Privacy Policy

SURGE is built and operated by {{OPERATOR_NAME}}, a private individual based in Ukraine. There is no company behind it. Under the GDPR that person is the data controller for everything described here.

Questions, requests, complaints: {{CONTACT_EMAIL}}. A real person reads that address, so give it a few days.

Two things decide what is stored about you: whether you have an account, and whether you talk to the AI coach. Signed out, everything below stays in your browser. Signed in, it syncs to a database so your phone and your laptop agree.

Your account

Accounts are handled by Supabase Auth. The account record holds your email address, a hashed password (never the password itself), and — if you used Continue with Google — the Google account id and the email and name Google returns for it. It also holds the timestamps of when you signed up and last signed in. SURGE never sees your Google password.

Your training data

Ten pieces of app state sync to the user_state table, one row each, readable only by you:

• activePlan — your weekly plan: days, exercises, sets, reps, rest.
• logs — every session you have logged: dates, exercises, weights, reps, hold times and RPE.
• chat — your conversation with the coach, kept as one continuous thread so it is still there next time.
• profile — experience level, age, gender, weight, other sports, and injuries and limitations you have told the coach about.
• bodyweight — your body-weight entries with their dates.
• customExercises — exercises you defined yourself.
• extras — one-off workouts you built or saved.
• activeSession — the workout in progress, so an interrupted session resumes.
• prefs — app settings, such as kilograms or pounds.
• coachPrefs — exercises and formats you have told the coach to avoid.

Reminders

If you switch on training reminders, the push_subscriptions table stores the push endpoint your browser issued, the keys needed to encrypt a notification to it, your timezone offset, and which weekdays your plan has a session. One row per device.

Shared workout links

When you create a share link, the workout itself — its name, exercises and any custom exercises it uses — is copied into the shared_workouts table under a random slug. That row does not contain your user id, your name or your email: it is the workout, not you. Anyone holding the link can open it until it expires.

Coach usage

Two tables count what the AI coach costs, because it is free to you and not free to run:

• ai_usage — your daily message and token count, so the daily limit can be enforced without a database-free cookie you could simply clear. Keyed user:<your id> when you are signed in.
• ai_request_log — one row per coach request: which model ran, how many tokens, what it cost, which tools were used, how long it took, and your user id. It never contains message text.

There is no analytics, no advertising and no third-party tracker anywhere in SURGE. No Google Analytics, no pixels, no session recording, no fingerprinting. Nothing on this site is trying to work out who you are across the rest of the web.

The GDPR asks for a reason for each purpose, not one reason for everything. Here they are:

Some of what SURGE holds is health data, which European law treats as a special category needing stronger protection than an email address. Specifically: the injuries and physical limitations on your profile, your body-weight history, your age and gender, and the RPE (how hard it felt) you record against sets.

The legal basis for that data is your explicit consent— not “legitimate interest”. You give it by typing the information in: entering a limitation, logging a body weight, or telling the coach about an injury. None of it is required. The app works without any of it; the coaching is just worse, because it is guessing.

You can withdraw that consent at any time by deleting the data — clear the fields on your profile, remove body-weight entries, or delete your account outright. Withdrawing does not undo processing that already happened, but it stops it going forward. Bear in mind that your injuries are sent to Anthropic with each coach message; that is covered in the next section.

This is the most important disclosure on the page, so it gets its own section. When you send a message to the coach, SURGE sends the following to Anthropic, whose model writes the reply:

• the conversation so far, including what you just typed;
• today's date, and whether today's planned session is still unlogged;
• this week's and last week's totals — sessions, volume lifted, average RPE;
• your profile — experience, age, gender, weight, other sports, and your injuries and limitations;
• your latest body weight and a reference point from about thirty days earlier;
• exercises and formats you have asked it to avoid;
• your saved one-off workouts and your active plan;
• your five most recent sessions set by set, and your top personal records.

That context is assembled fresh for each message and capped in size. It is what makes the coach useful — it cannot program around a bad shoulder it has not been told about — but it does mean your health information leaves this app and reaches a company in the United States. If you are not comfortable with that, do not use the coach: plans, templates, logging, the progress dashboard and everything else work without it.

What SURGE stores about those messages: the conversation itself, in your own chat row, which only you can read. The cost log records how many tokens a request used and which tools ran — never a word of what was said. Anthropic handles the message under its own terms as an API provider; what it does with API traffic is described in Anthropic's privacy policy.

You can use almost all of SURGE without an account. Then your plans, logs, profile and everything else stay in your browser's local storage on that one device. They are not uploaded, they are not backed up, and clearing your browser data deletes them for good. When you do sign in later, whatever is on the device moves up into your new account.

Guests are not entirely invisible, and it would be dishonest to say otherwise. To keep one person from spending the whole daily AI budget, the coach quota identifies a guest by a hash of their IP address — the address is run through a keyed hash and only the result is stored, as ip:<hash>, against a day and a message count. The raw IP is never written to the database. A hashed IP is still personal data under the GDPR, which is why it is disclosed here; it is used for nothing but abuse prevention, and the rows are deleted by the daily cleanup after thirty days. If the database is unreachable, the count falls back to a signed cookie instead (see below).

Coach messages you send as a guest go to Anthropic exactly as described above, along with whatever training context exists on the device.

SURGE never sees your card. Payment is handled by Paddle, who act as the merchant of record: they are the seller for the transaction, and they are the data controller for everything the payment itself needs — your card details, billing address, and the tax status of where you live. That information goes to Paddle directly and is covered by their privacy notice, not this one.

What comes back to SURGE, and all that comes back, is:

That is stored in one row of subscriptions, keyed to your account. There is no card number, no billing address and no payment history in SURGE’s database, because none of it is needed to run the app.

Deleting your account cancels the subscription at Paddle first, then deletes the row. Paddle keeps its own transaction records for as long as tax and accounting law requires it to — that obligation is theirs, and it survives your deletion here.

SURGE does not sell anything to anyone, and shares nothing for advertising. These are the companies it needs to run — sub-processors, in GDPR language — and exactly what each one gets:

Beyond that, data may be disclosed if the law genuinely requires it — a valid order from a competent authority — and nothing else would come close to justifying it.

SURGE sets two kinds of cookie, both strictly necessary:

• sb-* — Supabase authentication cookies. They are what keeps you signed in; without them every page load would ask for your password again.
• wp_usage— a signed, HTTP-only counter holding today's date and how many coach messages you have sent. It is the backup for the daily limit when the database is unavailable. It contains no identifier and cannot be read by scripts.

That is the complete list. Because both are strictly necessary for a service you asked for, no consent banner is required — and since there is nothing else to consent to, you do not get one. If analytics are ever added, this section changes first and a banner comes with them.

The daily job runs once a day and does the sweeping described above. It is the same job that sends training reminders.

If the GDPR applies to you, you have the right to see your data, correct it, delete it, take it elsewhere, restrict or object to how it is used, and withdraw consent you have given. Ukrainian data-protection law grants a comparable set. Most of it is a button rather than an email:

• See it and take it with you. Account → Export everything (JSON) gives you your plans, logs, profile, body weight, custom exercises and settings in a machine-readable file. Export workout log (CSV) gives you every logged set as a spreadsheet.
• Correct it. Every field is editable in the app — profile, plan, logged sets, body weight.
• Delete it. Account → Delete my account erases your account record, your synced data, your reminder subscriptions and your usage counters. Erase data on this device clears the local copy. Neither can be undone, so export first.
• Anything else — restriction, objection, or a question about any of this — email {{CONTACT_EMAIL}}. Requests are answered within one month, as the GDPR requires.

If you think your data has been mishandled, you can complain to a regulator: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman); in the EU or EEA, the supervisory authority of the country you live in. You do not need to contact us first, though it is usually faster.

The service is operated from Ukraine, and the companies listed above process data outside it — including in the United States. If you are in the EEA or the UK, that is an international transfer.

Those providers offer standard contractual clauses and their own data-processing terms for exactly this situation, and SURGE relies on them. Ukraine and the EEA are not covered by a mutual adequacy decision, so the transfer to the operator rests on the clauses and on the contract you have with the service. If that matters to you, the shortest safe answer is to use the app without an account and without the coach: then nothing leaves your device.

SURGE is for people aged 16 and over. It is not designed for children, and accounts are not knowingly created for them. If you believe someone under 16 has an account, email {{CONTACT_EMAIL}} and it will be deleted.

When this policy changes, the date at the top of the page changes with it, and the previous versions stay visible in the project's public commit history. If a change materially affects what is collected or who receives it, signed-in users are told by email before it takes effect. Continuing to use SURGE after that means the new version applies.

The companion document is the Terms of Service.