LEGAL

X Protocol Privacy Notice

Version: 29 October 2026, revision 5.

Information you enter includes your name, experience, weekly frequency, 50+ support choice, exercise repetitions, hold times and equipment weights, workout dates and history, programme choices, drafts, progress, Elite attempts and self-confirmed checkpoints. Fitness goals are no longer collected or edited. Habit and water tracking has been retired. Existing historical records remain in saved profiles, device copies and exports until handled under the retention and deletion procedures below; they cannot be added to or changed through the service. We do not ask for a medical diagnosis, height, body weight, date of birth or a detailed food diary in these profile forms. The weight field in an exercise log means equipment load, not body weight.

We use ordinary account and programme information to provide the service you request: our lawful basis is performance of our contract or steps at your request before a contract. We use necessary purchase records for the contract and keep required accounting evidence to meet legal obligations. We use proportionate security, fraud-prevention and complaint records for our legitimate interests in protecting customers and operating a reliable service; you can object to that processing.

We use necessary sign-in and session information to provide the account service you request. To protect sign-in and email delivery, we use short-lived challenges, keyed verification values, keyed email/IP rate-limit references and delivery attempt records. This security processing is based on our legitimate interests in preventing unauthorised access and abuse. Keyed references are pseudonymous, not anonymous. We do not store the plain sign-in code in our application database or ask you to send it to support.

We do not ask you to declare injuries, health conditions or medical clearance. The retired safety and clearance declarations have been removed from current server profiles. Older device copies, exports and restricted backups can still contain them; they are not used to decide training eligibility or to make medical assessments. We do not ask you to send medical details in routine support. Training records can reveal health information in context. Where information we process constitutes special-category health data, we must establish both a lawful basis and an applicable special-category condition before processing it; ordinary contract performance alone is not that condition.

We do not sell your personal information or use your programme records for targeted advertising. Programme progression uses your recorded activity to show training stages; it is not a medical assessment or a decision about employment, credit or insurance.

An email sign-in code expires after five minutes, is limited in verification attempts and can be used only once. The sign-in flow cookie binds the request to your browser. These cookies support the sign-in you request; they are not advertising or marketing consent.

New device draft and sync/recovery changes use this browser session by default. You may choose “Keep drafts on this device” to retain them after closing the browser, or “Session only” to stop new permanent draft writes. Older saved recovery copies remain protected until you explicitly clear them; choosing session-only does not erase an older copy or cloud history. Signing out is not a deletion command. A service worker caches application images and icons, not your authenticated API responses. You may clear site data in your browser; export records first if you wish to keep them. Downloads and copies on other devices remain under your control. We do not install advertising or analytics trackers in the member application.

Sign-in expiry prevents use; it is not an erasure timer. Expired sessions and sign-in codes cannot authenticate. Our removal targets are one day after sign-in flow expiry, 30 days after session expiry, seven days after email-code expiry, and 35 days after keyed rate-limit expiry or terminal email-delivery activity. These are targets, not guaranteed maximum storage periods or a claim of continuous automatic erasure. Stored expired records remain restricted until a controlled cleanup is completed.

Removal takes place in limited, authorised batches; expiry alone does not start automatic deletion. If cleanup is not authorised, is unavailable or has a backlog, restricted records can remain beyond these targets. The oldest eligible records are processed when an authorised cleanup takes place. A documented legal or security hold can also delay removal and must have a reason and review date. Active challenges, sessions, unresolved deliveries, leases, security budgets and account/payment records are not erased by this transient-record cleanup. We do not reset security or sending limits to clear a backlog.

Ordinary support correspondence is reviewed for removal 24 months after the case closes. Routine application security evidence has a 30-day target; incident evidence is reviewed 12 months after closure. Limited legal or security holds must record a reason and a review date. Providers' own security and legal records follow their documented rules, which these application targets do not override.

Encrypted recovery copies are excluded from ordinary account use. Our target is to remove eligible local recovery copies more than 35 days after capture, after a recent replacement has passed integrity and isolated-restore checks. We retain the two latest verified recovery copies and any specifically held copy. If verified replacements are unavailable or a limited legal or security hold applies, an older copy can remain beyond the target; a failed or incomplete replacement does not justify destroying the last usable recovery copies. Live erasure does not instantly remove independent device copies or provider version/recycle records. Valid erasure and suppression instructions must be reapplied before restored data is used; expired authentication or old email sends must not become active again.

Accounting evidence is retained for at least five years after the relevant 31 January Self Assessment filing deadline. An active dispute or legal obligation can require a longer limited hold. We explain a justified delay or residual retention when responding to a request. There is no requirement for you to accept advertising cookies or provide medical information in order to use ordinary account controls.

Cloudflare: operates a global network through Cloudflare, Inc. in the United States and its affiliates. Its published service subprocessor locations include the EEA, United States, Australia, India and Japan, depending on the activity. The current database configuration does not establish a country-specific residency restriction. The incorporated Cloudflare DPA, section 6 (https://www.cloudflare.com/cloudflare-customer-dpa/) provides the UK Addendum/SCC route for restricted transfers and describes its Data Privacy Framework arrangements. The service subprocessor list (https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/) explains the activity-specific locations.

Resend: our sending domains use its Ireland region. This does not mean all service processing stays in Ireland: Resend's DPA identifies primary operations in the United States and its published subprocessors include US processing. Its applicable DPA incorporates the UK transfer clauses/Addendum in section 6.4 (https://resend.com/legal/dpa); the subprocessor list (https://resend.com/legal/subprocessors) identifies the other services.

Google sign-in and support Gmail: Google processes information globally, including through Google LLC in the United States. Google publishes reliance on the UK Extension to the EU-US Data Privacy Framework and SCCs where applicable in its transfer framework (https://policies.google.com/privacy/frameworks?hl=en-GB). The support mailbox is consumer Gmail, governed by Google's consumer terms and privacy policy. It is not a Google Workspace processor service and we do not claim a Workspace DPA for it. Please limit support messages to the account/order reference and the problem, without medical details or card numbers.

Auth0/Okta, retained legacy and recovery records: the existing tenant uses the United Kingdom region. Okta's service subprocessor list (https://www.okta.com/legal/trustandcompliance/subprocessors/) also identifies US support/analytics and German warehouse processing, depending on the service. A copy of the DPA has been received; execution and the resulting account-specific UK transfer coverage have not been documented. We do not describe that outstanding evidence as an executed agreement. New direct Google/email sign-in does not use Auth0.

Stripe: processes the payment service and its retained transaction records, including transfers to Stripe, LLC in the United States. DPA section 6 (https://stripe.com/gb/legal/dpa) incorporates the Data Transfers Addendum (https://stripe.com/gb/legal/dta); section 5 provides the UK International Data Transfer Addendum with controller/controller and controller/processor modules as applicable. Stripe also has its own controller purposes.

Where an applicable UK adequacy route covers a transfer, we use that route; otherwise the applicable contractual safeguards and required assessment must cover it. Published provider terms do not prove a particular transfer's complete processing path or every account-specific acceptance fact. You can ask for information about the safeguards applying to your data and a copy, with proportionate redaction. Encryption supports security but is not itself a legal transfer mechanism.

You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or call 0303 123 1113. You do not have to give up that right to use the service. We will explain significant changes to this notice and identify the version that applies.