Privacy Policy

Resistance is a strength-training log. To do its job it holds personal information: what you lift, what you weigh, how you slept, what hurts, and whatever you tell Coach. This page says what we collect, what leaves our servers and to whom, how long we keep it, and how to get it back or delete it.

Resistance is operated by Percival Labs LLC, a Texas limited liability company, which is the data controller for everything described here. Write to privacy@rezist.ai about any of it.

The subprocessor list goes with this page. It names every outside company that can handle your data, what each one does for us, and what reaches it. We keep it current.

What we collect

Your account. Your email address, your display name, and your password, which we store only as a scrypt hash. If you turn on two-factor authentication or a passkey, we store the credential material for it. If you choose to add them, a public @handle, a bio and a profile photo. We also record that you accepted our Terms and disclaimers, which version you saw, and when. Creating an account asks for your date of birth so we can check you are old enough. We keep the result of that check and do not keep the date.

Your training. Workouts, logged sessions, every set with its weight, reps, RPE and notes, personal records, body measurements, bodyweight, custom exercises, and routines, including routine-as-code YAML if you use it.

Health information you type. The daily readiness check-in (sleep, soreness, motivation and stress, plus a free-text note), and the injuries, pain and physical limitations you tell Coach about, which are kept in Coach's memory so it does not ask twice. If you log food, your daily totals of calories, protein, carbs and fat, as four numbers you enter yourself. There is no food database and no meal analysis. We store the totals next to your training so Coach can read them alongside what you lifted. You can also add your birth year, height and sex, which we use for calorie estimates and coaching. This is health data and we treat it as such.

Data in your phone's health app stays on your device. On Apple Watch, workouts record heart rate and active energy through Apple Health, and finished sessions are written back to the Health app so they count toward your rings. On Android, finished sessions are written to Health Connect the same way, along with the calorie estimate for each one. To size that estimate for you rather than for an average person, Android reads your most recent weight back out of Health Connect when you have not logged one with us. It is used to work out the number and then dropped. None of that is uploaded, and our database has no field for heart rate, energy, steps or sleep. One number is the exception. When you time a run or a carry on Apple Watch, the distance the watch measures through Apple Health is saved as that set's distance, exactly like a distance you type, so it syncs to our server with the rest of the set and Coach can read it. The Health app syncs to your own iCloud under Apple's terms, and Health Connect stays on the device and is read only by the apps you allow. This mirroring is on by default and can be switched off in Settings, and it only ever happens after your phone asks your permission.

Coach conversations and Coach memory. Your chat threads are stored on our server so they follow you between devices. Coach's memory is a single free-text profile it keeps about you, covering things like your goals, equipment, constraints and injuries. You can read and edit it in the app.

Photos, in three different ways.

• Profile photo. You choose it. We save a new copy of the picture alone, under a random filename, which drops whatever else your camera recorded with it, including the location.
• A photo you send Coach, such as a machine or a form check. Our server makes a new copy of the picture alone, so the location and time your camera recorded go nowhere. The photo goes to the AI provider with that one request and we do not store it. Only the text of the conversation is kept.
• Feedback screenshots. If you switch on evaluation mode in Settings, a feedback button appears. Tapping it automatically captures the screen you are on, before you have typed anything, and attaches that image to the report. You cannot detach it. On a phone the only way to avoid sending it is to cancel the report. The web app cannot capture the screen, so nothing is attached there. Whatever was on screen is in the image, which can include measurements, notes, a Coach thread, or your email address on the Settings screen. The separate contact form in Settings sends text only.

Identifiers. An account id, your public @handle if you set one, and a push token for each install if you allow notifications.

Purchases. Which plan you are on, whether it is active, when it renews, and the store's transaction id. Card numbers never reach our servers.

Diagnostics. Crash and error reports (message, stack trace, platform, release), and request timing. A feedback report also carries app version and build, OS version, device model, the screen you were on, and your sync state.

Dictation. When you dictate to Coach, your device's speech recognizer handles the microphone. That is Apple's on iOS, Android's on Android (usually Google's), and the browser's on the web. Depending on the device and browser, the audio may be processed on your device or sent to Apple or Google by the operating system. The audio never reaches us. We receive only the resulting text, and only when you send the message.

What we do not collect. We collect no location, precise or approximate. The nearest thing is your device's time zone name, such as America/Chicago. The app keeps it with your other synced settings so that reminders, workout summaries and the weekly summary use your own day and week, and updates it when your device's time zone changes. The app also sends it with each Coach message so that "today" means your day. We collect no contacts, calendar, browsing history, files or advertising identifiers. The app has no advertising SDK and no third-party analytics SDK. Any page-view count on this website is Cloudflare's cookieless aggregate measurement, which does not follow you to other sites. We do not sell your data or share it with data brokers, and nothing here is used to track you across apps or websites.

What leaves our servers, and to whom

Your training data lives in a Postgres database on a server we run ourselves. Most of what you do never leaves it. What follows is the complete set of exceptions, and the subprocessor list names each company.

Our AI providers

Coach, the background summaries and the exercise editor's suggestions run on models from several AI providers. Which provider handles a given request can change at any time. The subprocessor list names the providers we use.

For the work we pay for, which is everything here except Coach on your own key:

• We use only the providers' paid API services, under terms where your data is not used to train their models. Any provider we add is held to the same terms.
• Each provider may keep requests for as long as its own terms allow, to check for abuse. We cannot promise your data is never stored.
• Each request carries a code that stands for your account, where the provider accepts one, so that its abuse checks can single out one account rather than the whole of Resistance. The code is not your name, email or account id. Each provider is sent a different one, and it cannot be turned back into your account without a key only we hold. Requests on your own key carry no such code.

Nothing goes until you allow it. Before Coach sends anything, the app asks on a screen of its own whether Coach may send your training data to our AI providers, and says what that data is. It asks the first time you message Coach or use one of its other features, on the screen a finished workout opens to (where that workout's summary would appear), and when you turn workout summaries on. Until you say yes, Coach does not answer on our key and no summary is written. You can withdraw your permission at any time under Settings → AI coach & memory, and from then on neither happens. If you do not allow it, the rest of the app works without Coach. The exercise editor's lookups, described further down, wait for the same permission. Until you give it, the editor sends nothing and offers no suggestions.

Coach on our key

When Coach answers on our key, the request to the provider carries:

• your message and the rest of that conversation;
• Coach's memory verbatim, including the injuries, pain and limitations you have told it about;
• your display name, age derived from birth year, height, sex, latest bodyweight and its recent trend;
• the sessions, sets, workouts, records, progress and body measurements Coach reads to answer, including the notes you wrote on a session or on an exercise in it;
• your readiness check-ins, including the free-text note, verbatim;
• the names of any exercises you made yourself, whether or not you have ever trained them;
• any photo you attached, at full size.

The notes you write on a session, before or after it, and on an individual exercise are part of your training history and go wherever it goes. Any question Coach answers by reading your history sends them, whether or not you attach that session to a message. That is how Coach can act on "left shoulder pinched on set 3, cut it short" instead of seeing only that a set got lighter. These notes are often about your body, so they can carry health information to the provider. Each note is sent in quotes and cut off at 120 characters. We do not put the notes you write on a measurement in the prompt.

The first message in a conversation also triggers a second, smaller request to write the thread's title, and a long thread is summarised from time to time by another. Both are sent the way the reply is, on our key to our AI providers or on your own key to the provider you chose.

Background summaries

Once you have allowed Coach to use your training data, Coach writes a summary after each workout and a review each week. These run in the background, without you asking and without a subscription, on our AI providers. Each request carries the session's name and every set in it with weights, reps and how hard it felt, the notes you wrote on that session and on the exercises in it, up to four earlier sessions in the same detail, your records for the lifts it covers, the week's totals, and your readiness check-in with the note you wrote that day, verbatim. It also carries the goals, health notes and training style from your Coach profile, and the instructions you have given Coach about how to coach you, so that the advice for your next session fits you.

You can stop the summaries on their own by turning Summarize my workouts off under Settings → AI coach & memory. No summary is then written, and nothing about your sessions is sent for one. Withdrawing your permission stops them too. Conversations with Coach are separate and are covered above.

Coach on your own key

Running Coach on your own key comes with Resistance AI, after a one-month trial on every account. You supply a key for OpenAI, Anthropic, Google, or any OpenAI-compatible service you point us at. The same information described above is sent to the provider you chose, on your own account with them, under their terms.

On your own key, whether your data is used to train a model depends on your plan with your provider, and a consumer plan often has weaker terms than a paid API plan. We cannot make the no-training promise above for you. We can make it when Coach runs on our key, because there we choose the plan. If you use your own key, read your provider's policy.

Your key is stored on your device, in the Keychain on iOS, the Keystore on Android, and browser local storage on the web app, which has no equivalent secure enclave. If you choose to sync the key across your devices, we store it encrypted with AES-256-GCM. We never return the plaintext to any client, and we never use your key for anything you did not start.

Everything else that leaves

• All of your traffic passes through Cloudflare. Cloudflare provides the DNS, the certificates and the tunnel that connects the internet to our server, for rezist.ai, app.rezist.ai and api.rezist.ai. Because it terminates the encrypted connection, it can technically see the contents of every request as well as the IP address, user agent and URL. That includes what you send at sign-in, your training data and your uploads. No other company on this page has that much access. Cloudflare also assembles some public pages on rezist.ai, such as a public profile or a shared program.
• Email. Amazon SES delivers verification links, password resets, two-factor codes and support replies. When you send a feedback report or use the contact form, the notification we receive carries your name, email address, account id and message. Everything you email us, including anything sent to privacy@rezist.ai, arrives in a Google (Gmail) mailbox.
• Push notifications. These are sent through Expo's push service, which relays them to Apple's and Google's push systems. Expo receives the push token and the notification's title and body. These can contain text you wrote, such as a workout or club name, or another member's public @handle. They never contain a Coach summary or a comment's text.
• Your workout on the iPhone Lock Screen. To keep that card current while the app is closed, we send its contents to Apple's push service. Those contents are the exercise you are on, your set count, and the short lines showing your next set and what you lifted for it last time. They go to Apple directly rather than through Expo, because this is not a notification.
• Profile photos and feedback screenshots are stored in a private Amazon S3 bucket in the United States, encrypted at rest, with no public access.
• Purchases go through Apple and RevenueCat in the app and through Stripe on the web. They receive your Resistance account id and the product and transaction ids. Card details go to Apple or Stripe directly and never pass through us.
• Errors. When something breaks unexpectedly, a report goes to Sentry. We attach no name, email or account id to it. Two things in it can still identify you. The report includes the exact address that failed, which can contain an id or a public @handle. A database failure also carries the query that failed along with its values, which can include free text you wrote or your email address.
• App updates. The app checks Expo's update service at launch, which sees your IP address, platform and app version.
• Making or editing your own exercise. Once you have allowed Coach to use your data, our server searches YouTube for a form video while you type an exercise's name, and asks one of our AI providers which of the results shows that movement. On a new exercise it also asks whether the library already has the movement under another name. The search carries the name and equipment you have typed. The AI requests carry those and the kind of exercise it is (barbell, machine, cardio), and the duplicate check also carries the muscles you picked. Apart from the code for your account described above, nothing else from your account goes with them, and the subprocessor list names the companies. The button on that screen that asks Coach to fill in the details is part of Coach, and sends what Coach sends.
• Exercise images and videos. GitHub serves the exercise library's demonstration images and YouTube serves its form-video thumbnails. Your device loads them directly when you open an exercise or the exercise picker, so those companies see your IP address and which exercise you are looking at. On the web they also see any cookies you already have with them. You cannot turn this off. If you would rather we served these images ourselves, tell us and we will.
• The API documentation page loads its viewer from the jsDelivr CDN, which sees your IP address if you open that page.
• Webhooks you set up yourself. If you configure one, we send a small signed payload (a session id and a count of records set) to the URL you gave us, when you asked.

What other people can see

Your profile is private by default. Nothing about your training is visible to anyone else unless you turn something on:

• Making your profile public shows your @handle, display name, bio, photo, the month you joined, and your follower counts. Aggregate training stats appear only if you separately switch those on. Turning your profile private again takes effect on the very next request, including previously shared links to your photo.
• Publishing a workout or routine to the marketplace makes that content public, along with its rating and install count. If your profile is private, your name and handle are masked on the listing but the content is still public.
• Sharing an individual session, posting a comment, or writing a review makes that item visible to others. Blocks are honoured everywhere you are signed in. Public pages served to visitors who are not signed in have no viewer to check a block against.

How long we keep things

• Your account and training data: until you delete them. Things you delete in the app are marked as deleted and stop appearing immediately. The row itself is cleared when the account is deleted.
• Coach conversations and memory: until you delete the thread or the account. Coach also keeps the previous version of its memory so a change can be undone. Text you removed from the memory is therefore retained for a while, where you cannot see it.
• Feedback reports and their screenshots: until you delete your account. They do not expire automatically, and any operator with admin access can read them. If you want a specific report and its screenshot removed sooner, email us.
• Change records: 90 days. We log every change made through the API so a mistake can be traced. Each entry records the action, the record it touched, the token that acted, and which fields changed, by name. It does not record what you put in them. Editing a session's note stores that the note changed. It does not store the note. Values are kept only for a short list of things like identifiers and status words, and anything outside that list, including every free-text field and every body metric, is stored as [redacted]. Entries hold no IP address and no user agent. They are deleted 90 days after they are written, by a sweep that runs hourly. You can read your own trail through the API. An operator can still deliberately read across accounts, and when they do, that read is itself written into the same log.
• Generated summaries: until you delete your account. Nothing expires them before that.
• Old sign-in credentials: 30 days. Sign-in sessions, API tokens, password-reset links and verification links are deleted 30 days after they expire or are revoked, by a sweep that runs hourly. An API token with no expiry date stays until you revoke it or delete your account.
• Takedown records: until we release them. When we take down your public profile or something you posted, we write a record of the takedown. Taking a public profile down also writes a separate record holding the handle and a one-way scrambled form of the email address, so that neither can be used to start again. The takedown record stops counting after 180 days and is deleted with your account. The record of the held handle and address has no time limit and stays after your account is deleted. Deleting your account explains why.
• Suspended and closed accounts: until we lift the suspension, or you ask. If we suspend or close an account under the Terms, we record that we did, when, and why, for as long as the suspension stands. We keep a closed account’s data instead of deleting it, because we close accounts for the most serious content and may have to hand the record to the authorities. Email support@rezist.ai to ask for a copy of it or for it to be deleted.
• Server log lines: 90 days. Our API writes one line for every request, holding the route in its general form (GET /v1/sessions/:id, never the id), the status, how long it took, and a request id. The line holds no account id, IP address or email address, and nothing you typed. The lines are collected into a log store on our own hardware and deleted after 90 days. Some other lines carry more. A background summary that gives up for good records the account id it was working on. An error your app reports carries its message, its stack trace and the screen you were on. When Coach changes its memory, it writes down its one-line description of the change, which can be about an injury. A webhook of yours that cannot be reached at all has its address written down. When an AI provider fails, its own error message is recorded, and that message can quote back part of what was sent to it. A request that fails unexpectedly records the failure's message, which for a database failure carries the values in the query that failed, as with the error reports above.
• Failed requests at our front door: until that program is next replaced. Requests reach our API through a separate program on the same machine, which passes them on. It writes nothing about a request that works. When it cannot pass a request on at all, because our API is restarting or the connection drops, it writes a single line about that failure. That line holds more than the one above. It has the exact address that was asked for, including any ids, your IP address, your country, and the name your app or browser gives for itself. Your sign-in token and any cookies are written as REDACTED in place of their values, and no account id or email address appears. These lines stay on that machine and are not gathered into the log store above. Nothing deletes them on a schedule. They go when that program is next updated or its settings change.
• Counts and timings: 90 days. How many requests each route served and how long they took, kept as running totals with nothing in them that identifies anyone. The store holding them is also capped at 4 GB, so a busy stretch can push the oldest out sooner than 90 days.
• Where the time went on an AI call: 30 days. Every time we call a model, for a Coach reply, a background summary or the exercise editor's lookups, we record which steps ran, which of Coach's tools they used, and how long each one took. This record holds no part of your message, nothing Coach read to answer it, and nothing that says whose turn it was. It is kept on our own hardware and deleted after 30 days.
• Failed sign-ins: about two hours. Ten wrong passwords for the same address within fifteen minutes lock it for fifteen more. We keep that count as a row in the database so it survives a server restart, and store the address as a one-way fingerprint, never in readable form. A sweep that runs hourly deletes the row once an hour has passed with no further attempt. Rate limiting is separate. It counts IP addresses in memory and never writes them to the database.
• How many emails were asked for: two days. So that nobody can flood an inbox with our mail, we count the sign-up, password-reset and verification emails requested for each address in a day, and requested from each internet address (for IPv6, the block of addresses one connection is given). Each count is a row keyed on a fingerprint of the address instead of the address itself, and is deleted two days after its last use. There are few enough internet addresses to try every one, so that fingerprint hides an IP address from a casual reader but would not stop a determined one.
• Database backups. We keep snapshots on a rotation, so a deleted account can remain in a backup until that backup ages out.

Deleting your account

There are three ways, and all three perform the same erasure: Settings → Account → Delete account in the app, rezist.ai/delete-account in any browser, or DELETE /v1/account. Each asks you to confirm first, with your password or, if your account has no password, with a code we email you. The web page signs in with a password only, so an account made through Google or Apple sign-in needs to set one first with Forgot password. Deletion then runs immediately, in one transaction. There is no grace period and no way to undo it, so export first if you want a copy.

It erases your profile, sessions, workouts, routines, exercises, measurements, readiness check-ins, records, Coach conversations and memory, preferences, devices and push tokens, webhooks, subscription records, feedback reports, your marketplace listings and reviews, and your social graph. Your profile photo and every feedback screenshot are deleted from object storage. Change records are erased wherever they name you, whether as the subject, as the entity, or through the token that acted, so the billing history a store webhook wrote about you goes too, even though no token of yours created it. Cached counts on other people's listings and clubs are corrected so your departure does not distort their numbers.

These do not disappear the moment you delete:

• Stored images take up to 30 days to disappear completely. Our object storage keeps previous versions so an accidental deletion is recoverable. Your photo and screenshots are removed from view immediately and permanently purged within 30 days.
• Anything you emailed us stays in our mailbox. Support threads, contact messages and the notifications we get about your feedback reports are not part of the account record, and deleting the account does not remove them. Ask and we will delete them too.
• A change record someone else caused can still mention your old @handle, for instance if a club owner removed you. The erasure finds records by your account id, so it does not catch the handle. Those entries expire on the same 90-day clock as the rest. When you leave, your handle is released for anyone to take, unless your profile was taken down, as the next point explains.
• A takedown holds your handle and your email address, and deleting the account does not lift either. When we take a public profile down, we hold the handle so nobody can register it, and we record a check that stops the email address being used to create a new account. That record is not part of your account, so deleting the account does not remove it. We keep the handle and a one-way scrambled form of the address, and never the address itself. The scrambled form cannot be turned back into an address and is no use for contacting you. The only question it can answer is whether an address someone signs up with has been held. It does not expire. Email privacy@rezist.ai to ask us to release it.
• Backups. A snapshot taken before you deleted your account still contains it, until that snapshot ages out of the rotation.

If you cannot sign in at all, email privacy@rezist.ai from your account's address and we will delete the account for you.

Exporting your data

Settings → Account → Export, or GET /v1/account/export with a scoped token, gives you a JSON file. Export is not behind a plan. It contains your profile, custom exercises, workouts and their exercises and sets, routines, sessions and every performed set, measurements and readiness check-ins, personal records, and Coach's current memory notes.

The export is your training record and does not cover the whole account. It does not include your Coach conversations, generated summaries, the previous version of Coach's memory, feedback reports, registered devices, webhooks, subscription records, saved preferences, routine-as-code documents, your profile photo file, your passkey and two-factor enrolment, your API tokens, change records, or your social and marketplace data (follows, comments, listings, reviews, collections, clubs, challenges). Sessions you have archived are also left out, though everything else you archived is included. If you want any of the omitted parts, email privacy@rezist.ai and we will put them together for you.

Your rights

You can see and correct almost everything from inside the app, including your profile and demographics, every logged session, your measurements, Coach's memory and your privacy settings. Export and deletion are self-service, as described above. You can also read your own change records, meaning every action taken on your account and the token that took it, from GET /v1/audit.

Depending on where you live you may also have the right to obtain a copy of your data, to have it corrected or erased, to restrict or object to how we use it, and to complain to your data protection authority. Email privacy@rezist.ai and we will respond within 30 days. We will not charge you for it and we will not treat you differently for asking.

We process your data to provide the service you asked for, to keep it secure and prevent abuse, and to meet our legal obligations. Consent is the basis for Coach sending your training data to an AI provider. It is also the basis for notifications, dictation, Apple Health and a public profile. You give it by allowing it or turning the feature on, and you can withdraw it by turning it off. Your readiness check-ins and the notes you write about how your body feels can be health data, and they reach an AI provider only with that permission.

Security

Everything travels over HTTPS. Passwords are scrypt-hashed. Two-factor secrets and synced AI provider keys are encrypted with AES-256-GCM. API tokens are scoped, so a token minted for one job cannot do another. Stored photos and screenshots live in a private bucket with public access blocked and encryption at rest. You can add two-factor authentication or a passkey in Settings, and we recommend it. No system is perfectly secure. If we discover a breach affecting your data, we will tell you and the relevant authority as quickly as we can establish the facts.

Age

Resistance is for people 13 and over, or the minimum age of digital consent where you live, whichever is higher. We ask for your date of birth when you create an account, and you cannot finish signing up without it. If the date puts you under the minimum, the account is refused.

We do not keep that date. It is checked when you sign up, and we record only that the check passed and when. If you are under 18, we also record the day you turn 18, because until then your account works differently. The birth year on your profile is separate and optional. You add it yourself to improve calorie estimates and coaching, and you can change or remove it at any time.

If you are under 18. Coach does not run on our key for your account, and no background summaries are written. Anyone who wants to follow you sends a request for you to approve. Only people you follow can comment on what you share or invite you to a club. Notifications about followers, reactions and comments start switched off, though you can turn them on. All of this ends automatically on your 18th birthday.

We cannot tell where you are, so we cannot check the second half of the rule. If your country sets a higher age than 13, it is up to you to meet it. We do not knowingly collect data from children. If you believe a child has an account, email privacy@rezist.ai and we will delete it.

Where your data is

Resistance is operated from the United States, and your data is stored there. If you use it from elsewhere, including the EU or the UK, your data is transferred to and processed in the United States, and by the providers on the subprocessor list, which operate globally. Where the law requires a transfer mechanism, we rely on the standard contractual clauses incorporated into those providers' terms.

Changes

When we add, remove or change a subprocessor, we update the subprocessor list. When we make a material change to this policy, or add a subprocessor that receives your personal data, we will tell you in the app or by email.

Contact

Privacy questions, requests, or a correction to something on this page: privacy@rezist.ai. See also the subprocessor list and the Terms of Service.