legal/privacy

Privacy Policy

last_updated: 2026-05-18T00:00:00Z

Workout Agent is an open-source AI strength coach that connects to your Hevy account. We take your privacy seriously and only collect what is strictly necessary to make the service work.

TL;DR: We store your Google account email (for sign-in) and your Hevy API key (encrypted, so we can fetch your workout data on your behalf). We never sell or share your data, and we never use it to train AI models. You can delete everything at any time from your account settings.

Who we are

Workout Agent is an open-source project maintained at github.com/ThomasVrancken/workout-app. For any privacy-related questions, contact us through a GitHub issue or via the email address listed on the maintainer's GitHub profile.

What data we collect

When you sign up and use Workout Agent, we collect and store:

Your email address and display name — provided by Google when you sign in (via Firebase Authentication).
Your Hevy API key — provided by you, encrypted at rest using AES-128 (Fernet) before being stored.
Account metadata — account creation date, last active date, and the date and version of the Terms you consented to.

We do not store your chat messages or any of your workout data on our servers. Workout data is fetched live from Hevy on each request and held only in memory for the duration of the request.

How we use your data

To authenticate you via Firebase Authentication.
To call the Hevy API on your behalf using your API key — reading or modifying your workout data when you ask the AI to.
To send your messages to Google's Gemini API (via Vertex AI) so the AI can generate a reply. We do not include personally identifying information beyond what is needed to answer your question.

We do not use your data for advertising, profiling, or to train any AI model. We do not sell or rent your data to third parties.

Third-party services

Workout Agent uses the following sub-processors:

Google Cloud Platform — hosts the application (Cloud Run), stores account data (Firestore), handles authentication (Firebase Auth), and runs the AI model (Vertex AI / Gemini). See Google's Data Processing Addendum.
Hevy — your workout data lives in Hevy. We use the public Hevy API with your own API key. See Hevy's privacy policy.

Where your data is stored

All data is stored in Google Cloud, encrypted at rest, in the region configured for the deployment (by default, an EU region). Your Hevy API key is additionally encrypted at the application level with a separate key that is not stored in the database.

How long we keep your data

We keep your data for as long as your account exists. If you delete your account, all your data (email, encrypted API key, metadata) is permanently deleted within 30 days. Backups are rotated out within the same period.

Your rights (GDPR)

If you are in the European Economic Area, you have the following rights:

Right of access and portability — export all your data via the Export my data button in account settings (or call GET /api/me/export).
Right to rectification — update your Hevy API key at any time in settings.
Right to erasure — delete your account at any time via the Delete my account button in settings. This is permanent and immediate.
Right to withdraw consent — sign out and delete your account at any time.
Right to lodge a complaint — with your local data protection authority.

Cookies and tracking

We do not use tracking cookies or any analytics services. The app uses browser local storage only to keep you signed in between sessions (a standard Firebase Auth requirement).

Age restriction

Workout Agent is not intended for users under 16 years old.

Changes to this policy

If we update this policy in a meaningful way, you will be asked to re-consent the next time you sign in. The last-updated date at the top of this page always reflects the current version.