What Spotter keeps, and where.

Who operates Spotter

Spotter is operated by Marcus Leong, an individual in the United States, during the private beta. Privacy questions, and every request in this statement, go to [email protected], from the address on your account.

What is stored, and why

• Your training— because it is the product. Programs, blocks, weeks and days you or your coach write; sessions, with every set you log (weight, reps, RPE, when). Estimated one-rep maxes, records and streaks are worked out from those sets each time a page asks, not stored. Weights are stored in kilograms whatever unit you type in.
• Your account— to sign you in and address you. The email address your sign-in uses, your first and last name when the sign-in provides them, your unit preference, and whether you have switched on “I coach people”.
• Coaching— so the right people, and only they, can see your training. Which coaches you have accepted, which athletes you coach, and any note a coach leaves on a day of your program. An invitation keeps the address it was sent to, which may belong to someone not yet on Spotter, until it is accepted; a declined one keeps it so the invitation is not repeated. A coach's note is free text. It is not a medical record and Spotter does not treat it as one, so do not put anything in a note that should not be stored.
• Operations— to run and fix the service. A request log with the method, the path, the status, how long it took, a request id, your user id and your network address; and an error report when something breaks, saying what failed, where, the request id and your user id. Never a header, never the contents of a request, never your sets: the log writes nine named fields and nothing else, and error reports are sent with request data stripped.

Where it lives, and where it goes

Spotter's database, its servers, the nightly copy of the database and its point-in-time recovery archive all run on Railway in its Amsterdam region (EU West). Some information is also processed outside the EU: Clerk and Sentry, below, are United States services; Cloudflare runs worldwide; and the operator reads the database from the United States when running Spotter.

Who processes it

• Clerkauthenticates your account: it holds your email address, your password or passkey, and your sign-in sessions, and sends the invitation and waitlist emails on Spotter's behalf. Spotter never receives your password.
• Railway hosts the app, the API, the database, its backups and the service logs.
• Sentryreceives error reports — what failed and where, with a request id and your user id, never your training data.
• Cloudflare provides the network edge and security layer in front of the app and the API, and processes the network and request information needed to deliver and protect the service, including your network address.

Nobody else. Spotter sells nothing to anyone, shows no advertising, and does not share your training with other athletes, with coaches you have not accepted, or with anyone outside this list.

AI, said now rather than later.Spotter may introduce AI-powered features. They would process your training data to give you analysis, insight or recommendations you ask for — your last twelve weeks, read for you. Spotter may also use training data to develop, improve or train machine-learning systems, including ones used to run Spotter. Before either happens, this statement will describe the use, and you will get whatever choice or permission the law where you live requires. Your data is not used for purposes unrelated to operating, improving or developing Spotter without telling you.

Who can see your training

You, always. A coach you have accepted can read your programs and your training, write into your future weeks, and leave notes, for as long as the relationship lasts. A coach reaches an athlete only through a relationship the athlete accepted in Spotter, and the server checks that on every request. Nobody — no coach, not the operator through the app — logs, starts, finishes or corrects a session for you. End the relationship from your You tab and the coach's access ends at once; everything in your account stays yours.

How long it is kept

• Your training, account and coaching records: for as long as your account exists.
• Request logs: seven days at the host, then gone.
• Error reports: up to ninety days at Sentry.
• Backups: each nightly copy is kept for thirty days; the point-in-time archive covers a rolling window. Restoring from either has been tested.

Your rights, and how to use them

Whatever the law where you live calls them, these are yours here: to see what Spotter holds about your account, to get a copy of it, to correct it, to have it deleted, and to complain. During the beta, email [email protected]from your account's address and ask; each is done by hand within a few days and confirmed by reply. Self-serve export and deletion arrive after the beta.

• A copy is your account data as files: your profile, programs, sessions, sets and coaching relationships. It does not include the operational logs above.
• Deletionremoves your account and everything in it from the live database and from Clerk, and ends your coaching relationships. Copies remain in backups until those expire — at most thirty days for the nightly copy, and the point-in-time window. A program a coach assigned you is a copy in your account; deleting your account deletes your copy, not the coach's original.
• A complaint goes to the same address first. If you are in the EU or the UK you may also complain to your data-protection authority.

When this changes

The date at the top moves when this statement has changed. A change that matters — a new processor, a new use of your data, a shorter promise — is emailed to your account's address before it takes effect.

A beta is a beta

Spotter is new and run by one person. Things will break; the operator reads every report. Your data is backed up nightly and is never deleted for non-payment, because nobody pays yet.