Privacy Policy

Last updated 16 October 2026.

The short version

  • TDeWorks AB in Sweden runs Swole.fit and is responsible for your personal data.
  • We collect what we need to run the app: your email, the name or gym handle you choose, your training and your food log. Health data only if you agree.
  • We don't sell your data, show ads or work with data brokers.
  • The AI coach and most AI features run on Claude by Anthropic in the USA. Food photos go to Google's Gemini. The AI only sees your body data and pain ratings if you switch that on.
  • Train in Public is off until you switch it on. What you post there is seen by the people you pick, and public posts by anyone.
  • Analytics only run if you click Accept in the cookie banner.
  • You can get a copy of your data, delete your account in the app and withdraw consent at any time.

1. Who is responsible for your data

Swole.fit is run by TDeWorks AB in Sweden ("we", "us"). We decide why and how your personal data is used, which makes us the controller under the EU General Data Protection Regulation (GDPR).

Company
TDeWorks AB
Org. number
559551-8514
Address
Orrakullaliden 9, 438 94 Härryda, Sweden
Contact
Contact form

You can also reach us through our contact form.

2. What we collect and why

We only collect what we need to run Swole.fit. To use it you need to give us an email address and a name or gym handle; without them we can't create your account. Everything else you add is up to you.

Your account

What: Your email address, the name or gym handle you choose, when you accepted the terms and this policy, your experience level and your settings, such as units, time zone and weigh-in day.

Why: To create your account, log you in and keep you logged in.

Legal basis: Contract (Art. 6(1)(b) GDPR).

You log in with a 6-digit code we email you. There are no passwords and no third-party login provider. Codes are stored hashed, work for 10 minutes and allow 5 attempts, and we send at most 5 codes an hour.

Each login session also stores your IP address and browser user agent. We use them, and the limits on login codes, to keep accounts secure and stop abuse. The legal basis for that is our legitimate interest in security (Art. 6(1)(f) GDPR).

Your training

What: Your cycles, workouts, exercises, sets, weights, reps, reps in reserve, notes and check-in ratings (recovery, soreness, pump and workload), and your cardio sessions: activity, time, duration, distance, effort and calories.

Why: To log your training, plan your next sessions and show your progress.

Legal basis: Contract (Art. 6(1)(b) GDPR).

Body data, the heart rate you add to cardio sessions and joint pain ratings are health data and have their own rules: see Health data.

Your food log

What: The foods you log, how much you ate (amount, unit and grams) with its calories, protein, carbs, fat and fiber, which meal it was and when you ate it. Also the foods you create yourself: name, brand, serving size and nutrition values.

Why: To log what you eat, add up your day and week, and show it next to your training.

Legal basis: Contract (Art. 6(1)(b) GDPR).

Foods you create stay private to you. Nobody else can see them or find them in search. Your food preferences (country, food languages, allergies and foods you won't eat) and your saved meals and meal plans are stored with your account too.

Train in Public

What: If you switch it on: your handle, avatar, bio, the posts, photos, videos, comments and reactions you share, who you follow and block, and reports you send. The date you confirmed you're 18 or older.

Why: To run Train in Public, the social side of the app.

Legal basis: Contract (Art. 6(1)(b) GDPR).

Who sees what is explained under Train in Public.

Messages to us

What: The name, email address, subject and message you send through the contact form.

Why: To answer you. Resend delivers contact-form messages to our inbox, which Google hosts (Gmail), and sends you a copy.

Legal basis: Our legitimate interest in answering your message (Art. 6(1)(f) GDPR).

Feedback in the app

What: The type, title and messages you send under Feedback in the app, our answers, and the browser user agent of the device you sent it from.

Why: To answer you, chase down bugs and make the app better. Resend emails your feedback and your email address to our inbox (Gmail) and emails you when we answer.

Legal basis: Our legitimate interest in answering you and improving the service (Art. 6(1)(f) GDPR).

Logs and usage records

What: Server logs with your user ID and, when there's a problem with your login, sometimes your email address. Records of your AI use: token counts and cost.

Why: Logs help us run the service, fix errors and keep it secure. AI usage records let us apply the fair-use limits.

Legal basis: Our legitimate interest in a secure, working service with fair AI use (Art. 6(1)(f) GDPR).

Analytics

What: How the app is used (page views and events) and how fast pages load, measured with Vercel Web Analytics and Speed Insights. Events contain no names or email addresses.

Why: To see what works and what to improve.

Legal basis: Your consent (Art. 6(1)(a) GDPR). Analytics only run after you click Accept in the cookie banner. See Cookies and browser storage.

3. Health data

Some of what you can log in Swole.fit is health data, a special category of personal data under Article 9 of the GDPR. It covers:

  • your bodyweight, body composition (body fat, muscle, water, bone and visceral fat) and tape measurements
  • your height, birth year and sex (sex is only used in the calorie formula)
  • your goal, pace and calorie and macro targets
  • the heart rate you add to cardio sessions
  • the joint pain ratings in workout check-ins

Why: to calculate your calorie and macro targets, show your progress and adjust your training.

Legal basis: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). We ask for it with an "I agree" checkbox or button before we store your body data, heart rate or pain ratings.

It's optional. Your training works without it. Without your consent, we skip the pain question in check-ins and don't store heart rate. If you say no when a check-in asks, we also remove pain ratings and heart rates you logged before.

Notes are free text. They're stored with your training and the AI features read them (see AI features), so only write health details in a note if you're fine with that.

Withdraw any time in Settings, under Health data. We then delete your body data, heart rates and pain ratings. Withdrawing doesn't affect what we did with your data before. You can also delete just your body data in Settings.

The AI coach only sees your body data and pain ratings if you also switch on "Coach can see health data". That's a second, separate consent. It's off by default, and you can switch it off any time in Settings or on the Stats page. The same switch decides whether the AI sees your calorie and macro targets, with one exception: when you ask for a meal plan, we send your targets so the plan can hit them (see AI features).

We never sell your health data or use it for ads.

4. AI features

Swole.fit has AI features you choose to use. To answer you, they send some of your data to AI providers. None of them gets your email address. This is what goes where.

Who runs the AI

Most features run on Claude, AI models made by Anthropic PBC (USA), through Anthropic's API. Under Anthropic's standard commercial terms, Anthropic doesn't use this data to train its models and keeps it for up to 30 days.

Two features go through Vercel AI Gateway, which we set to zero data retention: food photos (Google's Gemini) and the small decisions the coach makes (TypeSafe AI's Jev model).

AI coach chat and workout debriefs

Answered by Anthropic's Claude. We send your name, your program (your cycle, upcoming and recent workouts, sets, weights, notes and check-in ratings), your cardio (activity, time, duration, distance and calories, never heart rate), your food log (foods, amounts, meals, times, calories and macros), the food allergies and foods you won't eat that you set, what the coach remembers about you and the chat, including anything you type. Your body data, calorie and macro targets and pain ratings are only included if "Coach can see health data" is on.

After a workout, the coach can open a debrief chat about it with the same information. When you ask, the coach looks up your cycle history and food log, and can change your plan or log things for you. We keep your coach chats in Swole.fit until you delete your account.

Coach memory

The coach saves short facts you tell it in chat (goals, schedule, equipment, how you eat, how you like to be coached) so it knows them next time. Anthropic's Claude Haiku checks each new fact against what the coach already knows and writes it down. Injuries and other health facts are only saved if "Coach can see health data" is on. You can see, edit and delete every memory under Settings, What your coach knows, or switch memory off there.

Timeline recaps

Short recaps on your timeline are written by Anthropic's Claude Haiku. We send your workout numbers, records and up to five exercise notes. Pain ratings are only included if "Coach can see health data" is on. Never your name.

Coach lines

When you log a set, food or cardio, the coach sometimes pops up with a short line. Some of these lines are written by Anthropic's Claude Haiku. We send what just happened: the exercise and how the set compares to your plan and your best, the food's name, calories and protein, or the cardio activity and minutes. How your day compares to your calorie and protein targets is only included if "Coach can see health data" is on. Never your name. You can turn the coach's lines down or off in Settings.

Meal names

When you save foods as a meal, Anthropic's Claude Haiku can suggest a name. We send the names of the foods and the meal's label. Nothing else.

Meal plans and swap ideas

When you ask for a meal plan, Anthropic's Claude writes it. We send your calorie and macro targets (a plan can't hit them otherwise), your plan settings, the food allergies you set, the plan you're building on, anything you type as instructions, and foods from our food catalog to pick from. For swap ideas, we send the meal you want to replace (its name, foods, calories and protein) and anything you type. Never your body data, pain ratings or name.

Meals in your plan made only from foods in our food catalog may be saved, without your name, as suggestions for other people's meal plans in your country. Foods you created yourself are never shared.

Food photos

When you log food from a photo, the photo goes to Google's Gemini model to recognize the food and estimate how much is there. It goes through Vercel AI Gateway with zero data retention. We shrink the photo on your device first, which normally removes its location and camera details. We also send the note you add and the language of your food tables. We don't store the photo.

Coach decisions

TypeSafe AI's Jev model makes small decisions for the coach: when to show a tip or a line, which follow-ups to offer after a workout, which chat starters and progress views fit, which meal swaps fit and which supermarket aisle a food belongs in. It runs through Vercel AI Gateway with zero data retention. We send summarized set comparisons, the status of your week, exercise notes, the food or meal in question and the question being decided. How your day compares to your calorie and protein targets only if "Coach can see health data" is on. Never body data, pain ratings or your name.

Cycle builder chat

Also answered by Anthropic's Claude. We send your name, your experience level, the exercise list and the chat. It may ask about injuries, and whatever you answer is part of the chat. We don't store this chat.

Legal basis: contract (Art. 6(1)(b) GDPR), because these are features you choose to use. Your body data and pain ratings only go to the AI with your separate explicit consent (Art. 9(2)(a) GDPR).

Fair use. AI features count towards a monthly AI allowance. Some, such as food photos and swap ideas, are part of Beast Mode.

AI can be wrong. Answers are generated automatically, so check anything important and don't treat them as medical advice. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR).

5. Train in Public

Train in Public is the social side of Swole.fit. It's off until you switch it on, and it's only for adults: you confirm you're 18 or older with your birth date, which we check and don't store.

  • Your profile shows your name or handle, avatar, bio and follower counts to anyone with the link, including people who aren't logged in. Your badges and training stats (total workouts, when you started and how many posts) only show if you switch them on.
  • Your posts can share a workout (exercises, sets, weights, reps, records, volume, duration and muscles), a week, an achievement, a note or photos and videos, with an optional caption. Posts never include your body data, heart rate, pain ratings or food log.
  • You pick the audience for each post. Public posts and their comments can be seen by anyone, including people who aren't logged in, and show up in Discover. Followers-only posts are seen by your followers. Anyone using Train in Public can follow you without asking; you can block people.
  • Comments and reactions you leave are seen by everyone who can see the post. Reports you send come to us.
  • Photos and videos are stored privately with Vercel Blob and shown through links that expire within an hour. Before upload, your device removes location and camera details from them.
  • Profile and post pages tell search engines not to index them. A link you share yourself can show a preview of a public post.

Delete a post and we delete its photos and videos too. You can switch Train in Public off any time.

6. Who we share data with

We use these providers to run Swole.fit. They process data on our behalf:

  • Vercel Inc. (USA): hosting, storage for Train in Public photos and videos (Vercel Blob), analytics (only with your consent) and the AI Gateway.
  • Neon Inc. (USA): database hosting.
  • Resend (USA): email, such as login codes and contact-form messages.
  • Anthropic PBC (USA): the AI coach, debriefs, coach memory, timeline recaps, coach lines, meal names, meal plans, swap ideas and the cycle builder.
  • Google (USA): Gemini for food photos, reached through Vercel AI Gateway, and Gmail for the inbox that receives contact-form messages and feedback.
  • TypeSafe AI: the Jev model that makes the coach's small decisions, reached through Vercel AI Gateway.

Other people only see what you share in Train in Public. We don't sell your data, show ads or work with data brokers.

On browsers without a built-in barcode reader, such as Safari and Firefox, the barcode scanner downloads its reader from the jsDelivr network, which sees your IP address like any website does. The barcode itself is read on your device.

Transfers outside the EU

Most of these providers are US companies, so your data may be processed in the USA. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses. Ask us through the contact form if you want details or a copy of the safeguards.

7. How long we keep data

  • Your account and its data: until you delete your account. You can do that any time in the app under More, Delete account. Deletion is immediate and removes your data from our database, and your Train in Public photos and videos from our storage.
  • Login sessions: 30 days, renewed each day you use the app.
  • Login codes: 10 minutes.
  • Body data: until you delete it, withdraw your health data consent or delete your account.
  • Pain ratings and heart rates: until you withdraw your health data consent, say no when a check-in asks for it, or delete your account.
  • Coach chats and AI usage records: until you delete your account.
  • Coach memories: until you delete them, they expire (temporary facts like a trip), or you delete your account.
  • Meal plans: until you delete them or your account. Meals saved as suggestions for others (see AI features) carry no name and stay after that.
  • Food photos: not stored. They're gone once the food is recognized.
  • Train in Public posts, comments, reactions, photos and videos: until you delete them or your account.
  • Messages to us: as long as we need them to handle your request.
  • Feedback in the app: until you delete your account.
  • Server logs: a limited period, set by our hosting provider.

Copies in our providers' backups and logs are deleted on their own schedules.

8. Cookies and browser storage

Everything here is first-party: set by Swole.fit itself. We don't use advertising cookies or third-party tracking cookies.

Necessary cookies

These keep the app working, so they don't need your consent.

  • better-auth.session_token30 days

    Keeps you logged in.

  • better-auth.session_data5 minutes

    A short-lived copy of your login session, so the app doesn't have to look it up on every request.

  • swole-coach-signalUntil midnight

    Remembers today's coach tip.

  • swole-coach-dismissed90 days

    Remembers the coach tips you dismissed.

  • swolefit-analytics1 year

    Remembers that you accepted analytics. Only set after you click Accept.

  • NEXT_LOCALE1 year

    Remembers your language.

On HTTPS, the names of the two login cookies start with __Secure-.

Browser storage

We keep your cookie choice (for 1 year) and app preferences, such as theme, workout view, timers and timeline and body prompts, in your browser's local storage, under keys that start with swolefit:, plus your theme under theme.

While a tab is open, its session storage can hold a comment you started before joining Train in Public and whether we already matched the app's language to yours. It's cleared when you close the tab.

A service worker keeps a copy of app pages on your device for up to 30 days so the app works offline. That copy is cleared when you log out.

Analytics (optional)

Vercel Web Analytics and Speed Insights only run after you click Accept in the cookie banner. Events contain no names or email addresses. Legal basis: your consent (Art. 6(1)(a) GDPR).

Change your choice any time: . You'll also find Cookie settings in the footer of our homepage and in the app under More.

You can also block or delete cookies in your browser settings, but without the necessary cookies you can't log in.

9. Your rights

Under the GDPR you have the right to:

  • Access your data and get a copy of it.
  • Correct data that's wrong. You can edit most of it yourself in the app.
  • Delete your data. Delete your account any time under More, Delete account, or ask us to delete specific data.
  • Restrict how we use your data, for example while we check whether it's correct.
  • Take your data with you (data portability). You can export your workouts, cardio and food log as a spreadsheet under More: the last 7 days on the free plan, everything with Beast Mode. For a full copy of all your data, on any plan, send us a message.
  • Object to processing based on our legitimate interests.
  • Withdraw consent at any time, without affecting processing before that: health data in Settings, under Health data; the coach's access with the "Coach can see health data" switch; analytics with Cookie settings.
  • Complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority where you live or work.

To use your rights, send us a message through the contact form or Feedback in the app. It's free, and we answer within one month.

10. Children

Swole.fit isn't for children under 13. If you're 13 to 17, you need a parent's or guardian's permission to use it (see our Terms of Service), and you only get maintenance calorie targets: no cut or bulk.

Train in Public is only for adults (18 or older). If we learn that a child under 13 has signed up, we delete the account.

11. Changes to this policy

When we change this policy, we update the date at the top. If a change significantly affects how we use your data, we'll tell you in the app or by email before it applies, and ask for your consent again where that's needed.

12. Contact us

Questions about this policy or your data? Use our contact form, or Feedback in the app when you're logged in.

Read Terms of Service