Privacy Policy

We collect only what the app needs to work:

• Account — your email address and a password. Passwords are hashed by our authentication provider; we never see or store them in plain text.
• Profile & training context — your training goal, available equipment, anything you ask us to train around (e.g. injuries), and similar preferences you enter.
• Workout & body data — the exercises, sets, reps, weights, cardio, and notes you log; your bodyweight entries; and the dates and times of your sessions.
• Photos you upload (Pro) — images you send for analysis (e.g. a photo of a machine to identify an exercise). These are stored in your private storage and sent to an AI provider to produce the result.
• Voice dictation (optional) — if you dictate instead of typing, your speech is converted to text by Apple’s speech recognition (on iOS) or your browser’s speech service (on the web). The audio is used only to produce the text in your message box and is never sent to Spotter; the resulting text is handled like any other message you choose to send.
• Coach messages — the messages you exchange with the in-app coach, which we process to generate replies, plans, and insights.
• Technical data — standard server logs (e.g. request metadata and errors) used to keep the service running and secure.

Your fitness, bodyweight, and related entries are health-related information. We treat this data carefully and never sell it.

We use the data above to:

• provide the core service — logging, history, and progress charts;
• power the AI coach, plan generation, and image features;
• send you account and transactional emails you’ve enabled;
• process payments for Spotter Pro; and
• secure the service, prevent abuse, and fix problems.

We do not use your data for advertising, and we do not sell or rent it to anyone. We also do not use your coach chats, workouts, or any of your data to train AI models.

To deliver coaching, plan generation, exercise-video lookups, and image features, relevant parts of your data (such as your messages, recent workout context, an uploaded photo, or a search term) are sent to Microsoft Azure AI Foundry / OpenAI to compute a response. Dictation audio is never part of this: speech is transcribed by Apple’s or your browser’s speech service, and only the resulting text you choose to send is processed. Before the app first sends this data for AI features, it shows an in-app disclosure and asks for your permission. AI output can be inaccurate or incomplete — see the disclaimer in our Terms of Service.

Your chats aren’t training data. Neither we nor our AI provider use your messages, workouts, or photos to train or improve AI models. Your data is sent only to compute your response, under enterprise terms that prohibit training on it, and is not retained by the provider to build its models.

We use a small number of subprocessors to run Spotter. Each receives only what it needs for its function. We require each provider to protect personal data with protections that are at least as strong as those described in this policy for the services they perform for us:

• Supabase — database, authentication, and file storage — hosts your account and logged data.
• Vercel — application hosting and delivery.
• Azure AI Foundry / OpenAI — large-language-model processing for the coach, plan generation, and image analysis. Receives the message/context/photo content needed for that response.
• YouTube Data API (Google) — looks up exercise tutorial videos from search terms only. Spotter does not stream, host, or resell YouTube content — results open in the YouTube app or browser. No personal account data is sent beyond the search query.
• Stripe — payment processing for Spotter Pro on the web. Stripe handles your card details directly — we never receive or store your full card number.
• RevenueCat / Apple / Google — in-app subscription purchases on iOS and Android. Store purchase tokens and subscription status are processed so we can unlock Spotter Pro; we do not receive your full payment card number.
• Resend — sends transactional email, such as plan-share notifications.

We may also disclose data if required by law, or to protect the rights, safety, and security of our users and the service.

Spotter lets you share a workout split with another person (a Pro feature). When you do, the plan’s contents become visible to the people you share it with. Sharing is always initiated by you.

• Access & export — you can download your workouts, body metrics, and profile at any time from Profile → Export my data (JSON and CSV).
• Correction — you can edit or delete individual entries directly in the app.
• Deletion — you can delete your account, which removes your associated data. To request deletion or any other data right, contact us at support@spotter-labs.com.

Depending on where you live (e.g. the EU/UK under GDPR, or California under the CCPA), you may have additional rights over your personal data; we honour applicable requests.

Access to your data is enforced at the database level so that you can only read your own records, and data is encrypted in transit. We keep your data for as long as your account is active, and remove it (or anonymise it) after deletion, except where we must retain limited records to meet legal or accounting obligations.

No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security.

Spotter uses only the cookies needed to keep you signed in and to operate the app. We do not use advertising or third-party tracking cookies.

Spotter is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will remove it.

We may update this policy as the app evolves. We’ll change the “Last updated” date above and, for material changes, make a reasonable effort to notify you.

Questions or requests? Email support@spotter-labs.com.