Progressive Overload
Privacy Policy
Last updated: 8 August 2026
Progressive Overload is a gym tracking app. It stores the workouts you log so it can show you whether you are getting stronger. It does not run ads, does not track you across other apps, and does not sell your data to anyone.
This policy explains what the app collects, why it needs it, who it is shared with, and how to get rid of it. It applies to the Progressive Overload mobile app and this website.
Who we are
Progressive Overload is an independent app developed and operated by Thaïs Fontes in Québec, Canada, acting as the data controller for the information described below. You can reach us at privacy@progressive-overload.ca.
Person in charge of the protection of personal information: Thaïs Fontes, reachable at privacy@progressive-overload.ca. Québec's Law 25 requires us to designate this role and publish how to contact them, so this is who handles access, correction and deletion requests, and any privacy complaint.
What we collect
We only collect what the app needs in order to work. There is no hidden collection.
| Data | Why we need it |
|---|---|
| Email address | To create your account, sign you in, and let you reset your password. |
| Display name, and an optional username | So friends and coaches can recognise you. |
| Body diagram preference (female or male) | Optional. Chooses which anatomy illustration the muscle map draws. It is a drawing preference, nothing more, and you can leave it unset. |
| Workout data — exercises, sets, reps, weight lifted, hold duration, and the date of each session | This is the app. It is what the progress charts, personal records and recovery map are calculated from. |
| Programs and routines | Your training plan and the order you like it in. |
| Friends, coaching links and challenges | Only created when you deliberately share a friend code or accept an invitation. |
| Subscription status | Whether you have an active PO Pro subscription, so the app knows what to unlock. |
What we deliberately do not collect
- No body weight, body-fat percentage, measurements, height or age.
- No location data of any kind.
- No contacts, photos, camera, microphone or files from your device.
- No health data from Apple Health, Google Fit or Health Connect. The app does not connect to them.
- No advertising identifiers, and no analytics or attribution SDKs.
How your data is used
Your data is used to operate the app: to keep you signed in, store and display your training history, calculate your progress, and show your workouts to a coach or friend when you have explicitly linked to them. We do not use it for advertising, profiling or automated decision-making, and we never use it to train AI models.
Our lawful basis for processing is the performance of our contract with you — providing the app you signed up for — together with your consent for anything optional, such as the body diagram preference or linking with a coach.
Who your data is shared with
People you choose
Nothing is shared with another user until you act. Adding a friend requires you to share your friend code. A coach you approve can see your logged workouts, edit your program and log sets on your behalf. Removing them ends that access immediately. Challenge titles, descriptions and rewards are visible to the friend you send them to.
Service providers
We rely on a small number of processors, and nothing beyond this list:
- Supabase — database, authentication and hosting. Your data is stored in Supabase's Canadian region (ca-central-1). Privacy policy
- Expo — delivers over-the-air app updates. Privacy policy
- RevenueCat — manages subscription status. It receives an anonymous subscriber ID and your purchase history, not your workouts. Privacy policy
- Google Play — processes payments. We never see or store your card details. Privacy policy
- YouTube (Google) — a small number of exercises we have not yet illustrated ourselves still link to a demonstration video on YouTube. Opening one of those exercises loads its thumbnail from YouTube, and tapping play loads YouTube's own player, so Google receives your IP address and may set cookies exactly as it would on their website. We send them nothing about you or your training. We are replacing these with our own animations and will remove the dependency entirely when that is finished. Privacy policy
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We may disclose data if legally required to, and we will tell you unless we are prohibited from doing so.
Security
All traffic between the app and our servers is encrypted with HTTPS, and data is encrypted at rest by our hosting provider. Every database table is protected by row-level security policies, enforced at the database itself, so one account cannot read another account's data even if the app were modified. Passwords are salted and hashed; we never see them.
How long we keep it
Your data is kept for as long as your account exists, because the entire point of the app is a training history that goes back years. When you delete your account, it is removed immediately and permanently — see below. Encrypted backups are cycled out within 30 days.
Deleting your account and data
You can delete your account and everything in it at any time, from inside the app: Settings → Danger zone → Delete account.
This removes your profile, every set you have logged, your programs and routines, your friend and coaching links, and your challenges. It is immediate and irreversible. There is no deactivated or archived state, and nothing is retained for later.
If you have already uninstalled the app, request deletion on the account deletion page.
Cancelling a subscription is separate and is handled by Google Play. Cancelling does not delete your account, and deleting your account does not automatically cancel a subscription — please cancel it in Google Play as well.
Your rights
Depending on where you live — including under Québec's Law 25 and Canada's PIPEDA, the GDPR in Europe and the UK, and state privacy laws in the United States — you have the right to access your data, correct it, delete it, obtain a portable copy, withdraw consent, and object to or restrict processing.
Most of these are built into the app: you can edit your profile in Settings and delete everything from the Danger zone. For a portable copy of your data, or anything else, email privacy@progressive-overload.ca and we will respond within 30 days. You also have the right to complain to your local data protection authority — in Québec, the Commission d'accès à l'information.
Children and minors
Progressive Overload is intended for adults. You must be at least 18 years old to create an account. The app is not directed at children or teenagers, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email privacy@progressive-overload.ca and we will delete it.
International transfers
Your data is stored in Canada. Some of our service providers are based in the United States, so limited data — such as your subscription status — may be processed there under appropriate safeguards, including standard contractual clauses.
Not a medical service
Progressive Overload is a fitness tracking tool. It is not a medical device, it does not provide medical advice, diagnosis or treatment, and nothing it shows you should be treated as such. Consult a qualified physician before starting or changing any exercise programme. We never use your data for insurance, credit or employment decisions, and we never sell health or fitness data.
Changes to this policy
If this policy changes materially we will update the date at the top and notify you in the app before the change takes effect. Continuing to use Progressive Overload after that means you accept the updated policy.
Contact
Questions, requests or complaints: privacy@progressive-overload.ca.