Privacy Policy

Effective date: June 12, 2026 · Last updated: July 31, 2026

• 1. Who we are
• 2. Information we collect
• 3. How we use your information
• 4. Legal bases for processing
• 5. Sensitive data and the AI Coach
• 6. Crews, public profiles, and sharing
• 7. Referrals
• 8. How we share information
• 9. Cookies and local storage
• 10. Data retention
• 11. How we protect your data
• 12. Your rights and choices
• 13. Children's privacy
• 14. International data transfers
• 15. Changes to this policy
• 16. Contact us

1. Who we are

SetStreak ("SetStreak", "we", "us", or "our") is a workout tracking and fitness social service operated by Nexint. This Privacy Policy explains what personal information we collect when you use SetStreak at setstreak.com and the associated web application (together, the "Service"), how we use and share it, and the choices and rights you have. By using the Service, you agree to the practices described here.

2. Information we collect

Information you provide

• Account information. When you create an account, we collect your email address and a password, and we record that you confirmed you are at least 13 years old. Your password is never stored in readable form — it is protected using a strong one-way hashing algorithm (Argon2id) and cannot be recovered by us. You may also optionally provide a display name.
• Workout content. The information you enter into the app: your workout plan and any edits to it, exercises, sets, weights, reps, cardio sessions, weekly goals, streaks, personal records, and badges. This is stored as your private data and is not shared unless you choose to.
• Profile and cosmetics. If you set up a public-facing profile you may choose a unique handle (e.g. @yourname), a short bio, and cosmetic flair or themes.
• Coach profile (optional, sensitive). If you use the AI Coach or meal-planning features, you may provide details such as your sex, age, height, weight, body-fat percentage, activity level, training experience, goals, injuries, and dietary preferences, restrictions, or allergies. See Sensitive data and the AI Coach.
• Social activity. If you join or create a crew, we store your crew membership, the workouts or activity you choose to share to your crews, reactions, crew polls and your votes, optional "currently lifting" presence (off unless you turn it on), and optional gym check-ins.
• Gym check-ins and location. Checking in to a gym is optional. If you use "find gyms near me", your device asks for your location and uses it in your browser to search OpenStreetMap for nearby gyms; the coordinate is then discarded. When you pick a suggested gym, what reaches our servers is which public gym you picked — the gym's identity and the gym's map coordinates, which are attributes of that public place shared by everyone who checks in there. To verify you are actually at the gym for leaderboard credit, your device sends its position once with the check-in; our server compares it against the gym's stored coordinates in that request and discards it. Your coordinates are never written to our database. There is one exception, and it is one you create deliberately: the optional Home Gym feature. Your first Home Gym check-in saves that spot's location as your home gym's pin — for many people, that is their home. The pin is used for exactly two things: verifying your own later Home Gym check-ins (your position is compared against it and discarded, the same as at a public gym) and resolving your city for city-level leaderboards. Only you can create it, only our check-in verification reads it, and it is deleted with your account. Automated tests enforce that stored coordinates exist in exactly two places: public gyms, and your own home-gym pin.
• Nutrition and body data. If you use the food diary, we store the foods you log, your macro targets, and any weigh-ins you record, as part of your private workout data. Barcode scanning happens on your device; when you look up a barcode, our server queries food databases with the barcode number only.
• Progress photos (optional, premium). If you use progress photos, we store the photos you take, each photo's date, and its storage metadata. Photos are captured through the app's camera flow, which re-encodes the image on your device before upload — this strips camera metadata (EXIF), including any GPS position, so it never leaves your device. Progress photos are visible only to you: they are never shown on your public profile, never shared to crews, and never sent to AI providers. See Section 6.
• Communications and reports. If you email us, or submit a safety report about another user, we receive your message and the details you include so we can respond.

Information we collect automatically

• Technical and security data. Our servers record standard information such as your IP address and request timestamps. We use this to operate the Service securely — for example, to apply rate limits that protect our sign-in, sign-up, and password endpoints against abuse, and to help prevent referral fraud.
• Cookies. We set a small number of essential and functional cookies, described in Cookies and local storage. We do not use advertising or cross-site tracking cookies.
• On-device storage. The app stores a copy of your workout data in your browser's local storage so it works smoothly and remains available offline. This stays on your device and is cleared when you log out.

We do not use third-party advertising networks, analytics SDKs, or social media trackers, and we do not sell your personal information.

3. How we use your information

We use the information above to:

• provide and operate the Service — creating your account, storing your workouts, and syncing them across your devices;
• calculate features such as your streaks, weekly progress, personal records, muscle-coverage maps, Effort Score, and season progress;
• run social features you choose to use, such as crews, shared activity, reactions, and streak protection;
• generate optional AI Coach responses, training guidance, and meal plans when you request them (see Section 5);
• operate public profiles and the referral program when you opt in (see Sections 6 and 7);
• process payments for premium features through our payment provider (see Section 8);
• send you service-related emails, such as email verification, password resets, and notifications you've enabled (these are transactional, not advertising);
• keep the Service secure, prevent abuse and fraud, and diagnose and fix problems; and
• comply with legal obligations and enforce our Terms of Service.

We do not use your data to build advertising profiles, and we do not sell it.

4. Legal bases for processing

For users in the European Economic Area (EEA) and the United Kingdom, we process personal data on the following legal bases: to perform our contract with you (providing the Service you signed up for); our legitimate interests in keeping the Service secure, reliable, and free from abuse and fraud; your consent (for optional features such as the AI Coach's use of health information, public profiles, and non-essential cookies); and to comply with legal obligations. Where we rely on consent, you can withdraw it at any time.

5. Sensitive data and the AI Coach

The AI Coach and meal-planning features are optional. If you use them, you may choose to provide health-related information — such as your sex, age, height, weight, body-fat percentage, injuries, and dietary restrictions or allergies. In some jurisdictions this is treated as a special category of personal data, and we process it only with your explicit consent and only to generate the guidance, plans, and nutrition estimates you ask for.

When you send a message to the AI Coach, your message and the relevant parts of your coach profile are transmitted to our AI provider, Anthropic, to generate a response. If you use the coach's voice playback, the coach's reply text is processed by Mistral AI (Voxtral) to generate the audio you hear. Voice input was removed from the product in July 2026; your microphone is not used. These providers process the data to return a result to us; we do not authorize them to use your content to train their models. Your data is sent to these providers only when you actually use the relevant coach feature.

Meal plans are generated by an on-server engine from your profile. The shopping-list "order" buttons are external links to third-party retailers (such as Instacart, Walmart, and Amazon). If you click one, you leave SetStreak and go to that retailer's website, which is governed by its own privacy policy; we do not transmit your account data to those retailers beyond the link you choose to open.

Your coach profile and any health information are never displayed on your public profile or share card, regardless of your settings.

6. Crews, public profiles, and sharing

Crews. Crews are private groups you join or create. Members of a crew can see the activity and limited profile information that members share within that crew. Don't share anything in a crew you wouldn't want other members to see.

Public profiles (SetStreak Pulse). Your profile is private by default. You can choose to publish a public profile at setstreak.com/@yourhandle, which is viewable by anyone on the internet. When you publish, you control which sections are shown — for example your streak, headline stats, personal records, growth charts, muscle map, crews, or bio. The following are never made public, regardless of your settings: your email address, your real name (unless you specifically opt in), body metrics, weigh-ins, sex, age, injuries, dietary information, food diary, progress photos, your gym check-in history, and crew member lists. (Joining a gym leaderboard shows that you are on that gym's board — see the leaderboard paragraph below — never when you checked in.) Public statistics are self-reported by your device, except your streak and consistency score, which we verify server-side. You can switch your profile back to private at any time, which removes the public page.

Search indexing. Public profiles are not indexed by search engines unless you turn on the indexing option for your profile and we have enabled discoverability platform-wide. If indexed, your public content may be cached or shown by search engines outside our control.

Share cards. The shareable stats card is generated on your device. When you share it, it goes to whatever app, platform, or person you send it to, and what happens to it there is outside our control.

Streak leaderboards. Leaderboards are opt-in and off by default. If you join, a board entry shows exactly four things: your handle, your streak length, how many of those weeks were protected by a Streak Save, and your rank. Your geographic boards (gym, city, state, region, country) are derived from the public gyms you check in at — the city and state are attributes of the gym, resolved once from the gym's map coordinates. A board entry carries no coordinate, no address, and no check-in time. Appearing on a gym's board additionally requires repeated, location-verified check-ins at that gym, so a board reflects where you actually train. You can leave all boards at any time in settings, which removes you from every board immediately, including the global one.

Progress photos. Progress photos are the most private data in the product and are treated that way: they are visible only to you, in your own logged-in account. There is no setting that publishes them — they are excluded from public profiles, crews, share cards, and AI features by design, not by a toggle. They are stored in a private, encrypted storage bucket with all public access blocked, and your device uploads them directly to that bucket over an authenticated, time-limited link. Deleting a photo removes both the record and the stored image; deleting your account removes all of them.

No image analysis. We do not run facial recognition, body measurement, or any other biometric or content analysis on your photos, and we do not derive data from them. Our systems store the image bytes and serve them back to you; the progress montage is assembled from your photos on your device, so the images are never processed server-side at all.

7. Referrals

If you use the referral program, your invite link contains a referral code. When someone visits a referral link, we set a short-lived cookie to credit the referrer if that person signs up (see Cookies). To prevent fraud and abuse, when an account is created we record the sign-up IP address (and a coarse network prefix), a normalized form of the email address, and a basic device signal, and we may place rewards on hold for review. Referral rewards are in-app Streak Saves, which have no monetary value. You can ignore the program entirely; it has no effect unless you share a link or arrive through one.

8. How we share information

We do not sell your personal information. We share it only in these limited situations:

• Service providers (subprocessors). We use trusted providers to run the Service, each processing data on our behalf for the purpose shown:
  • Amazon Web Services (AWS) — cloud hosting, database, and private encrypted storage for progress photos (Amazon S3).
  • Amazon Simple Email Service (SES) — delivery of account and notification emails.
  • Stripe — payment processing for premium features. Stripe collects and processes your payment details directly; we do not receive or store full card numbers.
  • Anthropic — generating AI Coach responses, when you use the coach.
  • Mistral AI — text-to-speech for the coach's voice playback, when you use it.
• Lookup services. Some features query public data services with non-identifying inputs: your browser queries OpenStreetMap services (Overpass, Nominatim) directly for nearby-gym and gym-name search, our server queries Nominatim once per newly seen gym to resolve that gym's city from the gym's coordinates, and barcode lookups that miss our own food database query Open Food Facts with the barcode number only, and the gym picker loads recognized gym chains' icons from a favicon service (the request names the gym brand's website). None of these requests carry your account identity.
• Push notifications. If you enable notifications, your browser's push service (operated by your browser vendor, e.g. Google, Apple, or Mozilla) delivers them. We store the push subscription endpoint your browser issues; message payloads are encrypted to your browser.
• Other users, when you choose. Information you share to a crew, publish on a public profile, or include in a share card is visible to the people who can access those surfaces, as described in Section 6.
• Third-party links. Meal-plan order buttons link to external retailers; using them is subject to those retailers' own policies.
• Legal and safety reasons. We may disclose information if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, safety, and security of our users, the public, or SetStreak.
• Business transfers. If SetStreak or Nexint is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will continue to protect it consistent with this policy and notify you of any material change.

9. Cookies and local storage

SetStreak uses a small number of cookies:

• Session cookie (essential). After you log in, we set a single authentication cookie to keep you signed in. It is set with HttpOnly, Secure, and SameSite=Lax attributes, is not readable by scripts, and is used only for authentication. Because it is strictly necessary to provide the Service, it does not require consent.
• Referral cookie (functional). If you arrive through a referral link, we set a signed, HttpOnly cookie that records the referral code for a short period (around two weeks) so we can credit the referrer if you sign up. It is not used for advertising or cross-site tracking.

We also use your browser's local storage to cache your workout data on your device for offline use and faster loading. You can clear it at any time by logging out or clearing your browser data.

10. Data retention and account deletion

We keep your account and workout data for as long as your account is active so that the Service works for you.

You can delete your account yourself in Settings → Delete account (it requires your password, because it is irreversible), or by emailing us. Deletion takes effect immediately and does the following:

• Your workout data, food diary, weigh-ins, progress photos (records and stored images), coach profile, coach conversation history, check-ins, sessions, and push subscriptions are deleted.
• Any public profile is taken down and its snapshot deleted; you leave every crew and every leaderboard.
• Your account record is anonymized: the email address is replaced with a random tombstone (which frees your address for a fresh signup later), the password hash is destroyed, and the name is cleared.
• What is retained: purchase and payment records, anonymized, because accounting and tax law requires it; and your crew's already-settled weekly history, which belongs to the whole crew — those rows point at the anonymized record, so they identify no one. Any active paid subscription is cancelled at Stripe as part of deletion.

Residual copies may persist for a short period in routine backups before being overwritten, and we may retain limited information where required to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements.

11. How we protect your data

We use industry-standard safeguards to protect your information, including:

• encryption of all traffic in transit using HTTPS/TLS;
• one-way hashing of passwords (Argon2id) so they are never stored in readable form;
• storing authentication and email tokens only in hashed form, with automatic expiry;
• strict separation of each user's data so one account cannot access another's;
• allow-listed, minimized public profiles that exclude sensitive fields by design; and
• limiting internal access to what is needed to operate the Service.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your login credentials confidential.

12. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Access the personal data we hold about you.
• Correct your data — you can edit your profile and workout data directly in the app at any time.
• Delete your account and associated data yourself, in Settings → Delete account (see Section 10 for exactly what deletion does).
• Export a copy of your workout data.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent (for example, by turning off your public profile or no longer using the AI Coach).

To exercise any of these rights, contact us at privacy@setstreak.com. We will respond within the timeframe required by applicable law. You will not be discriminated against for exercising your rights.

EEA and UK residents

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data lawfully.

California residents

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we have not done so in the preceding 12 months. California residents may exercise their rights to know, delete, and correct by contacting us at the address above.

13. Children's privacy

SetStreak is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or the minimum age required in your jurisdiction). We require you to confirm you are at least 13 when you sign up, and we record that confirmation. Public profiles and public sharing features are not intended for users under 18. If you believe a child has provided us personal information, please contact us and we will delete it.

14. International data transfers

SetStreak is operated from, and stores data on cloud infrastructure located in, the United States. Some subprocessors (such as our AI providers) may process data in other locations. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States and possibly elsewhere, where data protection laws may differ from those in your country.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, and for material changes we will take reasonable steps to notify you. Your continued use of the Service after an update means you accept the revised policy.

16. Contact us

Questions, requests, or concerns about this policy or your personal data? Reach us at: