Privacy Policy

We store the training information you give us: your account details, anything you choose to add to your profile, and the workouts and performance you log.

Your training data is sent to an AI provider only when you choose to connect an AI client such as Claude or ChatGPT. If you never connect one, it is not sent to an AI provider.

If you join or are added to a workspace or team, its admins and your facilitator can see your sessions, logs, and reports.

We do not sell your personal data, and we do not use advertising or tracking cookies.

You can delete your account and its data yourself, at any time, from Profile & Settings → Danger Zone.

AI-generated workouts are not medical advice, and nobody reviews them before you train. Read Health and readiness in our Terms of Service before you start.

Account information: your email address and a display name provided at registration. Your display name does not need to be your real name.

Physical profile: optional fields you choose to fill in — date of birth, gender, height, weight, and unit preference.

Training context: any information you choose to enter as coaching context — including goals, program preferences, sport context, movement limitations, training availability, or free-text notes — as well as any context our AI coach generates with your consent. You control what you share; training context fields accept free-form input and may contain any information you choose to provide.

Workout data: sessions, exercises, sets, reps, weights, and performance logs you record or that are created through connected AI clients.

Import data: historical training records you upload from third-party apps (e.g. Strong, Hevy).

Connection metadata: when you authorise an AI client (such as Claude or ChatGPT) to access SessionPlan, we record the client identity and granted permission scopes.

Usage data: server logs including your IP address, request timestamps, endpoint paths, and error states.

Page analytics: we use Vercel Web Analytics on every page. It records the page path, referrer and any campaign parameters, your approximate country, and your device type, operating system and browser, and it derives a visitor identifier by hashing your IP address and browser user-agent. That identifier rotates every day and cannot be linked back to you by us or used to follow you to other websites. It sets no cookies and stores nothing on your device. We use it only to count traffic in aggregate; we do not use it to identify you.

To operate and improve the service: delivering the core features of session logging, AI coaching context, and performance history.

AI-assisted coaching: when you connect an external AI client, your training context and history are transmitted to that client via the MCP protocol so it can generate personalised workout plans, recommendations, and reports. This is the only circumstance in which your training data is sent to an AI provider.

Aggregate product metrics: we compute measures such as how many people return and log again, using account creation dates and workout timestamps. This does not read the contents of your workouts, and results are never shared or sold.

Account management: authentication, password changes, and account deletion.

Service communications: transactional emails related to your account (password resets, security notices). We do not send marketing emails without explicit consent.

Our lawful basis for processing account and workout data is performance of our contract with you. Our lawful basis for page analytics is our legitimate interest in understanding aggregate traffic to our pages. If you object to analytics, email us at help@sessionplan.ai or use a browser or extension that blocks the analytics script.

By default, the sessions you create are private to you. Other members of a workspace cannot browse them.

Workspaces and teams are an exception you should know about. New accounts are automatically added to a shared workspace. A workspace administrator, and the facilitator of a team you belong to, can view your sessions, performance logs, and progress reports. If you would rather not have your training visible to a workspace administrator, do not store it in SessionPlan.

A small number of authorised personnel can access stored data where necessary to operate, support, secure and debug the service.

We do not sell your personal data to third parties.

Your data is stored and processed in the United States.

Your data is stored in Supabase-managed PostgreSQL databases. Supabase acts as a data sub-processor under their published privacy and security terms.

We use Vercel for hosting and for Vercel Web Analytics, a cookieless page-view analytics service, as a data sub-processor.

We use Resend to deliver account emails such as password resets. Resend receives your email address and the content of those emails, and acts as a data sub-processor.

SessionPlan data means the profile, training context, workout history, reports, and logs you save in the product.

When you connect an external AI client (e.g. Claude by Anthropic, ChatGPT by OpenAI, GitHub Copilot), SessionPlan shares the relevant SessionPlan data with that provider through the MCP (Model Context Protocol) standard so the client can answer questions and take actions for you. This happens only for clients you have explicitly authorised.

Your external AI provider may separately retain prompts, chat transcripts, attachments, and generated replies inside its own product. Each provider's own privacy policy and terms govern that conversation handling.

If you are in the European Economic Area or UK, note that these transfers are to the United States.

Your data is retained for as long as your account is active.

You may delete your account at any time from Profile & Settings → Danger Zone. Account deletion permanently removes your profile, training context, and workout history from our live systems. This action is irreversible.

AI-client OAuth tokens you granted are revoked immediately on account deletion, and any access token already issued stops working on its next use.

Database backups and server logs are retained on their own rotation and are purged in the normal course; deleted data can persist in them briefly after your account is removed.

Access and correction: most of your data can be viewed and edited directly in the app, in your profile, sessions, and logs. If something cannot be corrected in the app, email us at help@sessionplan.ai.

Deletion: you may delete your account and all associated data via the in-app delete-account flow, or by emailing us.

Portability: you may request an export of your data by emailing us. Exports are produced manually on a best-effort basis; there is no instant download today.

AI-client access: you can disconnect SessionPlan from an AI client at any time in that client’s own settings, which stops it requesting your data. SessionPlan does not yet have an in-app screen for listing or revoking connected clients. Deleting your account revokes all AI-client access. Email us if you need access cut off sooner.

Objection: you may object to our analytics processing as described under How we use your information.

If you are located in the European Economic Area or UK, you have rights under GDPR or UK GDPR to access, rectification, erasure, portability, restriction, and objection. SessionPlan is the data controller; contact us at help@sessionplan.ai to exercise these rights. You also have the right to lodge a complaint with your local supervisory authority.

We are a small team and support is handled by email on a best-effort basis. We do not offer a guaranteed response time.

SessionPlan uses your browser’s local storage to keep you signed in, and to keep a copy of your account and profile details so pages load without waiting. It also keeps a workout you have started — the session’s name, what you have entered and when you began — so a closed tab or lost connection does not lose it, and small preferences: your selected workspace and team, your session filters, the exercises you recently swapped to, and notices you have dismissed.

Signing out, or deleting your account, removes all of this from that browser. If your sign-in expires without you signing out, a workout in progress stays so you can sign back in and save it.

For as long as a browser tab is open, it also remembers the page to return to after you sign in, and which public catalog session you chose before creating an account.

We do not use advertising or tracking cookies.

Our page-view analytics (Vercel Web Analytics) does not use cookies, stores nothing on your device, and does not track you across other websites.

SessionPlan is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are in the European Economic Area or the UK, you must be at least 16, or the age of digital consent in your country if that is lower. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy as the product evolves. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after a change constitutes acceptance of the updated policy.

September 17, 2026. We now describe SessionPlan as an AI-assisted coaching platform rather than an AI coaching service, the same words our Terms of Service already use. Nothing about how we collect or use your data changed.

August 30, 2026. We rewrote this policy for a public audience. Most changes describe practices that were already in place; we have said them plainly rather than leaving them to inference.

We now describe exactly what our page analytics collects, including that it processes your IP address to derive a rotating daily identifier, and that it runs on every page rather than only public ones. This is a fuller description of existing practice, not a new collection.

We now state that workspace administrators and team facilitators can view your sessions, logs, and reports. This has always been the case.

We now state that we compute aggregate return-and-log metrics from account and workout timestamps.

We removed a promise of in-app revocation for AI-client access that had no implementation behind it, and replaced it with what you can actually do today.

We added a plain description of where your data is stored, our lawful bases, your GDPR rights, and how to export your data.

Questions about this policy: help@sessionplan.ai