Privacy policy

Last updated October 26, 2026 · Français

WorkoutLog Pro is a training log at workoutlogpro.com, with a connector that lets AI assistants such as Claude and ChatGPT read and write your log when you allow it. It is operated by Mathieu Giguere, a sole proprietor in Quebec, Canada. This policy explains what we collect, why, who processes it, how long we keep it, and your rights under Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA.

Person responsible

Mathieu Giguere is responsible for the protection of personal information. Contact: support@workoutlogpro.com.

What we collect

Account: your email address, and if you sign in with Google, your name, profile photo link and Google account identifier. We never see your Google password. If you sign in with an emailed link, we keep the request (address, time, IP address) until the link expires.
Your training log: exercises (with nicknames you give them), workouts and their dates, names and notes, and each set's reps, weight, time, distance, band level, side, effort rating and notes; sets flagged to refine; workout plans you or your AI app save for a day.
Body weight, only if you choose to log it.
Settings: weight unit, timezone, language, rest timer, and whether you appear on the leaderboard.
In-app AI assistant (currently available to invited users only): the messages you send and the assistant's replies.
Connected AI apps: the name of each app you connect (for example "Claude"), when you connected it and last used it, and the access tokens that let it act for you. We store only a one-way hash of each token. For every request an AI app makes we record the tool used, whether it worked, how long it took and which app made it; we do not record the content of the request in that log.
Feedback: messages you send through the Feedback button, and feature requests an AI app files on your behalf. They reach the developer without your name or email (only an internal account number); to reply, we look up your account's email in our database.
Technical: a session cookie that keeps you signed in, a record of which pages of the app you open and when (used to count how often features are used), and standard server logs (IP address, page requested, time) used to run and secure the service. We use no advertising or third-party analytics trackers.

We do not receive your conversations with an AI app. When you connect Claude or ChatGPT, we only receive what the assistant sends to our tools (for example "log bench press, 3 sets of 8 at 135 lb") and send back the training data it asks for. What the AI app does with that data is covered by its own privacy policy.

Health-related information

Your workouts and body weight can reveal information about your health, which the law treats as sensitive. We use it only to provide the log, its history and records to you and the AI apps you connect. By creating an account and logging workouts you consent to this use. You can withdraw your consent at any time by deleting your account.

Leaderboard

The public leaderboard is off by default. If you turn it on in Settings, it shows your first name, the first letter of your last name and how many days you have trained, to anyone who visits it. Nothing else from your log is shown. You can turn it off at any time and you disappear from it at once.

Why we use it

To run your log: store workouts, compute volume, history, personal records and progress.
To let the AI apps you connect read and update your log, only within the access you approve.
To keep the service secure and working, fix bugs, and answer your messages.
To email you: sign-in links you request and notices about your account (such as a deletion confirmation). We send no marketing email.
To understand which features are used (page and tool-call counts, not their content) so we can improve them. If you tap "Notify me" on a feature that isn't available yet, we record that, and may email you once when it is.

We do not sell or rent your personal information, use it for advertising, or build advertising profiles. We do not use your log to train AI models.

Who processes it

DigitalOcean hosts our server and database in Toronto, Canada.
Google provides sign-in.
Resend delivers our emails (sign-in links and account notices); it receives your email address and the message.
OpenRouter and the model provider it routes to (currently Google Gemini) process the messages you send to the in-app AI assistant, only when you use it.
The AI apps you connect (such as Anthropic's Claude or OpenAI's ChatGPT) receive the training data their requests ask for, because you asked them to act for you.
Feedback notifications reach the developer through a private Discord channel, identified only by an internal account number.

Some of these providers process data outside Quebec (in other Canadian provinces or the United States). Each is bound by its terms to use the information only to provide its service and to protect it. We disclose information to authorities only when the law requires it.

How long we keep it

Your account and log: until you delete them.
Connected-app access: access tokens expire after 1 hour and refresh tokens after 90 days unused; you can disconnect an app at any time.
When you delete your account, it is erased from our live database immediately. Backups are kept for 30 days and then destroyed, so the deletion is complete within 30 days.
Server logs: kept for a limited time for security and deleted automatically as they age out.

Your rights

You can, at any time:

Access and export your data: in the app, open Settings and choose Download my data (a complete JSON file).
Correct it: edit or delete any set, workout, exercise or body-weight entry in the app.
Delete your account and all its data: Settings → Delete my account.
Disconnect an AI app: Settings → AI assistant → Disconnect.
Withdraw consent, ask questions, or make a request we haven't automated: write to support@workoutlogpro.com. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Security

All traffic uses HTTPS. Access tokens and authorization codes are stored only as one-way hashes. Each connected app can act only for the account that approved it, and only with the access you granted (read only, or read and write). If a breach involving your information creates a risk of serious injury, we will notify you and the Commission d'accès à l'information.

Children

WorkoutLog Pro is not intended for children under 14, and we do not knowingly collect their information.

Changes

We will post changes here and update the date above. If a change affects how we use information you already gave us, we will tell you in the app before it applies.