Who we are
This policy applies to the WorkOut.fit website and web app, also presented in the product as Plan4Strength. It is a browser-based workout planner: you generate plans for your gear and schedule, run timed sessions, and (when signed in) save history and body-weight logs.
There is no native mobile app. This site is hosted on Render (Oregon, United States).
What we collect
We only store data needed to run the service you asked for:
- Account. Email address and a hashed password if you register, or an identifier from Google or Microsoft if you sign in with those providers (when they are configured).
- Workout plans you choose to save.
- Workout sessions you complete while signed in: plan name, date, duration, exercises, sets, reps, and optional working weights (stored in kilograms).
- Body weight entries you log (stored in kilograms; the kg/lb switch is a display preference on your device).
- Preferences such as default equipment, music style, volume, and last-used planner settings.
- Exercise ratings and notes you add (likes, dislikes, private notes).
- Feedback you submit: the message, optional contact email, page URL, browser user-agent, and a hashed IP address used only to limit spam. We do not store a raw IP.
We do not collect GPS, contacts, photos from your device camera roll, health-kit data, or payment card details. You can generate and run a plan without an account; unsigned sessions are not stored in History.
How we use it
- To sign you in and keep you signed in.
- To generate, save, and display your plans, sessions, and body-weight history.
- To remember planner and runner preferences.
- To receive and respond to feedback, and to send a password-reset email if you request one and email is configured.
- To keep the service working (hosting, backups of the application database, abuse prevention).
We do not sell your data. We do not use it for advertising. We do not run third-party analytics or advertising pixels on this app.
Cookies, local storage, and sign-in
When you sign in, we set an HttpOnly authentication cookie (SameSite=Lax; Secure in production) so the browser can call our APIs. That cookie is used for authentication only — not for tracking across other sites.
The app also uses browser local storage on your device for things like the current plan, an in-progress workout you can resume, the kg/lb display unit, and high-contrast mode. A service worker may cache static pages and assets so the app loads faster offline. Cached files stay on your device.
We do not use advertising cookies or third-party tracking cookies.
Third parties
- Hosting. The app and its database run on Render. They process the account and workout data described above in order to host the service.
- Google and Microsoft sign-in. Optional. Shown only when those providers are configured. If you tap Google or Microsoft, that provider authenticates you and we receive a name/email identifier to create or sign in to your local account. We do not receive your provider password.
- Email delivery. If SMTP is configured, password-reset and (for operators) feedback notification emails are sent through that mail provider.
- Exercise media. Demo photos may be loaded from public GitHub-hosted exercise images. Video search and ExRx links open in a new tab when you choose them; we do not upload your workouts there.
- Strava. Not connected. A future, optional Strava connection may let you share workouts you choose to share. We will not post to Strava, read your Strava activity, or share session data with Strava unless you opt in. This policy will be updated if that feature ships.
Your control and deletion
- You can use the planner without creating an account.
- You can sign out at any time. That clears the session cookie.
- You can delete individual body-weight entries from the dashboard.
- You can clear local storage in your browser to remove the on-device plan, resume snapshot, and unit preference.
- To access, correct, or delete your account and stored workout data, use the Feedback page (category “Other”) and say you want your data deleted. We will delete the account and associated plans, sessions, preferences, ratings, notes, body-weight logs, and feedback tied to that account.
There is no in-app “delete account” button yet; a written request through Feedback is the supported path.
Children
WorkOut.fit / Plan4Strength is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes
If we add a feature that changes what we collect or share (including an optional Strava connection), we will update this page and the “Last updated” date.
Contact
Questions about privacy, or a request to delete your data, can be sent through the Feedback page on this site. That is the public contact channel for WorkOut.fit / Plan4Strength.