Privacy policy
Effective October 28, 2026
The short version: we store your training data so the app can sync it between your devices. We don't show ads, we don't sell your data, and we don't run any AI. If you connect your own AI assistant, it reads your data only when you ask it something. You can export everything or delete your account at any time.
1. Who we are
MCP Workout Tracker (the iPhone app, Android app, web app, our MCP server and this website) is run by BAMBAM LLC, a limited liability company registered in the State of Wyoming, USA. We are the "controller" of your personal data: we decide how it is used.
Contact: admin@bambamhq.com.
2. What we collect
Your account
- Your email address, and how you sign in (an email link, Sign in with Apple, or Google). If you use Apple's "Hide My Email", we only see the private relay address Apple gives us.
Your settings and coaching profile
- Settings: units (metric or imperial), theme, first day of the week, default rest time, whether the effort column is shown.
- Coaching profile (all optional): goals, experience level, training days per week, session length, available equipment, injuries and limitations, body weight, height, birth year and sex.
Your training
- Plans: programs, routines, target sets, your training calendar, and coach notes.
- Workouts you log: start and end times, exercises, sets, weights, reps, durations, distances, effort ratings, how the session felt (1 to 5), your notes, and body weight that day.
- Body measurements: body weight, body fat percentage, and measurements such as waist or chest.
- Custom exercises you create.
- Notes to your coach, for example "left knee sore".
- Imported history: if you import a Hevy or Strong file, we save the workouts in it. We don't keep the file itself.
Your AI assistant connections and activity log
- Which assistants you've connected (their name, and when you connected them).
- A change log of edits to your plans and profile: what changed (before and after), when, whether you or an assistant made it, and the assistant's one-line summary and reason. This powers the Coach activity feed and the Undo button.
Health app data (only if you turn it on)
See section 5.
Technical data
- When your device talks to our servers, our hosting providers record standard technical logs: IP address, device or browser type, time, and errors. We use these only to keep the service running and secure.
Kept only on your device
- A copy of your training data, so the app works offline. It's removed when you sign out.
- Your workout reminder days and time, whether health sync is on, and a record of your last import.
What we don't collect
We don't collect your location, contacts, photos, or payment details. The app has no advertising, no advertising identifiers, and no analytics or tracking tools.
3. How we use it
| What we do | Data used | Legal basis (UK and EU) |
|---|---|---|
| Run your account and sync your data between your devices | Account, settings, training | Needed to provide the service you asked for (contract) |
| Fitness and body data that may count as health data: coaching profile (injuries, body weight, height, sex), workouts, body measurements, health app data | As listed | Your explicit consent, which you give by entering the data or turning on health sync. You can withdraw it at any time by deleting the data, turning health sync off, or deleting your account. |
| Let your connected AI assistant read and change your plan when you ask it to | Everything listed in section 4 | Your explicit consent, given when you tap Allow. Withdraw it by disconnecting the assistant. |
| Show the activity log and let you undo changes | Change log | Contract |
| Keep the service secure and fix problems | Technical logs | Our legitimate interest in running a safe, working service |
| Answer your support or privacy requests | Your email and what you tell us | Contract, or legal obligation for privacy requests |
We don't use your data for advertising, we don't build marketing profiles, and we don't sell or rent it to anyone.
Because your health-related data is used only to give you the service, we don't use it to train AI models, and we don't make automated decisions about you that have legal or similar effects.
4. Your AI assistant
MCP Workout Tracker runs no AI of its own. If you choose to connect an assistant (for example ChatGPT by OpenAI or Claude by Anthropic), here's what happens:
- You approve it first. The assistant sends you to our approval page. Nothing is shared until you sign in and tap Allow.
- What it can do: read your profile, workouts, routines, schedule, body measurements, personal records and notes to your coach; create and change routines, programs and your schedule; and log workouts and body weight you tell it about.
- What it can't do: it can't delete anything for good, and it can't delete your account. Every change it makes shows on the Coach tab with an Undo button.
- When it reads your data: only when you're chatting with it and it calls our server to answer you. It only ever sees your own data.
- Disconnecting: on the Coach tab, tap Disconnect. The assistant can't renew its access, and loses access within the hour.
Important: once your assistant has read your data, it's part of your conversation with that assistant. The assistant's provider (for example OpenAI or Anthropic) handles your chats under its own privacy policy and settings, not ours. We don't control what they keep.
The quick buttons on the Coach tab ("Review my week" and others) open ChatGPT or Claude with a message already typed. That message travels in the link you open. Copy my training summary copies a summary of your last four weeks for you to paste wherever you choose.
5. Apple Health and Health Connect
Health sync is optional and off until you turn it on in Settings → Health app. Your phone asks for permission first, and you can turn it off at any time there or in the Health / Health Connect app.
- What we read: cardio workouts (running, walking, hiking, cycling, rowing, swimming and elliptical sessions: type, start and end time, distance, and which app recorded them) and body weight readings. The first time, we look back 30 days; after that, only new entries.
- What we write: workouts you finish in our app (type, start and end time, name, and distance for cardio).
- Where it goes: sessions and weigh-ins we read are saved to your training history, synced to our servers like the rest of your data, and visible to an AI assistant you have connected when it reads your history.
Data from Apple Health or Health Connect is never used for advertising or marketing, never sold, and never shared with anyone except the service providers in section 6 (who store it for us) and an AI assistant you chose to connect. We use it only to show you your training and let your coach see it.
Our use of data received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.
6. Who we share it with
We use these service providers ("processors") to run the service. They may only use your data to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, our MCP server (the service assistants connect to) | United States (US East) |
| PowerSync (JourneyApps) | Syncing data between your devices and the database | United States |
| bunny.net (BunnyWay d.o.o.) | Hosting this website | United States (New York), delivered worldwide |
| Brevo (Sendinblue SAS) | Sending sign-in link emails | European Union (France) |
| Apple | Sign in with Apple, App Store downloads, Apple Health (on your phone) | Apple's own terms |
| Google sign-in, Google Play downloads, Health Connect (on your phone), and the Inter font on this website | Google's own terms |
We also share data:
- with an AI assistant you connect, as described in section 4;
- if the law requires it, for example a valid court order;
- if BAMBAM LLC is sold or merged, with the new owner, who must keep these promises or tell you first.
7. Where your data is stored
Our main database is in the United States. If you live in the UK or the EU, your data is transferred to the US. We protect these transfers with the safeguards in our providers' data processing agreements, including the European Commission's Standard Contractual Clauses and the UK's addendum to them.
8. How long we keep it
- While you have an account, we keep your data so you can use it.
- Items you delete in the app (a workout, routine or note) are hidden straight away and kept so they can be undone. They're erased for good when you delete your account.
- When you delete your account, your account and all your training data are erased from our live database straight away, and your assistants are disconnected.
- Backups may hold a copy for up to 7 days before they're overwritten.
- Technical logs are kept for up to 7 days.
- Support emails are kept as long as needed to help you, and then deleted.
9. Your choices and rights
Things you can do yourself in the app
- Get a copy: Settings → Import and export → Workouts as CSV or Everything as JSON.
- Correct it: edit anything in the app.
- Delete it: Settings → Delete account. This erases your account and all your training data.
- Stop sharing with an assistant: Coach tab → Disconnect.
- Stop health sync: Settings → Health app → switch off.
Can't use the app? Email admin@bambamhq.com from your account's email address, and we'll delete your account for you. See how to delete your account.
Your rights in the UK and EU
Under the UK GDPR and EU GDPR you have the right to: access your data, correct it, delete it, get it in a portable format, restrict or object to how we use it, and withdraw consent at any time (this doesn't affect what we did before you withdrew). To use these rights, email admin@bambamhq.com. We'll answer within one month.
You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country.
10. US state privacy laws
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Washington or Nevada), you may have the right to know what we collect, get a copy, correct it, delete it, and appeal if we turn down your request. We don't sell personal data, we don't share it for cross-context behavioural advertising, and we don't use it for targeted advertising, so there is nothing to opt out of. We use sensitive data (including consumer health data) only to provide the service you asked for.
Consumer health data. Fitness and body data may be "consumer health data" under laws such as Washington's My Health My Data Act. The categories we collect are in section 2, the reasons in section 3, where it comes from (you, your health app, and your connected assistant), and who receives it in section 6. We collect and share it only with your consent and only to provide the service.
To make a request, email admin@bambamhq.com from your account's email address. You can use an authorised agent. We won't treat you differently for using your rights. To appeal a decision, reply to our answer with "Appeal" in the subject line.
11. Children
MCP Workout Tracker is not for anyone under 13. We don't knowingly collect data from children. If you think a child has an account, email admin@bambamhq.com and we'll delete it.
12. Security
- All data travels over encrypted connections (HTTPS).
- Database rules make every row visible only to its owner, through the app and through any assistant.
- An assistant's access only works for our server and only for your account, and you can withdraw it at any time.
No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.
13. Changes to this policy
If we make a significant change, we'll tell you in the app or by email before it takes effect. The date at the top shows the latest version.
14. Contact us
BAMBAM LLC, Wyoming, USA
Email: admin@bambamhq.com