Privacy at WorkoutPacer
WorkoutPacer is built local-first. Your workouts, streaks, routines, and stats live in your own browser or on your own phone. They are only ever uploaded if you create an account and turn on sync. Nothing about you is sold, and there are no advertising trackers on this site.
This page says plainly what happens to data. If anything here is unclear, ask and it will get clearer.
What stays on your device
By default, everything that matters:
- Every workout you have finished, including sets, reps, times, and dates
- Your streaks, rest-day bank, goals, and achievements
- Every routine you build or tune
- Your settings, including cadence, cue sounds, voice packs, and reminders
You can export all of it as a JSON file at any time from Settings, with or without an account. There is no lock-in and nothing is held back.
What is stored on a server, and only if you ask
Creating an account is optional. The workout never requires one.
- Sign-in (Clerk). If you make an account, we store your email address so you can sign back in, plus an account ID. You can sign in with an emailed code, with Google, or on iPhone with Sign in with Apple; there is no password to leak. Google and Apple share your email address and, if you allow it, your name. With Apple you can choose to hide your email, and Apple then gives us a private relay address instead. We never receive your Google or Apple password.
- Sync (Supabase). If you sign in, your workout history and routines are copied to a database so they survive a lost phone and appear on your other devices. Row-level security means only your account can read your rows.
Delete your account and the synced copy goes with it. The local copy stays on your device until you clear it, and your JSON export is yours forever.
What is measured, and how to stop it
This section applies to the website only. The iPhone app contains no analytics.
WorkoutPacer uses PostHog to understand how the app is actually used, because guessing produces worse software. This is product analytics, not advertising.
What is collected: which pages and screens get opened, which buttons get pressed, whether a workout was started and whether it finished, how far through it got, the shape of a workout (how many sets, which movements, how many reps), which cue sounds and voices are chosen, and standard technical details like browser, screen size, and rough region derived from your IP address.
What is never collected: your workout history, your routine names, your email address, your name, or anything you type into a text field. Session recordings mask the contents of every input box, and no recording is ever made on the sign-in screen.
Session recordings. WorkoutPacer records anonymised playback of browsing sessions on the website so real usability problems can be found and fixed. Text you type is masked. Recordings are retained by PostHog and are used for nothing but improving the product.
How to switch it off. Open Settings and turn off "Anonymous usage analytics." That stops collection on that device immediately, including recordings. If your browser sends a Do Not Track signal, WorkoutPacer honours it automatically and never starts.
No cookies for analytics. Analytics state is kept in your browser's local storage, not in a cookie, and is never shared with an advertising network.
Analytics traffic is served from workoutpacer.com/ingest on this domain rather than a third-party address. That is a routing choice, not a disguise: the destination is PostHog, as described above.
What never happens
- Your data is never sold, rented, or shared with data brokers.
- There are no advertisements and no advertising or social-media tracking pixels.
- No microphone access is ever requested. Rep counting is by tempo, not by listening.
- Your workout history is never used to advertise anything to you, and no feature you rely on will be taken away and sold back to you later.
Children
WorkoutPacer is not directed at children under 13 and does not knowingly collect data from them.
Your rights
You can export your data yourself at any time, from Settings, in a plain JSON file. You can delete your account and its server-side copy at any time. You can turn analytics off at any time. If you are in the EU or UK and want a copy of, or the deletion of, anything held about you, ask and it will be done.
Changes
If this policy changes in a way that affects what is collected, the date at the top changes and the change is described here rather than quietly slipped in.
Contact
Questions about privacy: moelueker@gmail.com.