Privacy Policy

Last updated: July 7, 2026

This Privacy Policy explains what data Full Coverage ("we", "us") collects at fullcoverage.app, why, and what your rights are. The short version: we collect the minimum needed to run a workout tracker, we don't run ads, and we never sell your data.

1. Data we collect

• Account data - your email address, a salted hash of your password (never the password itself), account creation date, email-verification status and subscription plan. If you sign in with Google we store only your email address.
• Training data - the workouts, sets, weights, exercise choices, equipment settings and profile options (such as body-map silhouette preference) you enter. This is the product; it is stored so you can access it from any device.
• Billing data - if you subscribe to Pro, our merchant of record Lemon Squeezy processes the payment. We never see or store your card number; we store only your Lemon Squeezy customer and subscription identifiers and your plan status.
• Technical data - standard server logs (IP address, request path, user agent) kept for security and debugging, and rate-limiting counters held briefly in memory. We do not use analytics trackers, advertising pixels or fingerprinting.

2. Cookies

We use a single first-party, HttpOnly session cookie (auth-token) to keep you signed in for up to 7 days, plus a short-lived cookie during Google sign-in. No advertising or cross-site tracking cookies.

3. How we use data

To operate the Service (sync your training log across devices), to secure it (rate limiting, abuse prevention), to send transactional email (verification, password reset, billing notices), and to provide paid features. We do not send marketing email without separate consent, and we do not sell or rent personal data.

4. Processors we share data with

• Lemon Squeezy, LLC (merchant of record) - checkout and subscription billing.
• Resend - transactional email delivery (your email address and the message).
• Google - only if you choose "Sign in with Google".
• Cloudflare - DNS/proxy in front of our server (sees traffic like any CDN).

Hosting is on our own server; your training data is stored there and is not shared with anyone else.

5. Retention and deletion

Your data is kept while your account exists. You can export your training log from Settings at any time. To delete your account and all associated data, use our contact form from your account email - deletion is permanent and completed within 30 days. Backups expire on a rolling basis.

6. Your rights

Depending on where you live (e.g. GDPR in the EU/EEA), you may have rights to access, correct, export, restrict or delete your personal data, and to lodge a complaint with a supervisory authority. Contact us and we will honour these requests for all users regardless of location.

7. Security

Passwords are hashed with bcrypt, transport is TLS-encrypted, sessions use HttpOnly cookies, and the server applies standard hardening headers and rate limits. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

8. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

9. Changes

We will post any changes here and update the date above; material changes will be announced by email or in-app notice.

Questions? Contact us.