Privacy policy

orcatrain is operated by Aidan Zammit, trading as orcatrain, as a sole trader established in Malta. As a sole trader there is no separate company — the controller is a named individual, and that individual is contactable at:

zammitaidan@gmail.com

Data protection in Malta is governed by EU GDPR together with its national implementation, the Data Protection Act (Chapter 586 of the Laws of Malta), and supervised by the Information and Data Protection Commissioner (IDPC). You have the right to lodge a complaint with the IDPC at any time — see "Supervisory authority" below.

Every category below is something the app actually stores today, not a future plan.

• Account and sign-in data. Your email address, and either a password or, if you sign in with Google, your Google account identifier. This is held by Amazon Cognito, the identity service orcatrain runs on — we never see or store your password ourselves.
• Profile data. Sex, birth date, height, a display name if you set one (which is what a coach sees instead of your email address), a goal bodyweight if you set one, your unit preference (metric or imperial — for display only; everything is stored in metric), and which of trainee/trainer you use the app as.
• Bodyweight history. A weigh-in per date you choose to log.
• Profile picture, if you upload one. It is held in a private store that is not readable by anyone on the open internet — the app hands your browser a short-lived link when it needs to show it. Removing the picture, or deleting your account, deletes the file itself and not merely the reference to it.
• Activity and settings. The date you last logged something, so a coach can see which of their trainees have gone quiet; whether you've turned the trainer email digest on and what hour you want it; and a per-day count of how many questions you've asked the AI assistant, which exists to cap usage rather than to profile you.
• Training history. Workouts, the sets logged in them, your personal exercise library (including any demo video links you add — we store the link, never the video), and any training programs you create, copy or are assigned.
• Coaching relationships, if you use them. If you connect with a coach or coach others, the app stores who is linked to whom, and — if you list yourself as a coach — the contents of that listing.
• Payment pointers, if you accept payments as a coach. We store an id and a status for your Stripe connected account and for a trainee's subscription to you — never card numbers, bank details or a running balance. That data lives with Stripe; see their own privacy policy for how they handle it.
• Questions you ask the AI assistant, if you use it. The assistant answers using a fixed, closed set of tools that can only read your own account's profile, bodyweight and training data — never another user's. Your question, and whatever that lookup returns, is sent to our model provider, Anthropic, to generate the reply. Nothing is sent to Anthropic if you never open the assistant.

No cookies. No advertising. We don't track you across other sites, run an advertising pixel, or sell or share your data with anyone for marketing — and we never will without saying so here first. We do use one privacy-preserving product-analytics tool, only if you agree to it, and it is described in full under “Product analytics” below. The only outbound links on the site are plain links you choose to click — to strengthlevel.com for a movement's strength standards, or to a YouTube video you or another user linked to as a demo. We never embed either; clicking one takes you to that site, which then applies its own privacy policy, not ours.

Your browser, not our servers, holds a few small things locally: your signed-in session tokens and your light/dark theme choice (in localStorage), and, only for the few seconds a sign-in takes, a one-time verification value (in sessionStorage). None of this is a cookie, none of it is used to track you, and none of it ever leaves your device except when it's presented back to our own API to keep you signed in. Once you answer the analytics question, your answer is stored there too so we don't ask again — that record is how “no” is remembered, which is why clearing it brings the prompt back. If — and only if — you agree to product analytics, that tool stores one further value in localStorage: a random identifier for the browser, so repeat visits can be counted as one visitor rather than several. It is not linked to your account, and withdrawing consent deletes it.

orcatrain sets no cookies at all. The session and theme values described above are strictly necessary for the app to work — staying signed in, remembering your theme — and are not the kind of non-essential tracking that Malta's ePrivacy rules (S.L. 586.01) require consent for, so they are not behind a prompt.

Product analytics is different, and it is behind a prompt. Those rules test whether something stores or accesses information on your device, not whether that something is technically a cookie — so the analytics identifier needs your consent even though it is stored in localStorage rather than as a cookie. Nothing analytics-related is downloaded, run or stored until you accept: refusing is one click, exactly as prominent as accepting, and is the default if you ignore the prompt or close it. You can change your mind at any time from the link in the footer, or beside “Sign out” when you're signed in; withdrawing takes effect immediately and deletes the identifier.

Your account, profile and training data are stored on Amazon Web Services in the United States (the us-east-1 region in Northern Virginia) — that covers the database, the sign-in service and the API. Transfers out of the EEA rely on the European Commission's Standard Contractual Clauses, which form part of AWS's data processing addendum. We spell this out because the analytics section below describes an EU-hosted tool, and we would rather you knew the rest of the system is not EU-hosted than let that imply otherwise.

With your consent, orcatrain uses PostHog to understand how the app is used — which screens people reach, whether sign-up completes, whether a set gets logged. It is hosted in the European Union (PostHog's EU region, in Frankfurt), so this data stays in the EEA, and PostHog acts as our processor.

It is anonymous, and deliberately poor at identifying you. We never tell it who you are: not your name, your email address or your account id. What it gets is a random per-browser identifier, the page you are on, and the technical details any analytics tool records by default — your browser and operating system, your screen size, and an approximate location (country and region) that PostHog derives from your IP address. That is not nothing, and we would rather say so than claim more privacy than we deliver. We have switched off the features that would otherwise collect a great deal more on their own: there is no session recording, no heatmaps, no automatic capture of clicks or form fields, and no surveys.

Your training record is never sent. No bodyweight, no loads, reps or RPE, no DOTS score, no birth date, sex or height, no exercise, workout or programme, and no free text of any kind. The events we record carry nothing but true/false flags — for example “a set was logged”, and whether it was the first of the day. Web addresses are stripped before they are sent, so a page like /programs/12345 is recorded only as /programs/:id — the page you were on, never which record you opened.

Analytics data is kept for up to a year and then deleted by PostHog. If you use a content or ad blocker it will most likely block this entirely, which is fine — we don't work around blockers, and it means our numbers are an undercount rather than a complete record.

We process your account, profile and training data because you asked us to, by creating an account and using the app to log your training — that's a processing contract with you (GDPR Article 6(1)(b)), not something we do on any separate legal basis. If you use the AI assistant, sending your question to Anthropic to answer it rests on the same basis: it's part of the feature you asked for.

Your data is kept for as long as your account is active, and for five years after your last sign-in. Signing in at any point resets that five-year clock. Before that period ends, we try to warn you first, so you have the chance to sign in and keep your account — though in fairness the automated reminder is not built yet, so for now this is a rule we apply by hand rather than a job that runs. If it lapses anyway, your data is permanently and irreversibly deleted — this is a hard delete, not an archive.

Under GDPR you can ask to access, correct, delete, restrict, or receive a copy of your personal data, and to object to how it's processed. Most of these you can exercise yourself, immediately, without asking us: reviewing and correcting your profile, bodyweight and training data anywhere in the app, and — on your profile page — downloading everything we hold on you as a single file, or deleting your account outright. Deletion is a hard delete, not an archive, and it cannot be undone. For the rights that have no button — restricting or objecting to processing, or asking a question about any of this — contact us at the address above and we'll handle it by hand.

Malta sets the minimum age at which someone can consent to an information-society service like this one, without a parent or guardian's involvement, at 13 (Subsidiary Legislation 586.11 under the Data Protection Act). If you are younger than 13, a parent or guardian needs to consent on your behalf before you use orcatrain — we don't currently have an automated way to collect or verify that consent, so please have them contact us using the address above first. This is separate from, and does not change, the minimum age to send or receive payment through the app's coaching features, which is handled elsewhere.

You can lodge a complaint about how orcatrain handles your data with Malta's Information and Data Protection Commissioner (IDPC) at any time, at idpc.org.mt.

If what orcatrain collects or why changes, this page changes with it, and the "last updated" date at the top moves. We don't keep an old version live once it's out of date.