Privacy

Liftworthy is built to need as little of your data as possible. You can use it without an account, there are no ad trackers and no third-party analytics, and accounts use passkeys, so we never hold a password. This page explains exactly what we store and why.

Who we are

Liftworthy is operated by ONWRD AS (organisation number 935 619 939), based in Norway. We are the data controller. Contact: hello.liftworthy@proton.me.

What we store

• An anonymous ID. The first time you rate, post or share, your browser gets a random ID in a strictly necessary cookie (tiers_lid). It’s how your ratings stay yours. It contains no personal details and lasts a year.
• What you do on the site. Your ratings, tier lists, shared lists, takes, upvotes, reports and blocks, linked to that anonymous ID.
• Your workouts: exercises, sets, weights, reps, times, and any caption you add. Without an account they’re visible only to you.
• An account, only if you create one: a username, an optional display name, bio and profile photo (all public), your settings, and the public half of your passkey. Your fingerprint or face never leaves your device; we can’t see it.
• What you post as a member: workouts you choose to share, photos you attach, comments, S’s you give, and who you follow. Each workout shows who can see it (everyone, your followers or only you), and you choose before posting.
• Photos are resized on your phone before upload, and location and camera details are removed.
• Machine scans. When you scan a machine, the photo is sent to Anthropic, the AI company whose model identifies the machine, and then discarded. We keep only which machine it was and whether you confirmed it, to measure accuracy. We don’t keep the photo.
• Questions you ask Liftworthy. When you ask a question in Explore, the question is sent to Anthropic’s model to answer it. We don’t store the question.
• Exercises you add: the name, details, a short clip and three still frames from it. The sound is removed on your phone before upload. Once approved they’re public, with your username. To check new ones, three stills and the details are sent to Anthropic’s model, which isn’t allowed to train on them.
• A display name, only if you choose one to post takes. It’s public.
• Your email, only if you join the app waitlist.
• A scrambled version of your IP address, kept for up to 24 hours to enforce rate limits. We never store your raw IP address.
• Anonymous usage counts. We count page views and taps on features (for example, how many workouts were started today) as daily totals. Nothing is attached to them: no ID, cookie or IP address, so they can’t be linked to you. Nothing is stored on your device for this.
• Your weekly plan, if you make one: your training days, goal, session length and where you train, saved to your account.
• Reminders, only if you turn them on: an address from your browser’s push service (Apple, Google or Mozilla), your time zone and the hour you picked. Reminders are sent through that push service. Turning reminders off deletes this.

Shared tier lists, takes, profiles and workouts you post publicly are public by design. Everything else is private to you, or to the people you chose.

Why, and on what legal basis

• Running the rankings, your lists, your training log, your plan, reminders and your account, and keeping them free of abuse: providing the service you asked for (contract) and our legitimate interest in preventing abuse.
• Improving Liftworthy: our legitimate interest. We use the anonymous usage counts, and totals worked out from the data above (such as how many people rated or came back in a week), never individual profiles.
• Waitlist emails: your consent. We email you when the app launches and about major updates, and you can opt out at any time.

Who else handles it

Our hosting and file storage (Vercel) and database (Supabase) providers process data on our behalf under data processing agreements, and we choose EU regions where available. Machine-scan photos, questions you ask, and the details and stills of exercises you add are processed by Anthropic under its commercial terms, which don’t allow it to train its models on them. Some of these providers are based in the US; transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. Fonts are served from our own domain. “Watch a demo” links open YouTube in a new tab only when you tap them. We don’t sell or rent data to anyone.

How long we keep it

• Ratings, lists, takes, workouts, photos, comments, exercises you added and your account: until you delete them.
• Machine-scan photos: not kept. Which machine it was: until you delete your data.
• Waitlist emails: until the app launches, then for as long as you stay subscribed.
• Rate-limit data: 24 hours.
• Reminder details: until you turn reminders off, delete your account, or your browser stops accepting them.
• Anonymous usage counts: kept, since they contain nothing about you.
• Backups: we keep a weekly copy of the database on an encrypted computer in Norway for four weeks, then delete it. Anything you delete is gone from our backups within about a month.

Your rights

You can erase everything, including your account, workouts and photos, instantly from You (backups catch up within about a month). For access, correction, objection or any other request, email us. You can also complain to your data protection authority; in Norway that’s Datatilsynet.

Children

Liftworthy isn’t intended for children under 13, and we don’t knowingly collect data from them.

If Liftworthy changes hands

If Liftworthy is sold or merged, your data moves to the new owner under this policy, and we’ll tell you before any change to how it’s used.

Changes

If we change how we handle data, we’ll update this page and the date above, and tell waitlist members about significant changes.