TopSet Privacy Policy

Effective date: November 12, 2026

TopSet (“the app”) is a training log and program tool for strength training. We take your privacy seriously. This policy explains what information we collect, how we use and protect it, and your rights.

Information we collect

When you use the app, we collect the following information linked to your account:

• Account information: your email address; if you use Sign in with Apple, the email address Apple provides (which may be a private relay address).
• Profile: nickname or name (optional), gender (optional), height and body weight.
• Training data: workout records (sets, reps and weight), estimated maximum strength (e1RM), personal records (PRs), and the training plans and notes you create or use.
• Preferences: your weight unit (kg or lb) and your device’s time zone (e.g. Asia/Shanghai), used to record and count your workouts by your local date.
• Profile photo: a profile picture you choose to upload (optional).
• Identifiers: your account’s unique identifier, including the user identifier from Sign in with Apple.
• AI assistant connections (only if you connect one): see Connecting an AI assistant below.

We do not collect your location, contacts, browsing or search history, or financial information, and we do not use third parties for advertising or cross-app tracking.

How we use information

We use this information only to provide the app’s features: creating and managing your account, saving and showing your training records and plans, and running strength calculations and statistics. We do not use your data for advertising or sell it to third parties.

Data storage and third parties

• Your data is stored with Supabase, the backend service we use, which hosts it on our behalf as an infrastructure provider. Data is encrypted in transit.
• When you use Sign in with Apple, Apple handles the sign-in; we receive only the information needed to create your account.
• If you connect an AI assistant, its requests reach us through Vercel, which hosts our connection address (connect.topset.top) as an infrastructure provider.
• Our hosting providers keep standard request logs, which include IP addresses, for a short time for security and operations.
• We do not include any advertising, analytics or third-party tracking SDKs.

Connecting an AI assistant (Claude or ChatGPT)

You can choose to connect TopSet to an AI assistant you use: currently Claude (by Anthropic) or ChatGPT (by OpenAI). Nothing is shared unless you connect one yourself. The feature is currently available by invitation only.

• You approve each connection, in the TopSet app or by signing in on our connection page. The approval screen shows which assistant is asking and what it will be able to do. The assistant never receives your password.
• What a connected assistant can read: your name, weight unit and time zone; the lifts you track and their e1RM; your workouts (exercises, sets, weight, reps, RPE and notes) and exercise history; and your plans. It cannot see your email address, height, body weight, gender or profile photo.
• What it can write: plan drafts only. A draft appears in Profile › AI assistants and becomes a plan only if you save it. An assistant cannot log sets, change or delete your plans or workouts, or change your account.
• Where the data goes: what an assistant reads is sent, at your request, to that assistant’s provider (Anthropic or OpenAI) and is handled under their privacy policy. We don’t control how they use it. We don’t receive your conversations with the assistant, only the requests it makes to TopSet.
• What we keep: a record of each connection (which assistant, what it may do, and when it was connected, last used and disconnected); access tokens, stored as one-way hashes (while a token is being renewed, an encrypted copy is kept for up to 30 minutes); daily usage counts (number of requests and amount of data, kept for 90 days); and plan drafts (unsaved drafts are removed after 14 days, and saved or discarded drafts keep no plan content). To prevent abuse, we keep a one-way hash of the IP address making a connection request for up to one day. Our own logs of these requests record only the kind of request, its result and how long it took, not your training data.
• Disconnecting: go to Profile › AI assistants, choose the assistant, and tap Disconnect. Its access stops immediately. Deleting your account also deletes all of its connections, drafts and usage records.
• Coach access: if you train with a coach in TopSet, you can let your coach’s AI assistant see your training (Profile › AI assistants › Your coach). This is off by default, and turning it off takes effect immediately.

Our website

This section covers our website, topset.top. The rest of this policy covers the app.

• Visit statistics: we use Cloudflare Web Analytics to count page views and see which sites send visitors to us. It sets no cookies and does not track you across sites. Cloudflare also hosts the website.
• Forms: if you request an invite to the AI assistant beta, we collect the email address you enter, which assistant you use, the language of the page and where you came from (for example, a link on Reddit). If you join the Android list, we collect your email address, the language of the page and where you came from. Both are stored with Supabase.
• How we use it: an invite request is used only to handle your request and to email you when your account is enabled. The Android list is used only to email you about TopSet for Android: an invite to test it early, and its release. We don’t use either for anything else, and we don’t sell or share them with third parties for their own use.
• How long we keep it: we keep invite requests until the beta ends, and the Android list until we have sent the release email. We delete each once that point is reached.
• Removing your details: email us at andyrenrj@taigang.club at any time to withdraw your request or leave the list, and we will delete your submission.

Data retention and deletion

• We keep your data until you delete your account.
• You can delete your account in the app. When you do, the profile and training data linked to that account are deleted.

Data security

We protect your data with measures such as row-level security (RLS) and encrypted connections, so that you can only access your own data.

Children’s privacy

The app is not intended for children under 13, and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy. We will point out significant changes in the app or on this page. By continuing to use the app, you accept the updated policy.

Contact us

If you have any questions about this privacy policy, contact andyrenrj@taigang.club.