Legal

Privacy

Last updated 18 October 2026

Reckoner is a strength-training coach: a Garmin watch app, a website, and a server that adapts your programme from what you actually lifted. To do that it holds training and health data about you. This page says exactly what is kept, why, for how long, and how to get it back or have it deleted.

The short version

• Your account is an email address. There is no password; we email a 6-digit code.
• We store your training log (what you lift and how it went, how you felt, your notes) and your profile and training setup. Some of that is health data, and it is only there because you enter it.
• Everything we hold about you lives in one database on one server in the EU, with the backups described below. It is not sold and not used for advertising, and it is not shared, apart from the services that run Reckoner for us, listed below, and totals across at least ten people that can never point to one person.
• We email you to run the account: the sign-in code, an address change, a hold, the reply to something you reported. Those cannot be turned off, because sign-in is passwordless. We may also write about getting started if you signed up and have not, and one click in that email stops it for good while your sign-in codes keep working.
• Your display name is shown to others only if you say so. In an event, its members also see how many planned sessions you did. Never your weights. A founding-member number is shown too, if you have one. Your email address appears on no page other than the operator's own console. Never to another athlete, and never on a public page.
• If you report a bug or request a feature, what you write appears on the public board right away, in your own words. Your display name is shown only if you have chosen to make it public, and your email address is never shown. Someone at Reckoner reads every submission, responds with a reason, and may clean up the wording or remove a row from the board.
• If you accept, we use Google Analytics to see which features get used. It sets its own cookies, so it runs only with your consent, carries no advertising, and does not follow you to other sites. It receives no account id, no training data and nothing you type, and that is enforced in the code rather than promised.
• Two cookies are set without asking: the sign-in session, and one holding your answer to the analytics banner. Both are set out in full in the cookie policy.
• We keep a log of the coaching decisions Reckoner makes for you, so it can coach you. While Learn from my training is on, we also keep a de-identified copy of your training records, with you taken out of it, to check and improve the coaching for everyone who trains with Reckoner. That copy carries no name, no email, no account id, nothing you typed and no actual loads. It is never given to anyone outside Reckoner and the services that run it for us, and only totals across at least ten people, which can never point to one person, are ever shared beyond that. Your health answers join it only if you say yes to that separately, and both switches are on the Account page.
• Setup asks everyone the standard health check before exercise. Reckoner coaches your training. It doesn't diagnose or treat injuries. If you tell it an area is sore or injured, it trains around that area, and when you say you are ready to train it again, it brings those lifts back a little lighter. Prehab is strength work for the joints you pick, built into your warm-up.
• Want it gone? Delete the account yourself on the Account page: it erases everything on the spot, and the backups that can still hold it for up to 30 days are never restored from. Or email hello@reckoner.fit and we will do it for you.

Who is responsible

Reckoner is operated by Inner Skill Set, registered in the Netherlands with the Kamer van Koophandel under number 75619563, and it is the data controller for the personal data described here. The controller and the server are both in the European Union, so the GDPR applies to all of it.

Contact for anything on this page: access, correction, export, deletion, or a complaint at hello@reckoner.fit.

The terms of service, which set out the agreement this data is processed under, are at reckoner.fit/terms.

What we collect, and why

Account

Your email address, and the date the account was created. Signing in mails you a 6-digit code; the code is stored only as a hash, expires after 60 minutes, is single-use, dies after 5 wrong attempts, and you can request at most 5 codes an hour. A successful sign-in creates a session token, stored only as a hash, and sets one cookie, rk_session, which is HttpOnly, SameSite=Lax, Secure over HTTPS, and lasts 90 days or until you log out. It exists to keep you signed in. It is not used for tracking or profiling. That cookie, and everything else this site keeps in your browser, is listed key by key in the cookie policy.

Email we send you

Your address is what the account runs on, so some email is not optional and cannot be switched off: the sign-in code, the confirmation when you change your address and the heads-up that goes to the old one, a notice if the account is put on hold and why, and the reply if you report something or send a request. Sign-in is passwordless, so an email you cannot receive is an account you cannot reach, and no setting on this site is allowed to silence it.

We may also write to you about your own account and about getting started. If you open an account and do not finish setting it up, or set it up and have not trained yet, you may get a note about picking it up. That is about your account rather than about anything we sell, and nothing is sold in it. One click stops it, from a link in the email itself: no signing in, no settings page to find, and it takes effect the moment you click rather than at the next send. Your sign-in codes keep working, and so does everything else in the paragraph above.

The rest is yours to set, and the Account page draws it as two switches. Your training covers everything the engine writes to you about your own training: the weekly numbers, a look back at your month on the 1st, the changes to your plan, a new block, and the note if you go quiet for a while. Your training is on when you open an account, the weekly numbers included, because it is mail about your own account and your own training. Switching it off on the Account page stops all of it at once, and the link at the foot of each of those emails stops that email. If your account was already open before this was the rule, nothing was switched on or off for you, and each of those emails stays exactly as you left it. Unless every one of them was already on, Today asks whether you want them, and your answer turns all of them on or all of them off. News, tips and updates covers what changed in the product and anything we send that is not about your own training, such as a note of what is new on Chalk and what moved on the board. That note never carries anything about your training. News is off until you ask for it, on every account, and the only thing that turns it on is you. Nothing about the account itself is on either switch: everything in the first paragraph above reaches you whatever these are set to.

Every recurring message also carries the same one-click link, and your mail app may draw its own Unsubscribe button beside any of them, which does the same thing.

We record when we have asked you about each of these two emails, so that we stop asking. That is three numbers per email against your account: how many times the question has been put in front of you, how many sessions you had logged when it was last asked, and whether you have finished with it. The two are kept apart, so an answer about one is never read as an answer about the other. We ask at most three times about each, and a no ends it for good. Nothing in it is your answer to anything else, and none of it leaves Reckoner.

We also record which month's look back and which edition of the news we have sent you, so that neither is ever sent to you twice. For the look back that is the month, the date, and which article it carried if it carried one, so it never hands you the same piece again; a month we decided not to send one is recorded with the reason, so it is decided once. For the news it is the edition and the date. Both are kept against your account, none of it leaves Reckoner, and it goes when the account does.

We also record which articles we have put in your weekly numbers and in the note we send if you go quiet, so neither hands you a piece you have already been sent. For each article that is which one it was and the date it last went. It is kept against your account, none of it leaves Reckoner, and it goes when the account does.

We also learn whether a mail we sent you was opened, and whether a link inside it was followed, and when. Resend tells us this the same way it tells us a code bounced, and we keep it against your address. Nothing you are sent and nothing you see is decided by it today.

We do not sell your address, rent it, or hand it to anybody to advertise to you, and there is no mailing list you were added to without being told. The address goes to Resend to deliver a message and nowhere else, which is set out under "Where it is stored, and who else touches it".

Your display name, your picture, and what other athletes can see

You can give the account a display name and a picture. Both are optional, both are yours to change or clear at any time on the Account page, and an account with neither works exactly the same: it shows a neutral label and a plain initial. The picture is stored in the database with the account, not uploaded to a file anybody could link to, so deleting the account deletes the picture with it.

Your display name is shown to another athlete only if you say so. If you join an event with friends, the people in it also see how many of your planned sessions you did each week. They never see your weights. We ask once, plainly, and both answers are a decision the account keeps: say no, or never answer, and you appear as the neutral label everywhere. There is no setting that has to be found and turned off, because nothing is published until you turn it on. The name has a policy: up to thirty-two characters, at least one letter or number in it, and the terms Reckoner, Admin, Support and Moderator are refused, so nobody can pass themselves off as us.

Your email address is not a fallback for a missing name. That is worth stating because it is the ordinary way an address leaks: a page reaches for "the athlete's name", finds none, and prints the address. Reckoner resolves every name through one piece of code that cannot return an email address at all, so there is no page that could do it by being written carelessly. The only screen in the whole product that shows an email address is the operator's own admin console.

Inviting somebody

You can send one person an invitation from the Invite someone screen. Reckoner writes the mail, it carries your display name and never your email address, and it goes to the address you typed and nowhere else. There are no reminders: one invitation is sent and nothing follows it.

The address you type is not stored. What is kept is a one-way fingerprint of it, a SHA-256 digest, alongside your account and the day you sent it. A digest cannot be read back into an address and cannot be written to, so there is nothing here that any mail could ever be sent from, and no address book of people who never joined. It is kept for one reason: it is the only thing that can recognize the same address a second time, which is what stops a second invitation ever reaching the same person and what holds the limit of five invitations a day. It is deleted with your account.

An invitation to an address that already has a Reckoner account is not sent. Nothing about that is reported back to you, in either direction, so this screen cannot be used to find out whether somebody is here. Reckoner never reads your contacts or an address book, and there is no way to invite more than one person at a time.

Founding members

The first hundred accounts carry a founding-member number and the date it was granted. It is given automatically, in the order accounts were created, and it is permanent: it does not depend on training, it does not lapse, and it is never reissued to somebody else, including after an account is deleted. It is a fact about when you arrived rather than a status you hold.

The number is public in the same way the display name is: it identifies you as one of the first hundred, and nothing else. It carries no email address, no training data and no date of birth. A founding member who has asked not to show a name is shown as their number alone, which is deliberate: the number is what lets two people who chose the same display name be told apart, so opting out of the name costs you nothing else. The total number of founding members is published as a count. No individual account is named by it.

What you report, and what gets published

You can report a bug or ask for a feature from inside Reckoner. What you send is stored: which of the two it is, what you wrote, and, if the form asked, which screen it was about and which of your watches was involved. It is tied to your account, because the answer comes back to you by email. The screen you were on and the watch you were using are not published. They are only there to help the person answering.

What you write appears on the public board right away, in your own words. We do not turn it into a summary first or wait for someone to approve it. The words you send are published on a page anyone can read.

Someone at Reckoner reads every submission and responds with a decision and a reason. We may clean up the wording so it is easier for everyone to understand. If we change the wording, the board makes that clear. We may also remove a row from the board, which removes it everywhere it appears.

Your name is shown only if you have chosen to make it public. If you have allowed us to show your display name, it appears with your submission. If you have a founding member number, that may appear too.

If you have not chosen to show your name, the submission is credited to your member number instead, or to "An athlete" if you do not have one. Anything submitted before 6 September 2026 is shown without a name.

Your email address is never shown on the board or anywhere else another user can see it. It is only visible to us in the operator console.

You can change your own words, and take your row off the board. You can edit what you wrote while it is still under Reviewing. Once we start building from it, the words stay as you sent them. Taking a row off the board hides the public card and nothing else: we still have the report, we still answer it, and the votes it already had stay with it.

If you are signed in, you can report another lifter's @handle for hate or harassment, or for violence or threats. We keep the handle, the reason you chose, anything you wrote (up to 280 characters), the time, and which account sent it, so we can stop one account sending a flood of reports. The lifter you reported is never told who reported them, and nothing is hidden or removed until a person at Reckoner has read the report. The report is deleted if you delete your account, or if the account it is about is deleted.

We may write a note on your card, and you can answer it. The note is public, it appears under your words, and it goes to you as a notification and an email. Your answer is public too, under the note. Only the person who sent a row can answer the note on it. Nobody else can write on your card, and you cannot write on theirs.

We keep your answers for as long as the account exists, the same as the submission they sit under, and they are deleted with it.

You can also vote for things on the board. Each person gets one vote per row, and pressing the vote button again removes it. Other users cannot see who voted for what.

If you delete your account, we delete the submissions you made through the board and your votes with them. This is different from the old board, where we published our own write-up of a decision and it could remain after an account was deleted. The board now contains what you wrote, so your submissions leave with your account.

Sharing a milestone or a session

When you share a milestone, a PB or a session, Reckoner draws the image on your own device. Your photo appears on a share card only when you turn on Your photo in the share sheet. It is off until you turn it on, it only ever sits beside your display name, and your choice is remembered on your account. Apart from that choice, sharing that way stores nothing about you or the share.

A share can carry a link to Reckoner, and only if you turn it on for that share. It is off every time the share sheet opens. A link makes a page at reckoner.fit/s/ followed by a code, and anyone with the link can open it. For that page we keep the image you shared, a smaller preview of it, its short title and its line, and the day you made it. We never keep your photo, your caption or your display name as text, and we record nothing about who opens the page.

You can remove a link any time under Shared records on your account page, and its page comes down at once. Images you already posted elsewhere stay where you posted them. Deleting your account removes every link and its images.

Every shared page has a Report this page link, which emails hello@reckoner.fit. We look at a reported page within 24 hours and take it down if it should not be there. A page we take down stops answering at once, and your account page shows it as taken down.

We count shares by the day, and how they were made (which kind of image, and which button), never who made them. We also count visits to shared pages, and accounts started from one: if you create your account after opening a shared page, your account notes that as a yes or a no, with nothing about which page it was or who shared it.

Sharing a plan. When you share a plan, Reckoner keeps a copy of its lifts, sets and rep ranges for the link, never your weights, history, records, bodyweight or email. If you choose Share with my name, your display name, or your @handle if you have one, is shown on the plan’s page, and your profile photo, if you have one; without a profile photo, your initials are used there instead. Shared anonymously, it reads A Reckoner lifter and shows neither. A profile photo is never shown to anyone unless you share with your name. Reckoner draws a preview picture for every plan you share, on our own server, and keeps it as the picture a chat app or a social site shows when somebody posts the link. The preview picture shows the plan’s name, goal, level, days and the muscles it trains, and your name or @handle. It shows your profile photo only when you have turned on Show my profile photo on the preview in the share sheet. In that case your profile photo is kept on our server inside the preview picture for as long as the plan is shared, and the picture is drawn again without it, or deleted, as soon as you turn that switch off, change your profile photo, share anonymously, turn the link off or delete the plan or your account. Apps that already showed the link may keep their old preview until they refresh it. We count opens, where they came from, sign ups and how many people took the plan, and record nothing about who. If somebody reports a plan, we keep the reason and the words they wrote, and never who sent it. Turn a link off, or delete your account, and its page comes down at once. Anyone who already accepted your plan keeps their own copy. If you make a plan public, it is also listed on Plans and on a page of your public plans, and search engines may show it. Take it off Plans any time; its link will keep working.

The plan sharing rules, and what we do about a shared plan. The first time you share a plan, you agree to our plan sharing rules. We save which version of the rules you agreed to, and the date. If we change the words on a shared plan, take its page down, delete its link or turn sharing off for your account, we write down what we did and why, and we tell you the reason. We keep that note until you delete your account, and then it is deleted too. When somebody opens a shared plan's link we look at which app they opened it in (Instagram, TikTok or Threads) for the length of that request and count the app's name. We keep no other detail of the visit.

Training together for an event. If you join an event through an invite, the other people in that event see how many of your planned sessions you did this week, and your name only if you chose to show it to that event; otherwise you appear as A Reckoner lifter. They never see your weights, your plan, what you skipped or your email. We count how many people opened and joined each invite, and record nothing about who. Leave the event, or delete your account, and you are gone from it at once.

The early-access waitlist

Registration is now open, so the waitlist is closed. If you asked to join before it opened, we still hold the email address you sent and the date you sent it, with a note of whether you have since been invited. We keep it only as a record of who asked, and use it for nothing else. Ask us and we will remove it. Creating an account does not remove the entry on its own: it stays, marked as invited, alongside your new account. Deleting your account deletes it too.

Paired watches

When you pair a Garmin watch, the watch and the site exchange a short code and the watch receives its own long-lived token (again stored only as a hash). Against it we keep the label the watch sends (for example Garmin epix2), any name you give the device yourself, and the created and last-used timestamps. That is what the Your watches page lists so you can recognize and revoke a watch. Device tokens do not expire on a timer; they stay valid until you revoke them on that page.

The watch app also tells us which Garmin model it was built for and which version of the app is on it, with the time it last said so. It sends those on the requests it already makes, so we can name your watch on the Reckoner on Garmin page and tell you when an update is waiting for it rather than telling everyone the same thing. It also sends the time zone the watch is set to, as a zone name like Europe/Amsterdam, so a training day you have not finished stays open until midnight where you actually are rather than midnight where your account says you live. It is four facts about the watch and none about you, we keep only the most recent answer, and it goes when you revoke that watch. An older version of the app does not send them, and then we say nothing about what is on your wrist.

Notifications on your phone or laptop

You can let Reckoner put a notification on your lock screen, one browser at a time, by answering your browser's own permission prompt, which Reckoner offers on Today and on the Account page. Say no, or never answer, and none of what follows exists.

Saying yes makes your browser mint a subscription with the push service its maker runs, and we store exactly what that subscription is: the address the message is delivered to, the two keys your browser hands us to encrypt it with, the date you said yes and the time we last sent to it. The address is a long random URL that belongs to that one browser. It carries no email address, no name and nothing you have logged, and it is held unhashed because it is where the message goes: it has to be used, not compared. We also note the date of each week you were sent the evening before notice, so you are sent it once. We also note which notifications you asked for, in four groups you can switch on the Account page, whether you turned on the check in reminder there and the date it last went, and which signed in session saved the subscription, so one browser keeps one subscription and signing out drops it. Race countdown: a few notes on the road to a race you entered, which you can turn off on Account. If the browser is on a phone we note whether it is an iPhone or an Android phone, read from what the browser says about itself and nothing more of it, so one phone keeps one subscription however many times Reckoner is added to its home screen.

The push service can see that a message went to that browser. It cannot read one. Every message is encrypted to your browser's own keys before it leaves our server, so what the service carries is sealed and it has no way of opening it. The messages are the kinds the permission question names: the evening before your week turns, which says how many of your lifts move up, hold or back off and names no lift and no weight; a new version of the watch app; a request you sent us moving; and, only if you turn it on, the check in reminder on a morning a lift that hurt is due, which names no lift and says nothing about your body. Rarely, a change to how Reckoner counts something you train with, worded the same for everybody it reaches. None of them carries your email address or anything you typed. When one is sent, the server's own log records which kind it was, which push service it went to and what that service answered, and never the delivery address, your name or your account.

It ends four ways and any one is enough: sign out, and this browser's subscription is dropped here and in the browser; turn notifications off in the browser; delete your account; or do nothing, because when the browser replaces a subscription it tells us the new one and the old one is deleted here, and one we were never told about is deleted the first time a send comes back saying it is gone.

Athlete profile: health data

If you fill it in: bodyweight, body fat, tape measurements, sex, height, date of birth, your eating goal (cut, maintain or gain) and your preferred unit. These coach you and are shown back to you, and nothing else: the starting weights in your program, the calorie and macro targets on Today, the strength standards on the Where you stand page, and the related content we show you. A blank answer starts your program on the lighter starting weights.

Setup also keeps how you train: your training goal, your training history, the days and time you have, where you train and what equipment is there, and the lifts you would rather avoid. Where you train is a name you give a place, such as Home, never your location. It is what your plan is built from.

If you train for an event, we keep what you tell us about it: its kind, the name you give it, its date and start time, how much it matters, a goal time or best total if you give one, and whether it is your first. It is what the lighter weeks before it are planned from. An event you ask us to add to the list is kept as a count against the words you typed, never with your account.

Training data

Every session you log, from the watch or the website, is stored, with everything you record about it. Today that is:

• the training day and plan week, and per exercise the reps for each set, the weight for each set, your RPE, and whether the exercise was done or skipped;
• how each set went beyond its reps and load: your form answers, set and rest times, and which side for a one side lift;
• other training you log beside lifting, such as cardio: what you did, for how long and how hard;
• If you log a race or a meet: your time or your attempts and total, and how it felt. Your best made attempt counts toward that lift's records.
• how you said you felt before you started, and a shorter day if you chose one;
• flags: pain, swap, too hard, or skipped, including the free-text detail you type, and the free-text note you can leave at the end of a session (people describe injuries here, so treat it as health data, because we do);
• a heart-rate summary for the session: average and maximum, and whether it came from a chest strap or the watch's wrist optical sensor. It is a summary only; Reckoner does not receive or store a continuous heart-rate stream;
• provenance: a session id, start and end timestamps, the device label, the watch app version, and, if your watch app supplies one, the Garmin activity id, a number that lets you find the matching activity in your own Garmin account. We store it; we do not use it to fetch anything from Garmin;
• pauses you take on the watch: how long each lasted and which set it came after. We use them to show the session as it happened and to leave a set lifted straight after a pause of ten minutes or more out of the stall count;
• which sets, effort answers and form answers you fixed on the watch after logging them, and for a set whether its reps, its load or both changed. They are shown beside the lift, and counted, as totals only, on an internal dashboard;
• after a lift hurt, how it feels when Today checks in on it: each answer you tap and when, any you took back, whether you chose to train it anyway on a day and at what weight, and the days you said Not today to a swap. We use them to decide when the lift comes back and how light, and we treat them as health data, because they are.

From this the engine builds your history: per-exercise progressions, an estimated one-rep max per lift, and the weekly "what changed and why" log.

When you delete a session we keep a note that it was deleted, so a watch cannot put it back.

From the same sessions we count your milestones and your best lifts: weeks trained, sessions of each lift, hours in the gym, and the heaviest, the most reps and the best estimated max you have logged. They are worked out again from your sessions every time you look, so correcting, clearing or deleting a session changes them. We keep a note of each one you earned, the day it was earned and the session it came from, and when a change to a session means one was never earned we mark the note withdrawn rather than delete it. We also keep whether you closed the card shown after a session. None of it is shown to anybody but you. When you share a milestone, the picture is drawn in your browser and goes wherever you send it; nothing about the share reaches us but the fact that a card of that kind was shared or saved, if you have allowed analytics.

If you write a setup note on a lift, such as a bench angle or where the pins sit, we keep it with your account, one note per lift, and show it on that lift on the website and on your watch. Reckoner never reads it: it does not change your training, and nothing else uses it.

How your plan feels

Twice in your first weeks we ask how your plan is feeling: too easy, about right or too much, and which part if you tell us. We keep your answer with your account so your plan can change if you say yes. We also count how many people gave each answer. The count never names anyone, and your answer is deleted with your account.

Kept only in your browser

Some things are kept in localStorage, which is not a cookie and is never attached to a request: it stays on the device until it is deleted. Your light/dark theme choice is one, under the key reckoner-theme, so a page does not draw in the wrong colors before it hears back. Whether you want kilograms or pounds on the calculators at /tools is another, under rk_unit. The shape you last picked for a milestone card, Story or Feed, is a third, under reckoner-share-format. The tab you last opened on Progress: Strength, Body or Training, is a fourth, under reckoner-progress-tab. All four hold a setting rather than anything about you: one of two or three words, chosen by you on a control, readable by nobody else, and never sent to us.

The rest is what makes Reckoner work in a gym with no signal. reckoner-day holds today's training day and the plan it comes out of, so the app can still show you what to lift when it cannot reach the server. It is used only on the day it was saved on, and on any later day it is ignored rather than shown to you. reckoner-outbox holds a session you logged with no signal, on the device, until it reaches us; it is deleted the moment it is saved. reckoner-train holds a training session you are running on the phone (the day's plan, the sets you have done and the times you did them) so that locking the phone, reloading or losing signal loses nothing; it is training numbers only, and it is deleted the moment the session is saved. reckoner-exs holds, for each lift you open from its name, the sets you did last time and your best set on it, so they still show with no signal; it keeps up to forty lifts and your own logged weights and reps only, and signing out deletes it. reckoner-today-shape holds the shape of the last Today page the browser drew (how many lifts it listed and how tall each block was) so the next one loads at the same size; it holds counts and heights only, never a lift, a load or anything you wrote. reckoner-today-detail holds whether you asked Today to show the detail on every lift, so it opens the same way next time; it holds one flag and nothing else. reckoner-install holds how many times you have opened Reckoner and whether you have been offered the note about adding it to your home screen, so you are not asked twice. reckoner-watch-nudge-hidden holds whether you have dismissed the note about pairing a watch, for the length of one browser session only, so it does not reappear on every page; how many times you have actually dismissed it is kept on your account instead. reckoner-asks holds which questions are waiting for you in the bell, for the length of one browser session only, so every page shows the same ones; it holds the names of those questions and a few counts, never a weight, a lift or anything you wrote. reckoner-coach-ask holds which notes suggesting a coach watch one set you have closed, one entry per lift and per note, so a note you closed does not come back in this browser. reckoner-effort-note holds that you closed the one time note explaining the number shown beside the effort words, so it does not come back in this browser. reckoner-push-ask holds that you pressed Not now on the notifications question on Today, so it is not asked again in this browser until you sign out. reckoner-checkins-retry holds that your yes to the notifications question could not be saved to your account, so it is tried once more the next time you open Today, and it is removed at that moment. reckoner-push-kept notes, for one browser session only, that this browser's notification subscription has already been checked with us.

Two more exist only on the operator console, and only an operator's own browser ever writes them: reckoner-admin-col-order holds which order that console's accounts table has its columns in, and reckoner-view-grant holds a short-lived pass, good for fifteen minutes and worthless without the operator's own signed-in admin account, that lets them open your app in a new tab to answer a question you have written in about. Neither holds anything about an athlete: the pass carries no name and no address, and it belongs to the one tab it was opened in.

Signing out deletes your day and anything still waiting to be sent, so a shared device does not leave one person's training in front of the next. Clearing your browser data clears all of it. A session that had not yet reached us goes with it, so open Reckoner somewhere with a connection before you clear anything you logged offline. The cookie notice lists every key, including ones nothing writes any more.

Server logs

The web server in front of the app keeps standard access logs (IP address, timestamp, the URL requested, and the browser's user-agent string) for security and troubleshooting. They are kept on the server for four to five weeks. Once a week a copy of that week's logs, with the server's own system and security logs, which record what the service did and the address each email went to, is written off the server to the same storage in the EU as the backups, and each copy is deleted sixteen days after it is written. They are read to investigate a fault or an attack, and are not used to build any profile of you. We also read them once a night to count how many times each page was viewed that day. We keep no address or browser details. The application itself writes no per-request log. It does count visits to each guide, as one total per guide per day, so Today can show what is trending; that count holds no address, no browser and no account. It also counts how many readers answered Yes and how many answered No to the question at the foot of a guide or post, as one total of each per piece per day; those counts hold no address, no browser and no account. When a search on our site finds nothing, we keep the words that were searched and the date, never who searched, and delete them after 90 days.

Analytics

If you accept it in the cookie banner, we use Google Analytics 4 to understand which features are actually used, so what gets built next follows behavior instead of opinion. It sets its own cookies (named in the cookie policy) and loads only after you consent. Google Signals and advertising personalization are switched off, so this data cannot be joined to an advertising profile or used to follow you to other sites.

What it can see is limited by the code, not by a promise. Every event the site counts goes through a single function, which drops any parameter that is not on a fixed list for that event and rejects any value that is not a number, a true or false, or a member of a fixed set of words. There is no other route to Google. That one rule is what makes it structurally impossible for a name, an email address or anything you typed to leave the page, and it is why the list below is a description of the software rather than an undertaking about our conduct.

What Google receives:

• which page or screen you opened, as a plain word or a fixed address;
• that a feature was used, as one of a fixed list of event names;
• your browser and device type;
• your IP address, which Google truncates, uses to derive an approximate location, and does not pass on to us.

What it never receives, on any of our analytics:

• No account id of any kind. Not your email, not a hash of it, not a session token, not a number standing in for you. Until 1 August 2026 we did send your numeric account id as Google Analytics' User-ID. We stopped, and nothing replaced it, which means signed-in visits no longer join up over time. That is a real cost and it was accepted deliberately.
• No training data. No loads, reps, RPE, one-rep-max estimates or tonnage; no bodyweight, body fat, height, age or sex. That a feature was used is counted; what you entered into it is not.
• No free text. Nothing you write, in a note, a flag or a form, reaches an event.
• No page titles from the signed-in app, since a title could carry a display name. The app sends a plain word for the screen instead.
• Nothing identifying in an address. Query strings are stripped whole rather than filtered, and any address with a person in it is rewritten before it is sent.
• No raw counts. Numbers are grouped first, even harmless ones: a session with five lifts is counted as "4 to 6".

One consequence is worth stating plainly, because it cuts the other way too. Because we send nothing that identifies you, there is nothing in Google Analytics keyed to you, and so deleting your account cannot delete anything there: there is nothing to find. We would rather say that than promise a deletion we could not carry out. Deletion of everything we do hold about you is covered under Your rights below.

You can withdraw consent at any time from the cookie policy page, which stops the analytics and clears its cookies. If you reject, or if your browser sends a Do Not Track or Global Privacy Control signal, none of it loads at all, and nothing runs quietly in its place. Google is a processor for this, acting on our instructions; details are in the third-parties section below, and the full cookie picture is in the cookie policy.

Video from YouTube

Some pages may carry a short video, from a YouTube channel we choose and credit. Nothing about you reaches YouTube from that page until you choose to press play: the picture you see before that is a copy we host ourselves.

Press play, and the video and its player load directly from YouTube, which is Google's own service and not ours. From that point it receives what any site you visit receives: your IP address, your browser, and which page and video. It may set its own cookies, and if you are already signed in to a YouTube or Google account in that browser, it will recognize you as that account. The full explanation is in the terms, the cookie it can set is named in the cookie policy, and both point on to YouTube's own privacy information.

What we do not do

• No advertising networks, no advertising identifiers, and no ad targeting. The one analytics tool we run is Google Analytics, only with your consent, described under Analytics above, and it carries nothing to any advertiser.
• No selling or renting of your data, and no sharing of it beyond the services that run Reckoner for us, listed below, and totals across at least ten people that can never point to one person. There are no data brokers involved.
• No advertising or cross-site tracking cookies. The two cookies set without asking are the functional sign-in session and the record of your analytics answer, both described in the cookie policy; the analytics cookies are set only if you accept them.
• No location data, no continuous heart-rate stream and no contacts. The only pictures kept are the one you choose for your account and the image behind a link you choose to share.
• We never ask for, receive or store your Garmin Connect password, and Reckoner does not read your Garmin Connect account. The watch app talks only to reckoner.fit, authenticated with the device token you granted it when you paired it.

Legal basis

Either learning answer is withdrawn with its switch on the Account page, and a no to your health answers clears your injury details there and then. The health data that coaches you is withdrawn by clearing those profile fields, or by asking us to delete the account. Withdrawing does not undo processing already carried out, except that turning off Learn from my training deletes every copy written for you.

Automated adaptation

Reckoner automatically changes next week's numbers based on the sets, RPE and flags you logged. That is the product, and every change is explained in the weekly log. It produces no legal or similarly significant effect. When you leave a note, or flag pain or an exercise swap, the day is deliberately not auto-progressed: it is held aside for a person to look at, who is told by email, through Resend, which day was held and why, with your note and your flag as you wrote them. Nothing else outside Reckoner is involved in that review.

Making the coaching better

Reckoner keeps a log of the coaching decisions it makes for you: a lift reset, a swap offered, what you decided to do about it, and how that lift went afterwards. The log is yours and it is there to coach you. It is how the app knows you have already held through a reset once, so the second time it says something different instead of repeating itself, and it is in your data export with everything else.

While Learn from my training is on, a second, de-identified copy of your training records is written with you taken out of it, and we use that set across everyone who trains with Reckoner to check and improve the coaching. It holds the kinds of record the coaching runs on: what you log (sets, reps, effort and form ratings, rest and session timing, cardio), what was prescribed, the coaching decisions Reckoner makes and how they turned out, and your plan settings (such as your goal, level, schedule and equipment), with coarse bands for context such as roughly how long you have been training, and a change in load as a percentage rather than a weight. It holds no name, no email address, no account id, nothing you typed and no actual loads. The id it does carry is a random number minted for you and kept in a table of its own, so one lifter's records can be studied together without being studied as anybody. Your health answers join it only under their own switch below. It is used for one purpose, checking and improving how Reckoner coaches, including the rules the engine follows and any tools or models built to do that. The records themselves are not sold or used for ads, and they are never given to anyone outside Reckoner and the services that run it for us. Only totals across at least ten people, which can never point to one person, are ever shared beyond that. Deleting your account deletes the log and the number that links you to it, and what is left in that set can no longer be connected to you.

What you let Reckoner learn from

Two switches on the Account page, under What Reckoner learns from, decide what goes into that set. Whatever you answer, your plan, your weights and your history stay exactly the same, and you can change either answer any time.

• Learn from my training. Nothing of yours is learned from until you say yes. A new account is asked in setup, and setup does not move on until the question is answered. An account made before this switch was added is asked on its next visit, and the app waits for a yes or a no before it carries on. Until an account answers, it counts as off. When the switch was added, every copy already written for an account made before then was removed, so a yes starts from that day.
• Turning it off takes your training out of what Reckoner learns from at that moment: every copy written for you is deleted in the same step, and nothing new is added while it stays off. Your own coaching log is not touched, because that is how Reckoner coaches you. Turn it back on and it learns from that day on. Nothing that was removed is ever brought back.
• Learn from my health answers. Weight, body fat, measurements, pain and heart rate. Your health answers join what Reckoner learns from only if you say yes, and only while Learn from my training is on as well. Setup asks it straight after a yes to Learn from my training, and an account made before the switches were added is asked when it says yes to learning from its training. They coach you whichever you answer. Today that set holds none of your health answers at all, whatever you pick, so this switch decides whether any of them ever may.
• A no to your health answers means we keep no injury details. Injury details are the sore areas you tell setup about so your plan can train around them. Any you had given are cleared the moment you say no, and none are taken while the answer stays no. That includes every area you asked Reckoner to work around. Instead you confirm you are fit to train against the standard health check, which the terms set out.

A record of each answer

We keep a dated record of each answer you give to those two questions, and of each time you confirm you are fit to train: which question, yes or no, the version of the wording you answered, where you answered it (setup, the Account page, the question on your first visit after this change, or the fitness question) and when. A record is never changed. For the health check only a yes is recorded: if something on the list applies to you, nothing about it is written anywhere. The records are kept for as long as the account exists, are deleted with it, and are in your data export.

Where it is stored, and who else touches it

All account, profile and training data lives in a single SQLite database on one server rented from OVH in the EU. Each account's state is isolated by user id. Deployments push code to that server and explicitly never transfer the database, so your data does not travel to a developer machine as part of shipping a release.

That database is backed up, and saying so is part of saying where it is. A compressed copy of it is taken every night and kept on the same server. Every night that backup set is also copied to a backup drive of ours in the Netherlands, which holds exactly what the server holds and lets a copy go the night after the server does, and once a week a copy of it is written to storage in the EU. A backup is the database as it stood when it was taken, so a backup made before you delete your account still holds what was in it, for up to 30 days until that backup expires, and every backup made afterwards does not. We never restore an account from a backup. See "How long it is kept" for how long each one lasts.

These are the parties involved, each narrowly:

• OVH: hosting provider for the server in the EU. They hold the machine the data sits on.
• Resend (Resend, Inc., United States): delivers every email Reckoner sends. That is the sign-in code, the confirmation when you change your address, an account notice, a note about getting started if you signed up and have not, the weekly numbers and the look back at your month if you have those turned on, the training nudge unless you have turned it off, the note of what is new if you have asked for news, and the invitation you send to somebody else, which is the address you typed rather than your own. Which of those you can stop, and how, is set out under "Email we send you". Your address and the words of the message are passed to them to deliver it and for nothing else, and they tell us what became of each one, so a sign-in code that bounced is something we can see rather than guess at. That now includes whether the mail was opened and whether a link inside it was followed, which they tell us and we keep against your address and the time it happened. It also carries Reckoner's own service mail to the person who runs it, which can name an account's address and carry a note or a flag an athlete wrote. This is a transfer of your email address outside the EU.
• Google (Google Ireland Limited): runs Google Analytics, as our processor and on our instructions, but only for visitors who accept it. It receives page and event data and your IP address, and it sets analytics cookies in your browser. It receives no account id and no training data. Google may process some of this outside the EU under its standard data-transfer safeguards.
• Backblaze (Backblaze, Inc., United States): the weekly off-server copy of the backup set is written to their storage service, into a private bucket in their EU Central region, stored encrypted. Each copy is deleted sixteen days after it is written. The data stays in the EU. They are a US company, so they act as our processor under standard contractual clauses. It is the database as described above and that week's server logs, and nobody reads either unless the server is lost or an attack on it has to be investigated.
• The push service your browser's maker runs: only if you turned on notifications, only in that browser, and only ever to carry one sealed message it cannot read. Which company that is depends on the browser you used, because your browser chooses it and tells us where to send. It is described in full under Notifications above.

Two things can be loaded from outside reckoner.fit. Once you accept analytics, the Google tag is fetched from googletagmanager.com on every page except the three policy pages, the admin console and our own internal pages, so it never loads here at all. And once you press play on a video, YouTube's own player loads from YouTube's servers, described in full under Video from YouTube above. The icon font the app draws its menu glyphs with used to come from a public CDN. It is served from reckoner.fit itself now, the same as every other file on the site, so it is not a second address and there is nothing further to disclose about it. Your browser's IP address is visible to whichever of those you actually trigger, and to nobody else.

If you put your plan in your calendar, the calendar you chose fetches it from reckoner.fit on its own schedule, using a private link that was made for you. That can be Google Calendar, Apple Calendar, Outlook, or any other calendar you gave the link to. What it fetches is your plan: each session's day and name, its lifts with their sets, reps and weights, and about how long it takes. That calendar is a service you use rather than one we use, so what it keeps of your sessions is between you and it. Turning the feed off on the Plan page stops every link you were given from showing anything at all.

How long it is kept

• Account, profile and training history: for as long as the account exists. Nothing is deleted automatically; it is your log and it is meant to be long-lived.
• Display name, picture and founding-member number: for as long as the account exists, and gone with it. A number is never given to anybody else afterwards, which means nothing about you is left behind: what is retired is the number, not a record of who held it.
• What you reported or asked for, and your votes: for as long as the account exists, and gone with it. If you delete your account, what you sent us through the board is deleted with it, along with your votes. It does not stay on the board.
• Anything you wrote under a note on one of your rows: for as long as the account exists, and gone with it, the same as the submission it sits under.
• Reports of a handle: until the account that sent it, or the account it is about, is deleted.
• Waitlist entries: until you ask to be removed, or until an account made from that address is deleted, which takes the waitlist entry with it. Signing up does not by itself clear the entry: it stays, marked as invited, so we can tell who has taken up a place.
• Invitations you sent: the one-way fingerprint of each address and the day you sent it, for as long as the account exists, and gone with it. There is no address to keep and none is kept.
• Which monthly look backs and which editions of the news we sent you: for as long as the account exists, and gone with it.
• Whether a mail was opened and which link you followed: for as long as the account exists, and gone with it, the same as the address it names.
• Your answers about what Reckoner learns from, and each time you confirmed you are fit to train: for as long as the account exists, never changed, and gone with it.
• The de-identified set: kept for as long as it helps check and improve the coaching. While your account exists a random number links it to you. Turning off Learn from my training deletes every row written for you, and deleting the account deletes the number, after which what is left cannot be connected to you.
• Calendar feed links: kept only as a one-way fingerprint, so we cannot show you a link a second time, for as long as the account exists, and gone with it. Turning the feed off stops every one of them working.
• Sign-in codes: 60 minutes, and deleted the moment they are used.
• Sessions: 90 days, or immediately when you log out.
• Pairing codes: 5 to 10 minutes, single-use, deleted once the watch has its token.
• Device tokens: until you revoke the device.
• A notification subscription: until you sign out of that browser, turn notifications off in it, delete the account, or the browser replaces it, whichever comes first.
• Server logs: four to five weeks on the server, until the weekly rotation removes them. The weekly copy written off the server is deleted sixteen days after it was written.
• Searches that found nothing: the words searched and the date, never who searched, deleted after 90 days.
• Backups of the database: a copy is taken nightly and the most recent fourteen are kept, so a nightly copy is gone about a fortnight after it was made, and a copy taken before maintenance on the server ages out the same way. The backup drive in the Netherlands holds exactly what the server holds and lets each copy go the night after the server does. A copy of the server's backup set is written off the server once a week, to storage in the EU, and each of those is deleted sixteen days after it was written. A backup is a copy of the database at one moment, so it holds whatever was in the database that night and nothing that happened afterwards. So a deleted account can remain in a backup for up to 30 days, until that backup expires, and we never restore from it.

Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, withdraw consent, and receive it in a portable format. You also have the right to complain to a data protection authority: your own national one, or ours, which is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). Telling us first is welcome but it is not a precondition, and you never have to go through us to reach them.

• See and export your data. The Account page downloads all of it as one file, including the de-identified rows that carry your number. Signed in, the site's own JSON endpoints return it directly in your browser: /athlete, /plan/current, /session/week, /week/changelog and /auth/devices. That is machine-readable JSON, the portable format. Or email us and we will send the full export.
• Correct it. Profile values are editable on the Setup page; a watch can be renamed on the Your watches page. Your display name, your picture and whether the name may be shown to other athletes are all on the Account page, and changing any of them takes effect at once. The founding-member number is the one thing that cannot be edited, by you or by us, because a number that could be changed would not be a record of when you arrived.
• Revoke a watch. Your watches page; revoking deletes that device's token immediately.
• Delete everything. Signed in, the Account page lets you do it yourself: type your own email address to confirm, and the account, the profile, the entire training history, every paired watch's token, any notification subscription, everything you reported or voted on and your entry on the early-access waitlist are removed from the database immediately, not queued and not hidden. Nothing is held back to restore you from. The only copies left anywhere are the backups described above, which are read only if the server is lost: a deleted account can remain in one for up to 30 days until that backup expires, and we never restore from it. Taking the waitlist entry too means your address is genuinely gone, at the cost of your place: getting back in means asking again. It happens while you wait, all of it or none of it, and signs you out. If you would rather we did it, email hello@reckoner.fit from your account address and we will run the same deletion, within 30 days and normally much sooner. We will confirm when it is done.

Security

Sign-in codes, session tokens and device tokens are never stored in readable form, only as SHA-256 hashes, so a copy of the database does not hand someone your sessions. The site is served over HTTPS only, and the session cookie is HttpOnly, Secure and SameSite=Lax. Each account's state is isolated per user id, and every request must present a valid session cookie or device token before any of it is returned. No system is perfect; if you believe something is wrong, tell us at hello@reckoner.fit.

Children

Reckoner is not intended for anyone under 13, and we do not knowingly hold data about children. Onboarding asks for a date of birth and refuses to build a program for anyone below that age. In some countries a person under 16 cannot give the explicit consent the health data above relies on without a parent or guardian, so if that is your situation, get it before filling in the profile. If you believe a child has an account, email us and we will remove it.

Not medical advice

Training loads, calorie targets and strength standards produced by Reckoner are approximate and evidence-informed, a starting point to adapt, not a medical or dietary prescription, and not a diagnosis.

Changes

If this policy changes, the date at the top changes with it. A material change is announced in the app to every account, saying what actually moved rather than that something did, because a notice nobody can act on is a notice nobody reads. When a change is large enough to need it, it is also emailed to every account. That email is about your own data, so it goes to everyone, including anybody who has turned off the note about getting started. The current version is always at https://reckoner.fit/privacy.