Privacy policy

Effective October 30, 2026

Personal Record is a lifting journal. This page explains what data the app handles, why it handles it, and the choices you have.

Who to contact

Nine4 provides Personal Record. For privacy questions, access requests, or help deleting data, email team@nine4.co.

The data you put in your journal

The app stores the exercises, variations, tags, sets, weights, repetitions, dates, notes, and preferences you enter. Your journal is saved on your device so you can use it offline. Personal records are calculated from that training history.

Device-only use and optional accounts

You can use a device-only journal without an account. That journal is not uploaded to our Supabase cloud database unless you choose to import it into an account. Device storage may be subject to your device's backup settings.

If you create an account, we use Supabase for authentication and cloud storage of the journal associated with that account. The app keeps a local cache to support offline use and synchronizes changes when a connection is available. Account records are associated with your account identifier.

Signing in with Google or email

If you choose Google sign-in, Google shares basic identity information with our authentication provider, Supabase. This can include your Google account identifier, email address, name, and profile image. We use this information to create or identify your Personal Record account and authenticate your access. The app does not request access to your Gmail, Google Drive, contacts, or calendar.

If you use email and password, Supabase handles your credentials and account authentication. Authentication sessions are stored using the operating system's secure storage on native devices; the web version uses browser storage. You can sign out in the app.

Personal Record' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

How we use information

We use account and training information to provide the journal, calculate records, authenticate you, synchronize your data, resolve sync conflicts, and respond to support requests. If you contact support, we receive the information you send us. Please avoid sending passwords or unnecessary sensitive information.

Service providers and technical information

Supabase processes account and cloud journal information on our behalf. Google processes your sign-in according to its own policies. Our website is hosted through OpenAI Sites, backed by Cloudflare. These providers may process technical information, such as IP addresses, request details, and security logs, to operate and protect their services. Information may be processed outside your country.

Learn more from the Supabase privacy policy, Google privacy policy, OpenAI privacy policy, and Cloudflare privacy policy. If you join the beta through TestFlight, Apple also handles information under its applicable terms and privacy policy.

Sharing, advertising, and website storage

We do not sell your training or Google account data. We do not use Google account information for advertising. Our website code does not include advertising or analytics scripts. Hosting providers may use cookies for security and bot protection. The app uses local storage and authentication storage to provide its functionality. We may disclose information when legally required or as necessary to protect the service and its users.

Export, retention, and deletion

You can export your journal from the app's account screen. We retain cloud account and journal information while your account remains active, unless you delete it or request deletion.

The account screen includes a confirmed account-deletion action that deletes your account and cloud training data. The separate device-only journal is retained. Signing out alone does not delete an account. To remove device-only data, use your device's app-data controls or uninstall the app; backup copies may be managed separately by your device or backup provider.

Deletion may not immediately remove information from provider backups or operational logs. Those copies are subject to the providers' retention and deletion processes. Data you have exported or copied elsewhere remains under your control. Contact us if you need help or cannot access the deletion option.

Security and your choices

We use authenticated access and per-account database access rules to protect cloud journals. No storage or transmission method is completely secure. Keep your device and sign-in credentials secure. Depending on where you live, you may have rights to access, correct, export, or delete personal information. Contact us to make a request.

Children

Personal Record is not intended for children under 13. If you believe a child has provided personal information through the service, contact us so we can investigate and address it.

Changes to this policy

We may update this policy as the app changes. We will publish the revised policy here and update its effective date. For material changes, we will provide additional notice when appropriate.