What we keep, and how to get rid of it

Privacy

Last updated: 18 September 2026

Built Capable stores your account and your training data so it follows you across your devices. This page explains what's kept, where, and how to delete it.

What we store

When you create an account, we store on our server (Cloudflare D1, a database hosted in the United States):

• Your email address and a hashed version of your password (we never store the password itself and cannot see it).
• Your training data — workout plans, equipment setup, training history (sessions, sets, loads, RPE, notes), your training level and preferences, and any 8-week program. This is the same data the app keeps in your browser; storing a copy on our server is what lets it sync across your devices.
• A session token (a random string in a cookie) so you stay signed in. It is not used for tracking.
• If you subscribe, a Stripe customer reference and the state of your subscription (whether it is trialing, active, past due or cancelled, and when the period ends). We never receive or store your card details.
• Feedback you send us — the message you wrote, when you sent it, and, only if you leave the “Include app details” box ticked, five technical details about the app at that moment: the version you were on, which screen you were looking at, your browser window width, your browser's user-agent string, and your time zone. The sheet shows you those five values before you send; untick the box and none of them are stored. Nothing from your training, your readiness answers or your equipment is ever attached to a feedback message.

A copy of your training data also stays in your browser's local storage so the app works offline. Signing out clears that local copy from the device you signed out on.

Feedback and testimonials

We keep feedback to fix what is broken and to decide what to build next. It is read by a person and is not used to advertise to you.

Once, after your fourth saved workout, the app asks how it is going. If you answer that it is going well, you can offer a line we could quote. That line is published only if you tick the box saying we may quote you, which is unticked by default — and if you do, we show a first name and last initial, never your email address. Saying nothing, or dismissing the card, changes nothing about your account. No reward, discount or unlocked feature is tied to feedback or to a testimonial, and the app never asks twice.

Ask us at any time and we will take a published quote down, or delete a feedback message, with no explanation needed. Your own feedback is included in your data export, and it is deleted along with everything else when you delete your account.

What we don't do

We do not sell or share your data. There is no advertising and no cross-site tracking. The only cookie is your sign-in session.

The site uses Cloudflare Web Analytics for basic aggregate traffic counts (page views, referrers, country, device type). It sets no cookies, stores no identifier for you, does not track you across other sites, and cannot be tied back to your account. It is not used to build a profile of you.

How your sessions are built

The app writes the lines you see on a workout — which movement fills a slot, why one stands in for another, the loads, the reasons under a recommendation. That is the app's own rules running on your equipment list, your training level, what you have logged and anything you have asked it to work around. It is not a language model, nothing you log is sent anywhere to produce it, and the same inputs always produce the same session.

The one exception is the “describe your workout” box, which is described below. Text written by that feature is labelled Written by AI where it appears. Lines the app wrote itself are labelled Adapted for you.

Other services involved

• Hosting. The app and database run on Cloudflare. Like any web host, Cloudflare processes the normal technical information a browser sends (IP address, browser type, files requested) and may keep short-term server logs for security and reliability.
• The "describe your workout" feature. If you use the free-text box, the sentence you type is sent to Anthropic's API to be turned into workout settings. It is not stored by us and, per Anthropic's API terms, is not used to train their models. Don't put anything sensitive in that box.
• Payments. Subscriptions are handled by Stripe. When you subscribe you are taken to a page hosted by Stripe, and the card number, name and billing details you enter there go to Stripe, not to us. Stripe is the processor of record for that information and handles it under its own privacy policy. What comes back to us is a customer reference and your subscription status — enough to know whether your account is paid, and nothing else. We send Stripe your account's internal id so a payment can be matched to the right account; Stripe collects your email on its own checkout page.
• Fonts. The typefaces are served from this site, not from a font service. Nothing about a page load goes to Google.

Deleting your account

Open the account menu and choose Delete account. It asks for your password, asks you to type a confirmation, and then deletes your sign-in and every session, program, logbook entry and feedback message we hold for you from the server — including any testimonial you had agreed we could quote. There is no copy and no way to restore it. Clearing this site's data in your browser removes the local copy.

If you have a subscription it is cancelled immediately as part of the deletion, so you are not charged again. Access ends at once rather than at the end of the period you have paid for, and there is no refund for the remainder — export your data first if you want to keep it. Stripe keeps its own record of payments you have made — it has to, for tax and accounting — so deleting your Built Capable account does not erase the payment history held by Stripe.

If the deletion cannot cancel your subscription for any reason, nothing is deleted and it tells you so, rather than leaving a card being charged for an account that no longer exists. Email the address below and we will do it by hand.

Password reset

If you're locked out, use Forgot your password? on the sign-in screen. We email a link that works once and expires in an hour. We store only a one-way hash of that link, never the link itself, and using it signs out every device on the account. Asking for a new link cancels any earlier one.

The email contains no tracking and no images. If reset by email is ever unavailable, the screen says so and points you at the address below rather than quietly doing nothing.

Changes to this policy

If this policy changes in a way that affects how your information is handled, the "last updated" date above will change.

Contact

Privacy questions, account deletion, or a password reset: [email protected].