Privacy policy

Last updated 21 July 2026

Reckoner is a strength-training coach: a Garmin watch app, a website, and a server that adapts your programme from what you actually lifted. To do that it holds training and health data about you. This page says exactly what is kept, why, for how long, and how to get it back or have it deleted.

The short version.

Your account is an email address. There is no password; we email a 6-digit code.
We store your training log (sets, reps, weights, RPE, notes, a heart-rate summary) and a small profile (bodyweight, sex, height, age, goal). That is health data, and it is only there because you enter it.
Everything lives in one SQLite database on one server in the EU. It is not sold, not shared, not used for advertising.
No analytics, no ad networks, no tracking cookies. The one cookie is the sign-in session.
Want it gone? Delete the account yourself on the Account page: it erases everything on the spot. Or email hello@reckoner.fit and we will do it for you.

Who is responsible

Reckoner, operated by Inner Skill Set, is the data controller for the personal data described here. The operator and the server are in the European Union, so the GDPR applies to all of it.

Contact for anything on this page: access, correction, export, deletion, or a complaint at hello@reckoner.fit.

What we collect, and why

Account

Your email address, and the date the account was created. Signing in mails you a 6-digit code; the code is stored only as a hash, expires after 10 minutes, is single-use, dies after 5 wrong attempts, and you can request at most 5 codes an hour. A successful sign-in creates a session token, stored only as a hash, and sets one cookie, rk_session, which is HttpOnly, SameSite=Lax, Secure over HTTPS, and lasts 90 days or until you log out. It exists to keep you signed in. It is not used for tracking or profiling.

The early-access waitlist

Reckoner is closed to new accounts right now. If you ask for a sign-in code and you haven't been invited, no account is created, but your email address is kept on a waitlist, with the date you asked and whether you have since been invited. It exists so we can let you in later, and it is used for nothing else. Ask us and we'll take you off it. Signing up does not remove the entry: it stays, marked as invited, alongside your new account. Deleting your account deletes it too.

Paired watches

When you pair a Garmin watch, the watch and the site exchange a short code and the watch receives its own long-lived token (again stored only as a hash). Against it we keep the label the watch sends (for example Garmin epix2), any name you give the device yourself, and the created and last-used timestamps. That is what the Devices page lists so you can recognise and revoke a watch. Device tokens do not expire on a timer; they stay valid until you revoke them on that page.

Athlete profile: health data

If you fill it in: bodyweight, sex, height, age, your goal (cut, maintain or gain) and your preferred unit. These feed two things and nothing else: the calorie and macro targets on the Fuel page, and the strength standards on the Where you stand page. Leave them blank and those pages simply tell you what is missing.

Training data

Every session you log, from the watch or the website, is stored:

the training day and plan week, and per exercise the reps for each set, the weight for each set, your RPE, and whether the exercise was done or skipped;
flags: pain, swap, too hard, or skipped, including the free-text detail you type, and the free-text note you can leave at the end of a session (people describe injuries here, so treat it as health data, because we do);
a heart-rate summary for the session: average and maximum, and whether it came from a chest strap or the watch's wrist optical sensor. It is a summary only; Reckoner does not receive or store a continuous heart-rate stream;
provenance: a session id, start and end timestamps, the device label, the watch app version, and, if your watch app supplies one, the Garmin activity id, a number that lets you find the matching activity in your own Garmin account. We store it; we do not use it to fetch anything from Garmin.

From this the engine builds your history: per-exercise progressions, an estimated one-rep max per lift, and the weekly "what changed and why" log.

Kept only in your browser

The site uses localStorage (not cookies, and never sent to the server) for your light/dark theme choice, a local copy of the profile values above so pages render before the server answers, and, on the Fuel page, your diet preference, allergen filters (nut-free, gluten-free), meal picks and any dishes you build yourself. Meal and diet choices are only in your browser: the server never sees them, and clearing your browser data deletes them for good.

Server logs

The web server in front of the app keeps standard access logs (IP address, timestamp, the URL requested, and the browser's user-agent string) for security and troubleshooting. They rotate on the server's normal schedule and are not used to build any profile of you. The application itself writes no per-request log.

What we do not do

No analytics of any kind: no Google Analytics, no product analytics, no pixels.
No advertising networks and no advertising identifiers.
No selling, renting or sharing of your data with anyone. There are no data brokers involved.
No tracking or advertising cookies. The only cookie is the functional sign-in session described above.
No location data, no continuous heart-rate stream, no contacts, no photos.
We never ask for, receive or store your Garmin Connect password, and Reckoner does not read your Garmin Connect account. The watch app talks only to reckoner.fit, authenticated with the device token you granted it when you paired it.

For completeness: the project also contains a developer-only prototype that can push workouts into the operator's own Garmin account from the operator's own machine, using credentials only they hold. It is not part of this service, it is not reachable from the website or the watch app, and it never touches another person's Garmin account.

Legal basis

Data	Why	Legal basis
Email, session, device tokens	To give you an account, keep you signed in, and let a watch you paired talk to the server	Performance of a contract, Art. 6(1)(b)
Waitlist email	To let you into early access when a place opens, after you asked for one	Steps taken at your request before entering a contract, Art. 6(1)(b)
Training log, plan, history	The service itself: storing what you lifted and adapting next week from it	Performance of a contract, Art. 6(1)(b)
Bodyweight, sex, height, age, heart rate, pain and injury notes	Health-related data you choose to enter so the coach can set loads, targets and standards for you	Your explicit consent, Art. 9(2)(a), withdrawable at any time
Server access logs	Keeping the service up and secure	Legitimate interests, Art. 6(1)(f)

Withdrawing consent for the health data means clearing those profile fields, or asking us to delete the account. It does not affect processing already carried out.

Automated adaptation

Reckoner automatically changes next week's numbers based on the sets, RPE and flags you logged. That is the product, and every change is explained in the weekly log. It produces no legal or similarly significant effect. When you leave a note, or flag pain or an exercise swap, the day is deliberately not auto-progressed: it is held aside for a person to rewrite. Your data is not sent to any third-party service for that review.

Where it is stored, and who else touches it

All account, profile and training data lives in a single SQLite database on one server rented from OVH in the EU. Each account's state is isolated by user id. Deployments push code to that server and explicitly never transfer the database, so your data does not travel to a developer machine as part of shipping a release.

Two third parties are involved, both narrowly:

OVH: hosting provider for the server in the EU. They hold the machine the data sits on.
Resend (Resend, Inc., United States): delivers the sign-in emails. Your email address and the one-time code are passed to them for that purpose only. This is a transfer of your email address outside the EU.

One more thing worth naming: pages of this site other than this one load an icon font from the public CDN cdn.jsdelivr.net, which means your browser's IP address is visible to that CDN when you use the app. It sets no cookies. This privacy page loads nothing from anywhere but reckoner.fit.

How long it is kept

Account, profile and training history: for as long as the account exists. Nothing is deleted automatically; it is your log and it is meant to be long-lived.
Waitlist entries: until you ask to be removed, or until an account made from that address is deleted, which takes the waitlist entry with it. Signing up does not by itself clear the entry: it stays, marked as invited, so we can tell who has taken up a place.
Sign-in codes: 10 minutes, and deleted the moment they are used.
Sessions: 90 days, or immediately when you log out.
Pairing codes: 5 to 10 minutes, single-use, deleted once the watch has its token.
Device tokens: until you revoke the device.
Server access logs: until the server's standard log rotation removes them.

Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, withdraw consent, and receive it in a portable format. You also have the right to complain to your national data protection authority.

See and export your data. Signed in, the site's own JSON endpoints return it directly in your browser: /athlete, /plan/current, /history, /session/week, /week/changelog and /auth/devices. That is machine-readable JSON, the portable format. Or email us and we will send the full export.
Correct it. Profile values are editable on the Fuel and Where you stand pages; a device can be renamed on the Devices page.
Revoke a watch. Devices page; revoking deletes that device's token immediately.
Delete everything. Signed in, the Account page lets you do it yourself: type your own email address to confirm, and the account, the profile, the entire training history, every paired watch's token and your entry on the early-access waitlist are removed from the database immediately, not queued, not hidden, and with no backup to restore them from. Taking the waitlist entry too means your address is genuinely gone, at the cost of your place: getting back in means asking again. It happens while you wait, all of it or none of it, and signs you out. If you would rather we did it, email hello@reckoner.fit from your account address and we will run the same deletion, within 30 days and normally much sooner. We will confirm when it is done.

Security

Sign-in codes, session tokens and device tokens are never stored in readable form, only as SHA-256 hashes, so a copy of the database does not hand someone your sessions. The site is served over HTTPS only, and the session cookie is HttpOnly, Secure and SameSite=Lax. Each account's state is isolated per user id, and every request must present a valid session cookie or device token before any of it is returned. No system is perfect; if you believe something is wrong, tell us at hello@reckoner.fit.

Children

Reckoner is not intended for anyone under 16, and we do not knowingly hold data about children. If you believe a child has an account, email us and we will remove it.

Not medical advice

Training loads, calorie targets and strength standards produced by Reckoner are approximate and evidence-informed, a starting point to adapt, not a medical or dietary prescription, and not a diagnosis.

Changes

If this policy changes, the date at the top changes with it, and material changes will be announced in the app. The current version is always at https://reckoner.fit/privacy.