LiftLog — Privacy policy
Kerberos Development
Effective date: 2026-10-29
LiftLog is a workout journal provided by Kerberos Development. This policy describes version 5.5.0: a local journal, portable JSON exports, and optional accounts and shared spaces when the Supabase service is configured. The preview build without backend configuration cannot sign in to shared spaces.
Data you enter
The local journal stores profile names, training days, exercise names and equipment/brand metadata, personal assignments, per-athlete training plans and workout prescriptions, fixed notes, dated weights and repetitions or reps-only results, result notes, body-weight and body-circumference measurements (including separate left/right points) with manual dates, optional times and notes, comparison preferences, archives and favorites. Names can be nicknames. Language, appearance and backup status are also stored. Charts and weekly body-weight statistics are calculated from your entries. No account is required for local use. Exercises can also store an optional YouTube video link shared across their uses. Links are included in full backups and in shared catalogs when configured.
Optional YouTube links
Videos must be hosted on YouTube. Link structure is checked on the device. When saving a new or changed link, LiftLog requests public metadata from YouTube to check availability. Opening a linked exercise requests its title and thumbnail from YouTube/Google; the provider receives the video URL and standard network information such as your IP address. Metadata is cached temporarily in app memory, is not added to backups and contains no journal records. Offline checks can be explicitly skipped after a warning. Playback opens in YouTube or an external browser only when you tap the viewing action. Google/YouTube privacy and availability rules apply. LiftLog requires no YouTube account or API key and does not upload workout data to YouTube.
Optional accounts and shared spaces
On first use you can choose Google sign-in or continue without an account. Opening Account and spaces or the space menu initializes the configured Supabase account service. Opening the menu fetches your account’s spaces without launching provider login. If you explicitly select a shared journal, later launches silently restore its session and contact the service to open it; no provider login is started automatically. Your entry choice, selected account/space and local recovery protection are stored on this device. You can sign in with Google or Apple, and explicitly link a second provider while signed in. The provider and Supabase process account identifiers and email, including an Apple relay address when applicable. LiftLog keeps a stable internal account ID, memberships, roles, athlete access scopes and optional profile links. Passwords for Google/Apple are handled by those providers, not entered into LiftLog. Signing in alone never uploads the local journal.
Sharing and recipients
A shared space stores its journal on the configured Supabase service operated for Kerberos Development. The developer/operator can administer that backend; this is not end-to-end encrypted storage. Creating an empty space uploads its name and first athlete profile. Copying the complete local journal into a new space requires a separate confirmation and uploads every local profile, note, measurement and history. After success the shared space becomes the default journal and the original is retained locally as a read-only recovery copy. You can explicitly make it independently editable again; it does not synchronize with the shared space. Owners grant other accounts access to selected athletes or all current and future athletes. Access to an athlete includes their notes, logs, body weight and circumference measurements. Observers can read; athletes edit their linked profile; managers edit their authorized athletes. Owners and unrestricted managers also manage shared metadata. Owners can see member emails and permissions. Shared access is checked by the server. Other members may export information they are authorized to read.
Shared editing and storage
Shared editing requires internet. Data is held in memory while its screen is open and refreshes while active. Shared journals are not automatically written into the local journal or private recovery file. Before a shared edit is sent, a device-private pending record stores the visible base and proposed data, account and space identifiers and operation identifier. It is not end-to-end encrypted. A change is confirmed only after the server accepts it. An unconfirmed draft remains on the device after closing the app until confirmed or explicitly discarded; you can export it. Android system backup and device transfer exclude this pending record; uninstalling the app removes it. Reopening requires the same account and current access to the space. Concurrent changes to different records are combined; conflicting edits to the same record are rejected. Server operation IDs and audit metadata record who changed an item. Network providers and hosting infrastructure may process technical connection information under their service policies. No advertising, analytics or remote crash-reporting SDK is added.
Session security
Supabase account session credentials and PKCE login verifiers are stored using platform secure storage. Android account storage is excluded from app system backup/transfer. iOS Keychain items may survive reinstall; signing out removes the account session from this device. Account credentials are never included in journal JSON/CSV or local recovery. Local athlete profiles are not authenticated accounts: anyone who can use the app on an unlocked device can access its local profiles. Protect your device with a screen lock. JSON exports are plain text, not additionally encrypted by LiftLog.
Invitations
Owners create single-use invitation codes valid for seven days and bound to the invited verified account email. The backend stores a hash of the code, its email, role, scopes and expiry. LiftLog displays the code for you to copy and send yourself; it does not send invitation emails or access your contacts. Pending invitations can be revoked. An already accepted membership must be removed separately.
Local recovery, exports and operating-system backup
Automatic local recovery copies stay in private app storage and are removed with app data. Old Downloads copies remain until you remove them. An accessible legacy copy is read only when initializing an empty local database. Manual JSON contains the complete current journal, including body weight, circumferences, plans, prescriptions and favorites. CSV contains exercise results for the selected profile, not body measurements, circumferences or prescriptions. Shared exports contain only the space data visible to your account and exclude memberships/invites. You choose where exports are saved; a selected storage provider may upload them. Android can back up local app data according to its settings. Shared account credentials are excluded from that backup.
Retention and deletion
Local data persists until deleted, replaced by a confirmed restore, or removed with app data. Delete local data removes the local journal, private recovery and obsolete private backup files; it does not delete exports, OS backups or shared spaces. Owners can permanently delete shared spaces, including their memberships, invitations, operations and audit metadata. Members can leave or be removed; this does not erase journal records they contributed. Delete LiftLog account removes the account and memberships after owned spaces are transferred or deleted. Journal contributions in others’ spaces remain; audit actor references are cleared while historical target metadata may remain until space deletion. This does not delete a Google/Apple account or your local journal. Ask the space owner to remove shared athlete data. Backend infrastructure backup retention is governed by the selected hosting plan and must be documented by the operator before production; deleting live data is not a promise of immediate deletion of provider recovery backups.
Permissions, providers and support
Internet is used for optional account/sharing services. OAuth opens an external browser and returns through a restricted application callback. There is no broad storage, location, contacts, camera, microphone, health-sensor or advertising permission. Supabase privacy: https://supabase.com/privacy; Apple privacy: https://www.apple.com/legal/privacy/; Google privacy: https://policies.google.com/privacy. Developer: Kerberos Development; contact: vexem@outlook.it. Support messages are used to answer your request; do not attach backups unless you want their contents reviewed. Contact us for account/backend data requests; local data can be deleted on your device. We do not sell workout data.
Fitness scope and changes
LiftLog records information you enter. It is not a medical device and does not diagnose or treat conditions. It does not provide medical advice. We update this policy when these data practices change. Production hosting region, retention and account-deletion information must be completed before publishing a configured sharing release.