Privacy Policy

Last updated: July 7, 2026

This Privacy Policy explains what data Full Coverage ("we", "us") collects at fullcoverage.app, why, and what your rights are. The short version: we collect the minimum needed to run a workout tracker, we don't run ads, and we never sell your data.

1. Data we collect

• Account data - your email address, a salted hash of your password (never the password itself), account creation date, email-verification status, subscription plan, the display name and interface language you choose, and a small amount of sign-in context: the two-letter country your requests arrive from (as reported by our CDN), the date you were last seen, how many times you have signed in, the website domain that referred you when you registered, and the kind of device you sign in from - one of iPhone, iPad, Android, Chromebook, Windows PC, Mac or Linux PC. We do not store your IP address against your account, we do not store your city or region, and the device is that category and nothing else: never your device model, your browser, or the user-agent string we read the category from. If you sign in with Google we store only your email address and the first name Google supplies.
• Training data - the workouts, sets, weights, exercise choices, equipment settings and profile options (such as body-map silhouette preference) you enter. This is the product; it is stored so you can access it from any device.
• Billing data - if you subscribe to Pro, our merchant of record Lemon Squeezy processes the payment. We never see or store your card number; we store only your Lemon Squeezy customer and subscription identifiers and your plan status.
• Technical data - standard server logs (IP address, request path, user agent) kept for security and debugging, and rate-limiting counters held briefly in memory. We do not use analytics trackers, advertising pixels or fingerprinting.
• Workout diagnostics - at the end of a workout the app sends a timeline of what happened in it: which stations you switched between, the sets you ticked, swaps, removals, repairs offered and taken, the coverage after each change, the build the app ran, and any error it hit. It is the workout's own numbers (exercise ids, set counts, coverage in sets) and nothing outside the app - never your IP address, device model or location. We use it to study how real gym sessions go and fix the app; it is kept for 120 days and then deleted. You can switch it off in Settings ("Workout diagnostics"). The same switch also covers a short record of how you moved through the app itself - when it opened, which step of setup you were on, whether you opened the workout picker - so we can see where people get stuck before a workout ever starts. It carries no new kind of information: screen names and counts, never text you typed.

2. Cookies

We use a single first-party, HttpOnly session cookie (auth-token) to keep you signed in for up to 7 days, plus a short-lived cookie during Google sign-in. No advertising or cross-site tracking cookies.

3. How we use data

To operate the Service (sync your training log across devices), to secure it (rate limiting, abuse prevention), to send transactional email (verification, password reset, billing notices), and to provide paid features. We do not send marketing email without separate consent, and we do not sell or rent personal data.

4. Processors we share data with

• Lemon Squeezy, LLC (merchant of record) - checkout and subscription billing.
• Resend - transactional email delivery (your email address and the message).
• Google - only if you choose "Sign in with Google".
• Cloudflare - DNS/proxy in front of our server (sees traffic like any CDN).

Hosting is on our own server; your training data is stored there and is not shared with anyone else.

5. Retention and deletion

Your data is kept while your account exists. You can export your training log from Settings at any time. You can also delete your account yourself, from Settings → Data → Delete account: it is immediate and permanent, and it removes your account record and your entire training log together. If you can no longer sign in, request deletion through our contact form and we will complete it within 30 days. Encrypted backups expire on a rolling basis within 30 days and are never used to restore a deleted account. See Delete your account and data for the full detail of what is removed and what we are required to keep.

6. Your rights

Depending on where you live (e.g. GDPR in the EU/EEA), you may have rights to access, correct, export, restrict or delete your personal data, and to lodge a complaint with a supervisory authority. Contact us and we will honour these requests for all users regardless of location.

7. Security

Passwords are hashed with bcrypt, transport is TLS-encrypted, sessions use HttpOnly cookies, and the server applies standard hardening headers and rate limits. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

8. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

9. Changes

We will post any changes here and update the date above; material changes will be announced by email or in-app notice.

Questions? Contact us.