Thicctory is a personal training log. This notice describes what it stores about you, why, who else processes it, and how long it is kept. It is written for the people using the app, not as a legal template.
What is stored
- Your account: email address, a display name if you set one, and — from sign-up — the day you confirmed you were an adult, and which version of the terms and of the health-data consent you agreed to, and when. The date of birth you enter at sign-up is checked and not kept.
- What you log: training sessions, exercises, sets, reps and weights; running and cardio data.
- Body data: weight, measurements and body composition check-ins, and your body profile — height, sex and date of birth.
- Nutrition: calories and macronutrients, including anything imported from another app.
- Notes you write against dates, which are free text and may describe symptoms, injuries or illness.
- Goals, routines, training plans and diet plans.
- Community activity: friendships, challenges, shared routines and suggestions — including the email address of anyone you invite, which is deleted after 90 days.
- Subscription status. Card details are handled by Stripe and never reach this app.
Much of this is data about your health. Storing it at all rests on the consent you give when you sign up, which is separate from agreeing to the terms of service; a training log cannot work without it, so withdrawing it means deleting your account. It is only used for the purposes below, and the AI features do not process it at all unless you separately agree.
Why
- To run the app: showing your history, statistics, plans and progress — the service you asked for.
- To run a subscription, where you have one.
- For the AI features — Coach and the Diet Planner — only with your explicit consent, given separately for each, and withdrawable at any time.
There is no advertising, no profiling for marketing, and nothing is sold.
The AI features
Coach and the Diet Planner send parts of your data to Cloudflare, which provides the AI model, where it is processed in the United States. Each feature is agreed to separately, and neither sends anything before you agree.
Coach
- Training sessions: exercises, sets, reps, weights, duration and heart rate
- Nutrition: calories and macronutrients you have logged
- Body measurements: weight, body fat and the measurements you record
- Your notes — which are free text, and may describe symptoms, injuries, illness, medication or test results
Diet Planner
- Your body profile: height, sex, date of birth and current weight
- Your weight trend and the calories you have logged
- Your goal: target weight, pace and dietary pattern
The Diet Planner is intended to help healthy adults with general fitness and weight-management goals estimate calorie and macronutrient targets and track progress. It is not intended to diagnose, prevent, monitor or treat disease or medical conditions, and is not intended as a substitute for professional medical or dietetic care.
Withdrawing consent stops any further processing and deletes what that processing produced: for Coach, your conversations, the technical record of each answer and the search index of your notes; for the Diet Planner, the technical record of each answer. Plans you chose to start are your own record and are kept until you delete them or your account. Withdraw from the Coach page, the Diet Planner page, or Your data.
AI output can be wrong. These features are a personal fitness assistant, not a qualified professional, and not a substitute for a doctor, dietitian or other qualified health care specialist.
Who else processes it
- Supabase — the database and sign-in, hosted in the United States (region us-west-1). All of the data above is stored there.
- Netlify — hosting. Requests pass through it, so data in a request or a response passes through it too.
- Cloudflare — the AI model, in the United States, and only for the features you have agreed to. Cloudflare states that it does not use customer content to train models, does not train large language models itself, and does not make customer content available to its other customers.
- Cloudflare Turnstile — a check that sign-ups come from a person rather than a bot. It sees your IP address and some details of your browser, on the sign-up page only.
- Stripe — subscription payments. Stripe keeps its own records of payments, including after you delete your account.
This means your data, including health data, is processed outside the UK, in the United States. The following each have a data processing agreement covering that transfer:
- Supabase (Supabase Pte. Ltd) — the EU Standard Contractual Clauses, controller-to-processor, together with the UK Addendum issued by the Information Commissioner.
- Cloudflare (Cloudflare, Inc., San Francisco) — the Standard Contractual Clauses with the UK International Data Transfer Addendum, and the EU-US Data Privacy Framework where it applies, under its data processing addendum (v6.4, 3 April 2026).
- Netlify — the EU-US Data Privacy Framework and its UK extension where they apply, and otherwise the Standard Contractual Clauses with the UK International Data Transfer Addendum.
How long it is kept
- What you log is kept until you delete it, or until you delete your account.
- The database has no routine backups on the plan it runs on, so something you delete is gone straight away and cannot be recovered. Download a copy from Your data if you want one.
- Coach conversations are kept until you delete them, or until you turn Coach off.
- The technical record of each AI answer is deleted after 90 days, and immediately if you withdraw consent. It is kept to check the quality of answers.
- The record that you gave or withdrew consent, and when, is kept: it is the evidence that processing was authorised.
Your choices
- A copy of everything — download it as a JSON file from Your data.
- Deletion — delete your account from the same page. It removes your account and everything in it straight away, and cancels any subscription.
- Withdrawing AI consent — at any time, with the deletion described above.
- Correction — everything you log can be edited in the app.
If you are in the UK or the EU, you also have the right to complain to a data protection authority; in the UK that is the ICO.
Contact
Thicctory is run by one person. For anything about this notice, or to exercise any of the above, email plates.midlife2j@icloud.com.