Subprocessors

A subprocessor is an outside company we use to run Resistance that can handle some of your data while doing its job. This page names each one, what it does for us, and what reaches it. It is part of the privacy policy, which explains each flow in context.

Your training data is stored in a Postgres database on a server we run ourselves. Every request passes through Cloudflare on its way to us. Apart from that, most of what you do in Resistance never reaches any company on this page.

When this changes. We update this page whenever we add or remove a subprocessor or give one a different job. If we add one that receives your personal data, we will say so here and, when the change is material, in the app or by email.

AI providers

Coach on our key, the summaries Coach writes after each workout and each week, and the exercise editor's suggestions run on models from the providers below, on our accounts with them. On those accounts we send nothing from an account under 18, and nothing from any account until it has allowed Coach to use its training data. Coach on your own key is covered under Others that receive data. Everything else in Resistance, including logging, history, charts, records, programs and the community, runs without them and sends them nothing.

We use more than one provider, and which one handles a given request can change at any time. Any provider listed here can be given any of the work in this section.

• Anthropic

  Training + health data

  Claude models, on our paid Anthropic API account.

• Google

  Training + health data

  Gemini models, on our paid Gemini API account.

• OpenAI

  Training + health data

  GPT models, on our paid OpenAI API account.

How we work with all of them:

• We use only their paid API services, under terms where your data is not used to train their models. Any provider we add is held to the same terms.
• Each provider may keep requests for as long as its own terms allow, to check for abuse. We cannot promise your data is never stored.

What a request carries depends on the job:

• A Coach reply carries your message and the conversation, Coach's memory verbatim (including injuries and limitations), your display name, age, height, sex, bodyweight and its trend, the training data Coach reads to answer you, including the notes you wrote on a session or on an exercise in it, your readiness check-ins with the free-text note, and any photo you attached. It does not carry the notes you write on a measurement. A conversation's title, and the summary that condenses a long conversation, are written by these providers too.
• A background summary, the review written after a workout or at the end of a week, carries the session's name and every set in it with weights, reps and effort, the notes you wrote on that session and on the exercises in it, up to four earlier sessions in the same detail, your records for the lifts it covers, weekly totals and per-muscle set counts, your readiness check-in with that day's note, verbatim, and the goals, health notes and training style in your Coach profile with the instructions you have given Coach. Summaries are written for every adult account that has allowed Coach to use its training data and has not turned summaries off.
• The exercise editor's two questions are which YouTube result demonstrates a movement, and whether the library already has that movement under another name. They carry the name, the kind of exercise and the equipment you have typed, and for the duplicate check the muscles you picked, together with the candidate video titles or library entries being chosen between. Nothing else from your account goes with them.

Infrastructure

• Amazon Web Services

  Photos and email

  S3 stores your profile photo and any feedback screenshots, in a private bucket in the United States (US East, Ohio) with public access blocked and encryption at rest. SES delivers our outbound email, including verification links, password resets, two-factor codes and support replies, so it handles your email address and the contents of those messages.

• Cloudflare

  All traffic

  Provides DNS, TLS and CDN for rezist.ai, app.rezist.ai and api.rezist.ai, hosts this website and the web app's files, and carries the tunnel between the internet and our API server. Because it terminates the encrypted connection, it can see the contents of every request and response, including sign-in details, training data and uploads, as well as the IP address, user agent and URL. It also renders the public profile and program pages on rezist.ai, and routes email sent to an @rezist.ai address. Any aggregate page-view count on this website comes from Cloudflare too.

• Google (Gmail)

  Email you send us

  The mailbox behind our @rezist.ai addresses, including privacy@ and support@. Anything you email us, with its attachments, your address and the headers that come with it, is delivered into a Google mailbox, as are the notifications we get when you file a feedback report or use the contact form. If you would rather not send a privacy request through Google, say so and we will arrange another channel.

• YouTube search (Google)

  Exercise names

  When you make your own exercise, our server searches YouTube for a form video to suggest. The search text is the name and equipment you have typed plus the words "proper form tutorial", and the search is made from our server on our own key, so Google sees our address rather than yours. The thumbnails your device loads, further down, are separate from this.

• Expo

  Push and updates

  Delivers push notifications, relaying them to Apple's and Google's push systems. It receives your device's push token and the notification's title and body, which can carry text you wrote (a workout, club or challenge name) or another member's public @handle. Your device also contacts Expo directly to create that token. Expo serves app updates as well, so at launch the app sends it the platform and version, and Expo sees the device's IP address.

• Apple

  Your workout card

  While a workout is running, your iPhone can show it on the Lock Screen and in the Dynamic Island. To keep that card current when the app is closed, our server sends its contents to Apple's push service, which passes them to your phone. They are the exercise you are on, how many sets you have done, and the short lines showing your next set and what you lifted for it last time. No notes, bodyweight or account details go with them.

• Sentry

  Error reports

  Collects crash and error reports so we can fix what breaks. It receives the error message, stack trace, release, platform and the exact address that failed. We attach no name, account id or email. The failing address can still contain an id or a public @handle, and a database error carries the query that failed together with its values, which can include free text you wrote or your email address. Our server sends the reports, so Sentry sees our address rather than yours.

Payments

Card details never pass through our servers.

• Apple

  Purchase records

  Handles every subscription bought in the iOS app, and holds the payment relationship. We learn the product, the transaction id, and whether the subscription is active. On iPhone, Apple also delivers your push notifications, keeps your workout card current and stores your Health data, as described above.

• RevenueCat

  Purchase records

  Validates App Store receipts and tells our server what you are entitled to. Receives your Resistance account id together with the product and transaction ids.

• Stripe

  Purchase records

  Handles subscriptions bought on the web. You give Stripe your payment details directly, on their hosted checkout; we send them your Resistance account id so the subscription can be matched to it, and we receive the subscription's status and id.

Content your device loads directly

These are contacted by your browser or the app, not by our server, so they see your own IP address rather than ours. None of them receives your training data.

• GitHub

  Exercise images

  Hosts the demonstration images for the built-in exercise library, which the app links to rather than copying. They load when you open an exercise or the exercise picker, so GitHub sees your IP address, your device's user agent, and the file name, which names the exercise you are looking at. You cannot turn this off.

• YouTube (Google)

  Video thumbnails

  Supplies the thumbnail images for form videos on some exercises, including any YouTube link you paste into an exercise you created. Loading a thumbnail tells YouTube your IP address and the video's id, which identifies the movement. In a browser it also sends whatever Google cookies you already have. Playing a video opens YouTube itself. You cannot turn this off either. Finding a video to suggest is the separate search our server makes, listed above.

• jsDelivr

  Web page assets

  A public CDN that serves the interactive viewer on our API documentation page. It sees your IP address if you open that page. No other page on rezist.ai loads anything from a third party.

Others that receive data

These receive data too, either at your request or without it passing through our servers. They are not our subprocessors.

• The AI provider you choose yourself

  Your own account

  When you bring your own key, Coach runs on OpenAI, Anthropic, Google, or any OpenAI-compatible service you point us at, using your key, on your account and under your terms with them. That company is your provider rather than our subprocessor, so its training policy is the one that applies to your data, and the commitments in the AI providers section above do not cover it.

• Apple and Google speech recognition

  Dictation audio

  When you dictate to Coach, your device's own speech recognizer handles the microphone. Depending on the device and browser, the audio may stay on the device or be sent to Apple or Google by the operating system. The audio never reaches us. We receive only the text you choose to send.

• Apple Health and Health Connect

  Stays on device

  Heart rate and active energy recorded during an Apple Watch workout, and finished sessions written back to Health, live on your device and in your Health app. On Android the same finished sessions go to Health Connect, with their calorie estimate. None of it is uploaded to us. Once it is in Health it follows Apple's rules, including syncing to your own iCloud. Health Connect stays on the phone and is read only by the apps you allow. The mirroring is on by default and can be switched off in Settings. Your phone asks your permission before the first write.

• A webhook you configure

  Your endpoint

  If you set one up, we send a small signed payload, holding a session id and a count of records set, to the URL you gave us. Where that goes is your choice.

Contact

Questions about anything on this page, or about a vendor we should be clearer about: privacy@rezist.ai. See also the privacy policy and the Terms of Service.