Privacy policy

Last updated 26 August 2026.

Who holds your data

Peak Health is operated by Erik Pastor Rios, who decides everything this page describes. Write to privacy@peakhealth.es about any of it.

What an account holds

Your email address, the name you gave, a picture if you added one, whether the address has been confirmed, and the day the account was made. Sign-in is an address and a password, so there is no Google, Apple or Facebook sign-in and none of them is told that you are here. The password is stored as a hash and never as the password itself.

You can start with no account at all. The first routine you save makes a guest account so the work is not thrown away, and that account holds the same rows as any other with no address attached to them. Signing up afterwards keeps the work and moves it across.

What a sign-in records

Every session stores the IP address the request came from, the browser or app that sent it, and when the session runs out. The browser keeps a cookie called better-auth.session_token for seven days; the phone keeps the same session in the device's own keychain. A sign-in request also carries a fingerprint of the browser, which the sign-in library works out to recognise an attack, and which reaches this app's server and nowhere else.

What your training holds

Your routines: their names, their sections, and any note on them. Your workouts: when each one began and finished, the time zone it happened in, and every set in it: the load, the reps, the duration, how hard it felt, the rest you took, and which side it was on. A rating for the whole session, a note on it, and any routine you left half-built.

Over weeks and months, your training history shows what your body can do. European data protection law treats that as health data, a special category under GDPR Article 9. Peak Health treats it the same way.

Being seen by other athletes

By default, only you can see your training. Your public profile is the setting that lets other athletes find and follow you, and you alone decide to turn it on. When you turn your public profile off, your followers stop seeing your training.

Your training history is health data, so the law requires your explicit consent before anyone else sees it. Turning your public profile on gives that consent for that one purpose. Turning it off withdraws it at once.

Where it is kept

One Postgres database, hosted by Neon. Accounts and training sit in it, and so does everything that keeps the service standing up: the open sessions, the consent you gave a connected assistant, and the counters that stop one account from hammering the server. The phone keeps a copy of your routines and workouts on the device so a session can open with no signal, and signing out erases that copy. Nothing else leaves that database except where this page says it does. The site itself runs on Vercel, which sees every request made to it.

What analytics sees

Product analytics goes to PostHog, on its European cloud. On the web it records the pages you open, the pages you leave, and the errors the browser throws. On the phone it records the app opening and closing, each set you complete, and each session you finish: the exercise, the load, the volume, and how hard the session felt. It also records the errors it catches and how each one happened. Once a night we send two counts of how many accounts the sweep took, with no account and no address.

While you are signed in those events carry your account id, your email address and your name, so one person’s events can be told from another’s. When you sign out, that link breaks for everything after it.

There is no switch that turns this off today. This page names that gap.

The sign-in vendor

Sign-in is built on Better Auth, an open-source library that runs on this app's own server. It sends no account data or training to Better Auth's servers.

The waiting list

Asking to be told when Pro arrives sends your email address to Resend, a company in the United States that holds the list, and to PostHog. Nothing else about you goes with it, and nothing has been sent to that list yet.

Notifications

The phone's rest timer schedules its alert on the phone itself. No push token is made, nothing is registered with Apple, Google or Expo, and no notification is ever sent from a server. Refusing the permission costs you the alert and nothing else.

Language

On the web the language is part of the address, /en or /es, and the phone reads the language and the time zone from the device. Your account keeps the language we last saw you reading, so that a mail about your own account arrives in it; the time zone is not kept. It is not a setting, and no screen offers one.

An assistant you connect

You can connect an AI assistant to your account through the MCP server. Once you approve it, that assistant can read and write your routines and read your workout history, notes and ratings included, until you disconnect it in Settings. You choose which assistant, and what it does with what it reads is between you and whoever runs it.

The exercise catalogue

Asking for a movement the catalogue does not hold opens a public issue on the open-exercise-db repository. It carries the movement (the name, the muscles, the equipment, the instructions), and carries nothing about you: not your name, not your address, not a set you have done.

What is never done

Your data is not sold, not rented and not handed to a data broker. There is no advertising in the product, and no advertising network is told anything about you. Nobody is profiled for anyone else's purposes.

What you can ask for

You can read, correct, export and delete everything held about you. Deleting the account is in Settings on the web and in Settings on the phone, and it takes your routines, your workouts, your drafts and your preference with it. For a copy of your data, a correction, an objection or a complaint, write to privacy@peakhealth.es.

You can also complain to your country’s data protection authority. In Spain that is the Agencia Española de Protección de Datos.

How long it is kept

Your training is kept for as long as the account exists, because a history that expires is not a history. A session runs out after seven days. Once a night we delete two kinds of account that hold nothing: a guest account older than thirty days that holds no training and nobody is using, and a named account older than thirty days whose address was never proved. An account that holds training is never swept, whatever its age, and you no longer have to ask. An account that holds an address receives a mail recording the deletion after it happens.

When this page changes

This page changes when the code it describes changes. The date at the top is the last time that happened.