Loading the page…
Closed pilot
This is a closed pilot for a few invited people, not a public service. Below, in short: what is stored, who sees it, which services help run TrainOnTap and how to ask for deletion. It covers the TrainOnTap iPhone app and the web version, which the app is replacing; a part that is only about one of them says so.
No payment data is stored here: the pilot has no payments.
The person running the pilot (the administrator) sees the data, for debugging and support during testing. Testers' data is isolated from each other: no one can see another tester's profile, workouts or conversation through the app.
The administrator also computes aggregate statistics about how the app is used (counts and shares, such as how many athletes finished a first workout) from the app's own records of all testers, with no list of people; see “Product analytics (the app)” below.
Hosting. The app's server and its live database run on Render, a US company, in Render's Frankfurt (Germany) region. The data described above is stored there, and Render's systems and staff can technically reach it as the host. Other copies are held elsewhere: the administrator's backup copies of the database, kept on a computer with an encrypted disk outside Render; exports of conversations and logs that the administrator may make on that computer for debugging and quality review; and the emails you send to the support address, kept in the support mailbox.
Sign-in. Auth0, a US company, runs the sign-in. It holds your email address and sign-in details and keeps its own logs of sign-ins, under its own policy. Deleting your account here also deletes your Auth0 account, but Auth0 keeps its own logs for as long as its policy says.
Notifications on the iPhone app. Expo's push service (a US company) and Apple's push notification service carry the notification to the phone, and see the text and the tap address as described under “What is stored”. How long they keep them follows their own policies.
Error reports go to Sentry (see “Error reports (Sentry)” below), and the conversation goes to the AI companies below. We do not sell your data, and we do not use it for advertising.
TOT is an AI coach: not a person and not a doctor, and it can make mistakes. Your conversation with TOT and the data TOT needs to reply (your profile, including your age, body measurements and any health notes or injuries you gave, and your program, workouts, logged sets and notes) are sent to an Anthropic model (Claude Haiku 5.5) to generate the reply (since October 16, 2026; before that, to OpenAI's gpt-6-luna model, which can write replies again if the app is switched back to it).
OpenAI also receives data in two other ways. To write the summary of a long conversation (so TOT remembers older messages), it gets your older messages and TOT's replies (each of your messages up to 4,000 characters), your active coach notes (health notes first), notes you removed from TOT's memory in the last 365 days, and a digest of your profile: age, goal, schedule, equipment, movements to avoid and constraint notes. And it gets TOT's work log (tracing): for each reply, your messages, TOT's replies and the data TOT read. The summary calls are traced too. Every trace carries an internal identifier of your account and is kept in OpenAI's tracing system so the developer can check the quality of the replies. A trace keeps the full text of your messages and TOT's replies, as sent, not a shortened version. Conversations, including health details you share, can therefore be stored in the logging and tracing systems of these companies, and the administrator can read them there.
Voice input. When you dictate a message or an answer, the recording is sent to xAI to turn it into text, together with the names of the exercises of your workout as spelling hints. The app keeps only the text, never the recording.
Anthropic, OpenAI and xAI are US companies, so your data may be processed in the USA. How long Anthropic, OpenAI and xAI keep this data is set by their own policies, which this app does not control; the exact periods are not known to the app and are not listed here, and the app cannot delete the data on their side. The API data processing policies of Anthropic and OpenAI apply (by default, requests made through their APIs are not used to train their models). The final decisions about your workouts and data are saved and checked by the app: the model proposes, it does not act directly.
Before you can use the app it asks you to agree to the processing above, on a screen of its own, and says that TOT is an AI. Without your agreement TOT cannot be used: nothing you write is sent to these companies, and the app shows that screen again.
The app records which version of the consent text you agreed to and when. If what you agree to changes (for example a new company or a new kind of data), the text gets a new version and you are asked again.
You can withdraw your agreement at any time: in Profile (in Settings in the installed app) choose “Withdraw AI consent”. From then on the app sends nothing to these companies and asks again before it can be used. Withdrawing does not delete your data in the app (see below) and does not remove what these companies already hold.
The TrainOnTap app for iPhone and Android has one more optional setting, “Share usage data”. It is off until you turn it on: new users see it on the consent screen, next to the AI agreement but separate from it, and everyone can change it in Profile. Leaving it off blocks nothing.
When it is on, the app records which screens you open, which buttons you tap (by a fixed internal name, never by the text on the button), when an empty or an error state is shown, when the app is opened or goes to the background, and whether a sign-in worked or why not (you cancelled it, it failed, the server could not be reached). Each record has the time, a random identifier of this installation and of the session, the phone's platform (iOS or Android) and the app's version, and it is linked to your account. It never contains your messages, workouts, weights or health details, any text you type, or the identifier of a workout or any other item: a screen is recorded by its pattern, for example /workout/[id]. TOT never sees these records.
While you answer the setup questions after signing in, the app also records three more things, when this setting is on: that you saved one of the four groups of questions (which group, never your answers); how the setup ended, which is one of three, and one of them is that your first answer was “I have my own program”, so that record states plainly that you said you have your own program (no other answer you give is recorded); and, when a save fails, which kind of failure it was (a conflict with another save, a refusal, an answer the server could not accept, or no reply).
When you start a planned workout or a template from the Workouts tab (or from the screen of a planned workout) and the start does not go through, the app also records that, when this setting is on: whether it was a planned workout or a template, and which of eight kinds of reason it was (another workout is already running, so that record states plainly that you had a workout in progress; the workout is no longer planned or is for a later time; it changed since you opened it; it was not found; an exercise of the template is no longer in the catalog; the phone was offline; the server did not answer; or anything else). A start the app sees succeed is not recorded this way. The record never says which workout or template it was.
The records go to this app's own database, where the rest of your data is, and nowhere else: not to Anthropic, OpenAI or xAI, and not to any analytics or advertising company. The app has no advertising identifier and does not follow you across other apps or sites. Until you answer, and until you have agreed to AI processing, up to 1,000 recent records (none older than 30 days) wait in the phone's storage and nothing is sent; if you decline, they are deleted from the phone.
Records are kept for 13 months after the server received them, and a daily clean-up deletes older ones. If you switch the setting off, the app stops recording and sending, but the records already stored stay until they are 13 months old or your account is deleted. Deleting your account removes them, and your recorded answers to this question, with the rest of your data.
Separately from this setting, the administrator computes aggregate statistics about the app from its own records of everyone, including people who did not switch “Share usage data” on: counts and shares, such as how many athletes finished a first workout. The setting covers only the records of screens and taps described above. The statistics are not a list of people, but in a pilot this small a count can describe one person.
When something breaks in the app, on the server or in your browser, the app sends an error report to Sentry, an error-tracking service, so that the developer learns about the failure and can fix it. A report holds only technical details: the kind of error, where in the app's code it happened, the page's route pattern without its own address (for example /workout/[id], not your workout's identifier), the request method, the app's version, and the name and version of your browser and operating system.
A report never contains your messages, TOT's replies, your workouts, profile, notes or health data, the error's text, cookies, the page's full address, your account identifier or your IP address. When your browser sends a report, Sentry sees your device's network address the way any website does, and it is set to store neither the address nor a location worked out from it. The administrator reads the reports in Sentry. They are stored in Sentry's EU data region; how long Sentry (Functional Software, Inc., a US company) keeps them is set by its own policy. Because a report is not linked to your account, it cannot be found and deleted on request.
The iPhone app sends reports in the same way once its error reporting is switched on; until then it sends none. A report from the app also names the phone's model, the version of its operating system and the app's version. The same rules hold: no messages, workouts or health data, no error text, no account identifier, and no link to your account.
Email the support address, from the email address your account uses (the administrator can give you the address); if you use Sign in with Apple and hide your email, that is the private relay address Apple made for TrainOnTap. We reply to that address with a one-time code, and we delete your account only after you send the code back. The Profile of the installed web version has a “Delete my data” row that opens a prepared email to the same address. Once the iPhone app has its own step for deleting an account, you will be able to ask there too, and the email route will stay.
On request, your profile, programs, workouts, logged sets, conversation with TOT, your ratings of its replies, notification subscriptions and devices, scheduled notifications, your choice of categories, your usage records and your recorded answers about usage data and AI consent are deleted from the app's database permanently, in one operation, and your Auth0 sign-in account is deleted. We aim to finish within one month of your request and write to you when it is done.
Some copies remain for a while or are out of our hands. Database backups are kept for about three months and then removed; a deletion does not reach them at once, and if one is ever restored, we repeat your deletion. This does not cancel or delete the conversation from the request history at Anthropic and OpenAI, where the traces also keep it: deletion on their side is governed by their data retention policies, not by this app. Expo's and Apple's push services, and Auth0's own logs, follow their own policies. The email you sent us stays in our mailbox. Error reports are not linked to your account, so they cannot be found and deleted.