Privacy Policy
This policy explains what Athlete Craft does with your information. The short version: your training data is stored on your phone and in our database so it is not lost, and it is only sent outside that when you use the AI Trainer.
Who we are
Luke Ichiro Depue
Email: Athlete Craft@gmail.com
Athlete Craft is an iPhone app for athletes to track training. This policy covers the app and this website. We are the data controller for anything described below.
The summary
- Your training data lives in two places: on your phone, and in our database, so it survives losing or changing your device.
- You have an account. It holds your email, a username, a display name and an optional bio. You can delete it, and everything with it, from inside the app.
- The AI Trainer is the only feature that sends anything to a third party. It cannot answer questions about your training without reading it, so using it sends your training data to OpenAI. Nothing else does.
- We don't sell your data, and we don't run ads or advertising trackers.
What we collect, and how
Your account
To use Athlete Craft you create an account. It stores your email address, a username, a display name and an optional bio. Your password is handled by our authentication provider; we never see it.
Your training data
Your presets, exercise names, logged sets and statistics, workouts, games, practices, schedule and progress Views are stored both on your phone and in our database. Keeping a copy in the database is what lets your history survive a lost or replaced phone.
This means we technically hold your training data. We do not read it, analyse it, sell it, or use it for anything other than running the app for you. It is never shared with anyone except when you choose to use the AI Trainer, described next.
Sent to our server and to OpenAI when you use the AI Trainer Pro
The AI Trainer answers questions about your training, which requires sending some of your logged data along with your message.
- What is sent: your message, plus your username, display name and bio, and your complete workout, game and practice history — every set and every note.
- Who receives it: our own server, which forwards the request to OpenAI
(model
gpt-4o-mini, via the OpenAI API). - Training: OpenAI does not use this data to train its models. Data sent through the OpenAI API has been excluded from training by default since 1 March 2023; training would require us to deliberately opt in, and we have not. (This is the opposite of the consumer ChatGPT default, which is where most reporting on the subject comes from.)
- Provider retention: OpenAI retains API requests for up to 30 days for abuse monitoring and to provide the service, then deletes them, unless legally required to retain them longer.
- Our server: a Supabase Edge Function. It is stateless and never logs your message, prompt or training data — only a truncated one-way hash of your user ID and an HTTP status code. Supabase records standard invocation metadata (time, path, status), retained for about one day.
- Conversation history: kept on your device, and you can clear it at any time in the app. Our server stores no transcripts.
- AI memory notes: the app can keep short notes the AI has formed about your training, so it has context in later conversations. These are stored in our database and have no automatic expiry — they are kept until you erase them or delete your account. You can erase them at any time with Settings → AI Trainer → Clear AI Memory.
- Identifiers: no separate ID field is sent to OpenAI, but your display name travels inside the message itself, so what reaches OpenAI is identifiable.
You choose whether to use this feature. If you never open the AI Trainer, none of your training data is ever sent to OpenAI.
Your subscription
Apple processes all payments. We never see your card details, billing address or Apple ID. Apple tells us only whether a subscription is active.
We use RevenueCat to manage subscription entitlements. It receives your subscription status and an identifier, never your payment details.
Product analytics
We use PostHog (PostHog Cloud, United States) to understand how the app is used so we can improve it. This analytics is identified — it is tied to you, not anonymous.
We send PostHog your email address, display name and username, along with your subscription status, your plan, and your primary sport. We also record which screens you visit, app lifecycle events (opening and closing the app), and links you follow into the app.
We do not record your screen. Session replay is switched off. Your training data, workout logs and AI conversations are never sent to PostHog.
Why we use it
| Data | Purpose | Legal basis (EEA/UK) |
|---|---|---|
| Your training data | To run the app and keep your history safe across devices | Performance of a contract |
| Data sent to the AI Trainer | To answer your training questions | Your consent |
| Subscription status | To unlock Pro features | Performance of a contract |
| Account details (email, name, username) | To run your account | Performance of a contract |
| Identified product analytics | To understand use and improve the app | Your consent |
Third parties
The only parties who may receive data are listed here.
| Who | What they get | Why |
|---|---|---|
| Apple | Payment and subscription data | To process your purchase |
| OpenAI | Your message and the workout data needed to answer it | To generate the AI Trainer's reply |
| Supabase | Your account and all of your training data | Hosts our database and server function |
| RevenueCat | Subscription status and an identifier | To manage Pro entitlements |
| PostHog (US) | Your email, display name, username, subscription status, sport, and which screens you use | Product analytics |
Any third party with whom we share your data provides the same or equal protection of that data as described in this policy. We do not sell your data, share it with data brokers, or allow it to be used for advertising or use-based data mining.
How long we keep it
- Your training data: kept until you delete it in the app or delete your account. Deleting your account removes our copy permanently.
- AI conversations: OpenAI deletes API request data after up to 30 days. Our own server keeps no transcripts at all.
- Subscription records: for as long as the subscription is active, plus any period Apple requires for billing and tax records.
- Analytics: retained for one year. This period is set by our PostHog plan and cannot be shortened, though you can ask us to delete your analytics data at any time.
- Server logs: about one day.
Deleting your data and withdrawing consent
- Training data: delete individual entries in the app at any time.
- AI Trainer: clear your conversation in the app, and erase stored AI memory with Settings → AI Trainer → Clear AI Memory.
- Your whole account: delete it from inside the app. This permanently removes your profile, your training data and your AI memory notes from our database.
- Anything else: email Athlete Craft@gmail.com and we will delete it. We respond within 30 days.
- Subscription: cancel in Settings → your Apple ID → Subscriptions.
Security
All data is encrypted in transit using HTTPS. Our database is hosted by Supabase, which encrypts data at rest. Data on your phone is protected by your iPhone's own file protection and passcode. Row Level Security is enabled on every table holding user data, so no account can read another account's records. No system is perfectly secure, and we cannot guarantee absolute security.
International transfers
Athlete Craft is available in 175 countries. All of our processors are in the United States — our Supabase database and server function run in us-east-2 (Ohio), and OpenAI, RevenueCat and PostHog are US-based. If you are outside the United States, your data is transferred there.
Where the law requires a specific safeguard for sending your data to the United States, the following apply:
| Processor | Safeguard |
|---|---|
| OpenAI | EU Standard Contractual Clauses, with the UK Addendum and Swiss provisions |
| Supabase | EU Standard Contractual Clauses (Modules 2 and 3), with the UK Addendum and a Swiss addendum |
| RevenueCat | EU Standard Contractual Clauses, with the UK International Data Transfer Addendum |
| PostHog | Certified under the EU-U.S. Data Privacy Framework, including the UK Extension and the Swiss-U.S. framework, and additionally covered by Standard Contractual Clauses |
You can ask us for a copy of these safeguards at any time.
Children's privacy
Athlete Craft is a general-audience app and is not directed to children. You must be at least 13 years old to create an account and use it.
We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, email Athlete Craft@gmail.com and we will delete it promptly.
If you are under 18, you should have a parent or guardian read this policy with you before using the AI Trainer.
Your rights in the EEA and UK
If you are in the EEA or UK you have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your local supervisory authority.
Athlete Craft is run by an individual developer based in the United States. We do not currently maintain a representative in the European Union under Article 27 of the GDPR, on the basis that our processing of EEA residents' data is occasional and small in scale. You can reach us directly at Athlete Craft@gmail.com for any request or question about your data, and we answer within 30 days. We keep this position under review as the app grows.
Your rights in California and other US states
We do not meet the thresholds that make us a "business" under the CCPA/CPRA, and we do not sell or share personal information. Regardless, you may request access to or deletion of any data we hold by emailing Athlete Craft@gmail.com. We will not discriminate against you for asking.
Residents of Virginia, Colorado, Connecticut, Texas and Washington have comparable rights, exercisable the same way.
NEEDS: Washington's My Health My Data Act may require a SEPARATE standalone Consumer Health Data Privacy Policy. See the note to Luke.
Health data and breach notification
Training and workout data may be treated as health-related information under some laws. We are not a HIPAA covered entity. If we ever discover a breach affecting your health-related data, we will notify affected users without unreasonable delay and no later than 60 calendar days after discovery, and will notify the FTC where required.
Automated decision-making
The AI Trainer produces suggestions only. It does not make any automated decision that produces legal effects or similarly significantly affects you. You decide what to do with what it says.
Changes
If this policy changes materially we will update the date at the top and note the change in the app's release notes.