Privacy Policy

Last updated: July 10, 2026

1. Who we are

This Privacy Policy explains how Metal Strength ("we", "us", the "Service") handles personal data on the website at metalstrength.fit. Metal Strength is operated by an independent developer based in France, acting as the data controller for the purposes of the EU General Data Protection Regulation (GDPR). You can reach us at [email protected].

2. Information we collect

a. Account information

Creating an account is optional. If you sign up with email and password, we store your email address and authentication details. If you sign in with Google, we receive your name and email address from your Google account. If you sign in with Apple (in the mobile app), we receive the name and email address Apple shares — which may be a private relay address if you choose to hide your email. Accounts and sign-in are handled for us by Supabase (see section 7).

b. Profile, training & health data you save

When you are signed in and choose to save something, we store the data you entered so we can build your history and progress charts. This can include:

• Profile defaults: sex, bodyweight, optional age, unit preference (kg / lb), and — if you answer the optional onboarding questions — your training goals and experience level
• Each saved lift: the exercise, weight and reps, estimated one-rep-max, strength tier, percentile, and the date you performed it
• Health-calculator saves: the inputs and results you choose to save from the macro and body-fat calculators (for example height, weight, age, activity level, calorie and macro targets, and body-fat estimates)

This is fitness and body data you knowingly enter and is tied to your account. We use it only to show you your own history and charts. You can delete any saved entry, or your whole account, at any time.

c. Messages you send us

If you use the contact or "notify me" form, we collect the name, email address and message you submit so we can reply and (for the launch list) email you. These messages are delivered to us by email through Resend.

d. Technical & usage data

Like virtually all websites, our hosting and security providers automatically process limited technical data needed to deliver and protect the site — for example your IP address, browser and device type, and request logs. Our bot-protection widget (Cloudflare Turnstile) also processes your IP and a token to tell humans from bots. We use this for security, abuse prevention, and to keep the Service running.

3. The calculator

The strength calculator runs entirely in your browser. If you are not signed in, the numbers you type are used only to compute your result on the page and are not sent to our database. They are transmitted to our servers only if you are signed in and click "Save to my log".

4. Cookies & similar technologies

We use cookies and similar browser storage for a few distinct purposes:

• Essential / sign-in: when you log in, your session is kept in your browser's local storage so you stay signed in. Without this, accounts cannot work.
• Security: Cloudflare Turnstile may set a token/cookie to verify you are not a bot when you submit a form.
• Analytics: Google Analytics helps us understand how the site is used (pages visited, sessions). In the EEA, UK and similar regions these cookies are only set after you consent.
• Advertising: Google and its partners set cookies to serve and measure ads — see section 5.

Where the law requires it (for visitors in the EEA, UK and similar regions), non-essential cookies — including personalised advertising — are only used after you give consent through our cookie/consent message. You can change or withdraw your choice at any time, and you can also block or delete cookies in your browser settings.

5. Advertising (Google AdSense)

This website is supported by advertising. We use Google AdSense, a third-party advertising service provided by Google. As a result:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info/choices and youronlinechoices.eu.

For more on how Google uses data when you use our site, see How Google uses information from sites or apps that use its services and the Google Privacy Policy.

6. Payments & subscriptions (PayPal)

Premium subscriptions are processed by PayPal. When you subscribe, PayPal collects and processes your payment details under its own privacy policy — we never receive your full card or bank details. We store what we need to run your subscription: your PayPal subscription id, the plan, its status, and renewal dates, linked to your account. We keep transaction records for as long as accounting and tax law requires.

7. Services we use (data processors)

We rely on a small number of trusted third parties to run the Service. Each processes data only as needed to provide their function and under their own privacy policy:

• Supabase — accounts, authentication and database for your saved data. Privacy policy
• Cloudflare — website hosting, content delivery and Turnstile bot protection. Privacy policy
• Resend — delivery of transactional and contact emails. Privacy policy
• Google — Google Fonts (loading our typefaces processes your IP), Google Sign-In, Google Analytics, and Google AdSense advertising. Privacy policy
• PayPal — payment processing for Premium subscriptions. Privacy policy

We do not sell your personal data.

8. Legal bases for processing (GDPR)

• Performance of a contract: creating your account, storing the data you ask us to save, and running your Premium subscription.
• Legitimate interests: keeping the Service secure, preventing abuse, and responding to messages you send us.
• Legal obligation: keeping billing and transaction records that accounting and tax law require us to keep.
• Consent: non-essential cookies, analytics and personalised advertising, and sending you launch/marketing emails you signed up for. You may withdraw consent at any time.

9. How long we keep your data

• Account, training & health data: kept until you delete it or close your account.
• Subscription & billing records: kept while your subscription is active, then as long as accounting and tax law requires.
• Contact / signup messages: kept only as long as needed to handle your request or while you remain on the launch list.
• Technical logs: kept short-term by our hosting/security providers for security and reliability.

10. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email [email protected]. You also have the right to lodge a complaint with your data protection authority — in France, the CNIL.

11. Deleting your data

You can delete individual saved entries from your dashboard at any time. To delete your entire account and all associated data, open Dashboard → Settings → Delete account (available on both the website and the mobile app) — deletion is immediate and also cancels any active Premium subscription so you are not billed again. If you prefer, you can instead email [email protected] from your account email and we will remove it for you.

12. International data transfers

Some of our providers (such as Google, Cloudflare, Supabase and Resend) may process data on servers outside the European Economic Area. Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Children's privacy

The Service is intended for a general fitness audience and is not directed to children. We do not knowingly collect personal data from children under 15. If you believe a child has provided us data, email [email protected] and we will delete it.

14. Mobile application

The Metal Strength mobile app offers the same accounts and features as the website, and this policy covers it. When you sign in, the data described in section 2 is stored in our database (Supabase) so your history is available across your devices — exactly as on the website, calculator inputs are only sent to us when you choose to save them. The app supports native Google and Apple sign-in, and Premium purchases are handled as described in section 6. The app build contains no advertising and no analytics trackers. Apple and Google may independently collect technical information through the App Store and Google Play under their own privacy policies.

15. Security

We use reputable providers and security measures (including database row-level security so an account can only ever access its own data, encrypted connections, and bot protection) to protect your information. No method of transmission or storage is completely secure, but we work to keep your data safe.

16. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected here with a new "Last updated" date above.

17. Contact

Questions about this Privacy Policy or your data? Email [email protected].