Last updated ·
Privacy policy
What Sparlift stores, why, who helps run it, and how to see or erase your data.
The short version: Sparlift stores what you log so it can show it back to you. There are no ads and no tracking cookies, and your data is never sold. You can erase your training and body data from Settings at any time.
Who is responsible
Sparlift is an independent project run by one person, who is the controller of your personal data under the GDPR. Contact: [email protected].
What we store and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, and your password stored only as an argon2id hash | To give you an account and let you log in | Contract: needed to provide the service |
| Time zone | To put each session on the right day | Contract |
| What you log: workouts, sets, rounds, classes, routines, plans and your own exercises, including a Hevy history you import | To show your training back to you and estimate recovery | Contract |
| Body measurements you add (weight, body fat, body water, visceral fat) and body-scan reports you upload | To chart them over time | Your explicit consent, given by adding them; withdraw it by deleting them |
| Server logs: IP address, browser, pages requested and time | Security and fixing errors | Legitimate interest in keeping the service safe |
Body measurements and some training data can count as health data. Sparlift only processes them because you choose to add them, and only to show them back to you.
Who helps run Sparlift
- Amazon Web Services hosts the servers and the database in London, UK. The EU recognises the UK as giving personal data adequate protection.
- Cloudflare sits in front of the site to deliver it quickly and block attacks. It sees your IP address and the pages you request.
- Anthropic reads the numbers from a body-scan report, and only when you upload one. The files are sent to Anthropic's API in the USA for that one reading, under its commercial terms and standard contractual clauses. Those terms don't allow Anthropic to train models on them.
Nobody else receives your data.
In your browser
- One cookie,
tracker_session, keeps you logged in for up to 180 days. It's strictly necessary, so there is no cookie banner. - The app keeps a few settings (theme, units) and any logs that haven't synced yet in your browser's local storage, so it works offline.
- If you choose English or Spanish on the public site, that choice is remembered on your device.
- There are no analytics, advertising or tracking cookies.
How long we keep it
- Your account and what you log: until you erase it or ask for your account to be deleted.
- Server logs: a few weeks at most.
- Database backups roll over within 35 days, so erased data leaves them within that time.
Your rights
You can ask to see, correct, export or delete your data, object to how it's used, or withdraw your consent. Write to [email protected] from your account's address; you'll get an answer within a month.
- Erase your data yourself: More → Settings → Erase all data deletes your workouts, routines, plans, own exercises, body measurements and uploaded reports straight away.
- Delete your account: email us and the account itself is deleted too.
- Export: email us and you'll get your data as a file.
If you think your data has been handled wrongly, you can complain to your data protection authority. In Spain that is the AEPD (aepd.es).
Security
Your connection to sparlift.com uses HTTPS. Passwords and login tokens are stored only as hashes, so a copy of the database doesn't reveal them. Images in uploaded reports are stored without their location metadata (EXIF).
Children
Sparlift isn't meant for anyone under 16.
Changes
When this policy changes, the date at the top changes with it.