, Facebook Pixel, or any advertising network.
International transfers: our servers and these providers are in the United States. For users in the EU, UK and Switzerland, PostHog and Vercel are certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, which is the legal basis for those transfers.
Bluetooth: the app uses Bluetooth Low Energy to talk to your Garmin watch during workouts, and to a Bluetooth heart-rate strap if you pair one. It stores the watch's or strap's identifier and name on your phone so it can reconnect. Heart rate from a strap is recorded with your workout, the same way as heart rate from your watch. On Android 11 and earlier, the system requires location permission to find Bluetooth devices; Rack does not use it to record your location.
Retention & Deletion
You can delete your account at any time from Settings. When you do:
- ●Your workouts, routines, exercises, preferences, profile details (date of birth, biological sex, body weight, height), training maxes, progression rules and What Rack Knows facts are permanently removed from our servers within 30 days, including backup copies of our database
- ●Your progress photos, form-check videos and profile picture are deleted from our storage at the same time. If our storage provider is briefly unavailable, we retry, and we remove anything left over by hand
- ●Your coaching relationships end and shared data is removed. Coaching subscriptions paid through Stripe are cancelled. App Store and Google Play subscriptions are not: cancel those in your store settings
- ●We ask PostHog to delete your analytics profile, events and recordings
Deleting a single photo removes it from storage, usually within seconds. “Delete All Data” in Settings, or deleting the app, removes the data on your phone but not your account. Use account deletion for that.
Your Rights
You can request a full export of your data at any time from Settings → Export.
You can delete your account and all associated data at any time from Settings → Delete Account, in the Rack app or on the web dashboard. Deleting your account does not cancel a subscription: cancel App Store or Google Play subscriptions in your store settings.
You can delete, download or export any progress photo at any time, and stop using cloud features, AI features, fact backup or photo uploads without losing local workout tracking.
EU/UK residents: you also have the rights to data portability, rectification, restriction of processing, and to object. Where we rely on your consent (progress photos, What Rack Knows backup, AI features), you can withdraw it at any time.
California residents: you have the right to know what we collect, to request deletion, and to opt out of sales. We do not sell personal information.
Children's Privacy
Rack is not directed at children under 13 (16 in the EU/UK). We do not knowingly collect personal information from children. Progress photos require users to be 18 or older.
Changes to This Policy
We may update this policy from time to time. For material changes (such as new categories of data collection or new third-party processors), we will notify you via in-app notification at least 14 days before the change takes effect. Changes are reflected in the “Last updated” date at the top and in the change log below.