Privacy policy
Last updated 1 October 2026. Overset is run by [BUSINESS NAME TO BE CONFIRMED], the "controller" of your data under UK GDPR. You can write to us at [email protected].
The short version: Overset is a workout log. We keep what you log so it works on all your devices, we do not run ads, and we never sell your data.
What we collect
Your account. Your email address, and a password stored only as a hash (we cannot read it). If you sign in with Apple or Google, we receive the name and email they share with us.
What you log. Workouts, sets, weights, reps, notes, routines, programmes, goals, body weight and body measurements, progress pictures you choose to add, your settings and your answers to Trainer's questions (such as your goal, training days and equipment). This is your training data and it is the point of the app.
Notifications. If you turn on rest bell or reminders, we keep a push address for your device (and a short device description) so we can send them. We send them only to the devices you enabled.
Feedback you send. If you use Send feedback, we keep your message and any screenshot you attach, with your account.
Searches that find nothing. When an exercise search finds nothing, we may keep the search words, without your account, so we can add the exercise.
Purchases. If you subscribe to Trainer, the payment is handled by Apple or Google. We receive confirmation of whether you have Trainer and until when. We never see your card details.
Technical data. Our host and our network provider see your IP address and basic request details when you use the app, as every website does. We do not use advertising or tracking tools, and we do not build a profile of you.
Apple Health, Health Connect and Strava
These are off until you switch them on. If you allow Apple Health (iPhone) or Health Connect (Android), Overset can write your workouts and body weight to it and read body weight from it. Nothing from Health is used for advertising or shared with anyone else. You can withdraw access in your phone's settings at any time. If you connect Strava, we send it the workouts you choose to post, and nothing else.
How we use it
To run the app, sync your data between your devices, work out Trainer's suggestions from your own numbers, send the notifications you asked for, answer your messages, keep the service secure and fix faults. The legal bases are performing our contract with you, your consent (for notifications and Health), and our legitimate interest in keeping the service safe.
No automated decision with a legal or similar effect is made about you. Trainer's suggestions are advice for your training, and you can ignore them.
Who it goes to
We use a small number of providers to run Overset, and they process data for us under contract:
Supabase, which hosts the database, sign in and file storage, in London (eu-west-2). Sevalla, which hosts the website and app files. Cloudflare, which sits in front of the app and protects it. Apple and Google, for sign in, push delivery and purchases. Our email sender, for sign in emails and, if you opt in, reminders. [HOSTING AND EMAIL PROVIDER DETAILS TO BE CONFIRMED]
Some of these providers may process data outside the UK. Where they do, we rely on the UK's approved safeguards, such as the International Data Transfer Addendum.
We do not sell your data, share it for advertising, or give it to anyone else, unless the law requires it.
How long we keep it
We keep your data while your account is open. While your account is open we also keep earlier versions of your saved data, so a mistake can be undone. If you delete your account, we delete your account, your logged data, those earlier versions, your pictures and feedback screenshots, and your notification addresses straight away, and they cannot be recovered. Feedback messages are removed with the account.
Your rights
Under UK GDPR you can ask to see your data, correct it, delete it, restrict or object to how we use it, take it with you, and withdraw consent. In the app: Settings, Export data gives you everything in a file you can read, and Settings, Account, Delete account removes it. For anything else, write to us. We reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).
Children
Overset is not for children under 16, and we do not knowingly collect their data.
Security
Your data is encrypted in transit. Each account can read only its own rows, and we limit who can reach the systems that hold it. No service is perfectly secure, so please use a strong password.
Changes
If we change this policy in a way that matters, we will say so in the app before it takes effect.