Privacy Notice

This notice explains how Workout Express collects and uses personal data. Workout Express is the data controller for the personal data described here — we decide why and how it is processed.

1. Personal data we collect

• Account data — email address and login credentials.
• Profile and training data — display name, workouts, logged sets, reps, weights, session notes, program completion, streaks and nutrition plan progress.
• Subscription data — plan, status and billing period for your account.
• Support data — messages you send us.
• Technical data — IP address, device identifiers, browser type, and usage and error telemetry.

2. Why we use it and our legal basis

• Creating your account and providing the Service, including saving your workouts and progress — performance of a contract.
• Managing your subscription and access to Premium features — performance of a contract.
• Security, abuse and fraud prevention — legitimate interests.
• Improving and debugging the product — legitimate interests.
• Customer support — performance of a contract / legitimate interests.
• Marketing emails, where sent — consent, which you can withdraw at any time.
• Meeting legal and accounting obligations — legal obligation.

3. Who we share it with

• Service providers / subprocessors — hosting, database, authentication, analytics and support tooling providers acting on our instructions.
• Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell your personal data.

4. International transfers

Some providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. Retention

We keep account and training data for as long as your account is active, and for up to 12 months after deletion or prolonged inactivity, unless a longer period is required for legal, tax or dispute-resolution purposes. After that it is deleted or anonymised.

6. Your rights

Depending on where you live, you may have the right to access, rectify, erase, restrict or port your data, to object to processing, and to withdraw consent. You also have the right to complain to your local data protection supervisory authority. We respond to requests within one month. Contact support@workoutexpress.fit.

GDPR (UK/EEA residents). You have the rights listed above under the UK GDPR and EU GDPR, including access, rectification, erasure, restriction, portability, objection and withdrawal of consent, plus the right to lodge a complaint with your supervisory authority.

CCPA/CPRA (California residents). You may request to know the categories and specific pieces of personal information we collect, the purposes for collecting it and the categories of third parties we disclose it to; request deletion or correction; and request to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioural advertising, and we do not use sensitive personal information for inferring characteristics. We will never discriminate against you for exercising these rights. Submit a request — including through an authorised agent — to support@workoutexpress.fit; we verify requests using the email address on your account and respond within 45 days.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls and row-level database security so users can only read their own records.

8. Cookies and local storage

We use essential cookies and browser local storage to keep you signed in and to remember your program progress and preferences. Any analytics or marketing cookies are only set with your consent, and you can manage them through your browser settings.

9. Contact

Workout Express — support@workoutexpress.fit.