Workouter Privacy Policy

Information We Collect

• Account Information. When you create an account, we collect information such as your email address and password (or, if you sign in through a third-party provider, the basic profile information that provider shares with us).
• Workout Data. The core function of Workouter is letting you build workouts. This includes the exercises, intervals, durations, targets, and workout structure you create, along with any names or notes you give your workouts. This data is provided directly by you — Workouter does not access your device's GPS location and does not collect biometric or health readings (such as heart rate) directly. Workout-type settings, such as whether a swim is logged as pool or open water, describe the workout itself rather than your physical location or health status. By default, workouts you save are visible to other signed-in Workouter users in our public workout library alongside your handle (see How We Share Information below), and you can mark a workout private at any time to keep it visible only to you.
• Workout Photos. If you send us a photo of a workout, such as a whiteboard, we store the photo and use it to build your workout. When you send a photo from our website, your browser removes its location and other embedded metadata before it is uploaded. To stop the same photo being processed repeatedly, we keep a fingerprint of each photo and a keyed, non-reversible code derived from the IP address that sent it.
• Technical and Usage Data. We automatically collect certain information when you use the Service, including IP address, browser and device type, pages visited, and general usage patterns. We use this to keep the Service running reliably and to understand how it's used.
• Analytics. We use Google Analytics to understand aggregate usage of the Service, such as which pages are visited, how often, and how users navigate the Service. Google Analytics uses cookies and similar technologies to do this, and Google's handling of this data is governed by Google's own privacy policy.
• Advertising. To measure how our Facebook, Instagram, TikTok, and Google ads perform and to show you relevant ads, we use server-side conversion reporting — Meta's Conversions API, TikTok's Events API, and Google's Measurement Protocol — and browser-based pixels from Meta and TikTok. When you subscribe, or when you sign up after arriving from one of our ads, we send the relevant platform a record of that event from our own servers — matched using an ad click identifier (captured from the ad link you clicked) and a hashed, non-reversible version of your email address — so it can attribute the sign-up or subscription to the right ad campaign. If you didn't arrive from an ad, your sign-up is not reported to Meta or TikTok. Separately, with your consent (see Cookies and Similar Technologies below), we load Meta's and TikTok's tracking scripts in your browser. These scripts set their own cookies and may collect information such as pages you visit on the Service, so these platforms can show you relevant ads (including ads for Workouter after you visit, known as retargeting) and build similar audiences for ad targeting. These platforms may combine this information with other information they already have about you, including from a Facebook, Instagram, TikTok, or Google account, in accordance with their own privacy policies.
• Payment and Subscription Information. If you subscribe to a paid plan, your payment is processed by Stripe, Inc. We do not collect or store your full card number — Stripe handles that directly and is responsible for its own PCI-compliant security. We do receive and store limited billing-related information from Stripe, such as your subscription plan, billing status, and a Stripe customer identifier, so we can manage your subscription.
• Phone Number and Text Messages. If you choose to text us a workout — including a photo of one written on a whiteboard — or use SMS codes to log in, we collect your phone number and the content of that message, including any photo you send. We use AI providers, currently Google and Anthropic, to analyze photos and extract workout details, and use your phone number to send you responses and one-time login codes. We retain the photos, messages, and the prompts we send to our AI providers to process them — including to review and improve the accuracy of this feature and to train and improve our AI models — as described in Data Retention below. Messages are sent and received through Twilio; messages you send via WhatsApp also involve Meta Platforms, Inc., which operates the WhatsApp Business Platform — separate from Meta's role as an advertising partner described below.
• AI Assistant Connections. You can choose to connect your Workouter account to a third-party AI assistant, such as Claude (Anthropic), ChatGPT (OpenAI), OpenClaw, or Meta's Muse, using our connector (built on the Model Context Protocol, or MCP). When you authorize a connection, that assistant can access the account data you permit — such as your workouts (including private ones), your usage quota, and delivery status — and, where supported, create workouts or send them to your watch on your instruction. We record which assistant is connected and what it requests, so we can operate and secure the connection. Connections are off until you set them up, and you can revoke access at any time in your account settings.

  Once data reaches an assistant, it is handled under that provider's own terms and privacy policy, not ours. We don't control what these providers do with it, which may include retaining it or using it to train their models, depending on your settings with them. OpenClaw can be self-hosted, in which case your data goes wherever your own setup sends it. Only connect assistants you trust, and review their privacy practices first.

• Android App and Garmin Watches. Our Android app can send workouts to a paired Garmin watch over Bluetooth. To do this, we use basic information about your watch, such as its model, to make sure the workout is compatible. The app also uses an identifier for your app installation, and removes location and other embedded metadata from photos you share into it before uploading them. The app also sends diagnostics about workout generation, including a random request identifier, outcome, time, response status and app version. We receive the installation identifier and hash it in diagnostic logs. These reports contain no workout text. Reports can be stored on your device for up to seven days before upload and are removed from service logs after 30 days.
• Information We Do Not Collect. We do not collect precise device location, and we do not directly collect biometric or health readings (such as heart rate).

How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service, including generating Apple Watch– and Garmin-compatible workout files from the workouts you create
• Create and manage your account
• Process payments and manage your subscription through Stripe
• Save your workouts so you can return to them
• Build a workout from a text message or photo you send us, and deliver it to your Apple Watch or Garmin watch
• Review and improve the accuracy of that AI feature, and train and improve our AI models, using the photos, messages, and prompts involved
• Send SMS codes if you choose to log in that way
• Let AI assistants you connect read and create workouts on your behalf
• Enable future features, such as sharing a workout with other users, where you choose to do so
• Monitor, debug, and improve the Service
• Measure and deliver advertising, including through Google, Meta/Facebook, and TikTok advertising tools
• Communicate with you about your account or changes to the Service
• Comply with legal obligations

How We Share Information

We may share information with:

• Service providers who help us operate Workouter, such as our hosting provider and database provider, under obligations to protect your data
• AI model providers. To build workouts, we send the descriptions and photos you give us to AI model providers that process them on our behalf, currently Google and Anthropic
• Payment processor. Stripe, Inc. processes your payment information on our behalf, subject to Stripe's own privacy policy
• Messaging provider. Twilio, Inc. sends and receives our SMS, MMS, and WhatsApp messages on our behalf. Messages sent via WhatsApp also involve Meta Platforms, Inc., which operates the WhatsApp Business Platform
• AI assistants you connect. If you connect Claude (Anthropic), ChatGPT (OpenAI), OpenClaw, Meta's Muse, or another assistant to your account, we share the account data you authorize with that provider at your direction. Its handling of that data is governed by its own privacy policy
• Advertising and analytics partners. We use Google Analytics, which shares usage information (such as pages visited) with Google LLC, including server-side sign-up and subscription event reporting through Google's Measurement Protocol for analytics and Google Ads conversion tracking. We also share information with Meta Platforms, Inc. and TikTok through Meta's Conversions API and TikTok's Events API so we can measure and optimize ad performance: server-side conversion reporting (matched via a hashed email address and ad click identifier) reports the subscription event, and a sign-up when you arrived from one of our ads, and, with your consent, browser-based pixels from each platform share usage information such as pages visited, so these platforms can also show you relevant ads and build similar audiences for ad targeting
• Other users. Workouts you create are included by default in a public workout library, visible to other signed-in Workouter users alongside your handle. The library is only visible to other signed-in users of the Service, not to the general public or search engines. You can mark a workout private at any time to remove it from the library.
• Legal or safety reasons, if required by law, or to protect the rights, safety, or property of Workouter, our users, or others
• In connection with a business transfer, such as a merger or acquisition, subject to standard confidentiality protections

We do not sell personal information in exchange for money. However, our use of advertising tools like Google's Measurement Protocol, Meta's Conversions API, TikTok's Events API, and browser-based pixels may be considered a "sale" or "share" of personal information for cross-context behavioral advertising under laws like the California Consumer Privacy Act (CCPA). See Your Rights below for how to opt out.

Data Storage and Security

Workout and account data is stored in a PostgreSQL database. We use reasonable administrative and technical safeguards to protect your information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

We retain your account and workout data for as long as your account is active, or as needed to provide the Service. You can delete your account yourself, immediately, in the Workouter iPhone app (Settings, then Account) or on your account page on workouter.co; this also cancels any subscription and disconnects apps connected to your account. You can ask us to delete your account by emailing developers@workouter.co. When we delete your account, we will delete or anonymize your personal information within 30 days of your request, including any workouts you created, whether private or previously public. Some information is retained longer where required — for example, billing records needed for tax and accounting purposes are kept for the period required by law. If another user has already copied one of your public workouts into their own account, that copy remains with them, since it's no longer solely your data once copied. Deleting a workout, or marking it private, removes it from the public workout library. Deleted data may also briefly persist in backups for a limited time before being purged. Service logs, which can include your account identifier, are deleted automatically after 30 days. When your account is deleted, we keep a record of the cost of each AI request made for it, without your text or any link to you, and usage events already sent to our analytics and advertising partners stay with them.

We keep workout photos you send after your workout is built, to improve Workouter, including to train and evaluate the models that read workouts from photos. Deleting your account deletes the photos you sent while signed in. To have photos you sent without an account deleted, contact us. Photos and messages you text us, and the prompts we send to our AI providers to process them, are retained rather than deleted after processing, so we can review and improve the accuracy of this feature and train and improve our AI models. If you'd like your content excluded from AI training while still using this feature, contact us at developers@workouter.co.

Cookies and Similar Technologies

We use cookies or similar technologies for:

• Essential functions, such as keeping you signed in and processing payments
• Analytics, through Google Analytics, to understand usage of the Service (see Information We Collect above)
• Advertising attribution, to remember which ad (if any) brought you to the Service, so a resulting subscription can be matched and reported to our advertising partners (see Information We Collect above)
• Sign-up attribution, a first-party cookie that remembers the campaign link, ad network, or website (its domain only) that first brought you to the Service, saved to your account if you sign up. We use it only to measure which channels bring people to Workouter, and we don't share it with anyone
• Advertising and retargeting, through Meta's and TikTok's browser pixels, so those platforms can show you relevant ads and measure their performance (see Information We Collect above)

When you first visit the Service, a cookie banner asks whether you accept or reject analytics and advertising cookies. Essential cookies are always set, since the Service cannot function without them. If you accept, Google Analytics and the Meta and TikTok pixels are enabled for that browser; if you reject, or before you make a choice, none of them run. You can change your choice at any time by clearing your browser's cookies/site data for workouter.co and revisiting the Service, which will show the banner again, or through your browser settings directly. If you are in California or another state with a similar law, you can also opt out of this use through the mechanism described in Your Rights below.

Your Rights

If you are in the European Economic Area or United Kingdom (GDPR):

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent

Our legal bases for processing your data include performing our contract with you (providing the Service), your consent (for example, for analytics and advertising cookies), and our legitimate interests in operating and improving the Service.

If you are a California resident (CCPA/CPRA):

You have the right to:

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — you can do this by contacting us at developers@workouter.co. We honor opt-out preference signals such as Global Privacy Control (GPC) where required by law
• Not be discriminated against for exercising these rights

To exercise any of these rights, contact us at developers@workouter.co.

Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it.

International Data Transfers

Workouter is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for such transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date above or through other reasonable means. We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

Workouter LLC

784 S. Clearwater Loop, STE R

Post Falls, ID 83854, USA

developers@workouter.co