Privacy policy

SetList is a workout app operated by an independent developer in the United States. You paste a link to a workout video (or upload one), and SetList uses AI to turn it into a structured workout you can follow, log, and track.

This policy explains what data SetList collects, what happens to it, and what your choices are. It covers both the SetList app and the usesetlist.com website, including the early-access waitlist, which you can join without creating an account. We have tried to write it so you can actually read it. If anything is unclear, email us and we will give you a straight answer.

The short version

If you only joined the waitlist, all we have is your email address, and we will use it once, to tell you your invite is ready. In the app, we collect the minimum it needs to work: your account, your workouts and training history, media you upload, a private log of your own activity in the app, and your IP address briefly for rate limiting. We use it to run the service and for nothing beyond what this policy describes. We do not run ads, we do not sell your data, we do not share your data with other users, and we do not use third-party trackers. When you delete your account, your records and the media files linked to your account are deleted, with copies in routine backups aging out within about 30 days.

What we collect

Waitlist signups. If you ask for early access on our website, we store your email address so we can invite you. Alongside it we store which button on the page you used and the address of the site that referred you, so we know which pages are worth keeping, and a one-way hash of your IP address rather than the address itself, which lets us stop signup spam without holding a record of where you were. We use your email for one thing: to tell you when your invite is ready. No newsletter, no marketing sequence, no sharing it with anyone. You can ask us to remove you at any time by emailing us, and joining the waitlist does not create an account.

Website analytics. On usesetlist.com we count visits and how far down the page people read. We built this ourselves rather than adding an analytics product, because every one of them, including the privacy-friendly ones, is a third party receiving your request, and we promise below that there are none. So: no cookie, no browser storage, nothing written to your device at all, and no account or profile of you anywhere. To count people rather than page loads we store a one-way hash of your IP address, your browser's user-agent string and today's date. Because the date is inside it, that value changes for you every night and cannot connect today's visit to tomorrow's. We keep only the host that referred you, never the full address, since a full link can carry a search you typed or the name of a private group. And if your browser sends Global Privacy Control or Do Not Track, we record nothing at all.

Account information. Your email address, used to sign you in (by magic link, or through Google sign-in). If you sign in with Google, we also receive the basic profile Google provides, such as your name and profile photo.

Workout and training data. The workouts you import or build, the exercises in them, the sessions you complete, the sets and reps you log, and your history and streaks.

Content you import. Links you paste, captions you paste, and video files you upload for extraction. Videos you upload may show you or other people. Only upload videos you have the right to share. Uploaded video is analyzed by our AI provider to identify exercises, not to identify people.

Creator information. Imported workouts keep public information about their source so they stay useful: the creator's handle, the source link, video timestamps, and the creator's public profile photo. For some imports (for example Instagram), SetList stores a private copy of the post's media so your workout keeps working after the platform's own links expire. This media follows the same deletion path as everything else in your account. A creator who wants their content removed can email us.

Analytics events. A private log of actions in your own account, such as "workout imported" or "workout completed". These events are never visible to other users and are used only to understand which features are actually working. This is our own event log, not a third-party analytics product.

Transient technical data. Like every web service, our hosting and authentication providers keep short-lived server logs that include IP addresses. When you use the import features or play your private videos, we also briefly hold your IP address and a per-account request counter to enforce rate limits; those counters expire within about two days. We never join IP data to your workout data.

How we use your data

One purpose: to provide the service. That means signing you in, extracting workouts from the content you give us, saving your workouts and history, syncing them across your devices, and keeping the service stable and secure. We do not use your data for advertising or profiling. The only exceptions are the legal ones described in "When we could be required to share data" below.

AI processing

Extraction is the heart of the app, so here is exactly what the AI providers see and why.

Google (Gemini API). When a workout is extracted from video, the video itself is sent to Google's Gemini API so the model can watch it and identify the exercises. This applies to videos you upload and to videos fetched from links you import. Uploaded videos are removed from Google's processing storage automatically within about 48 hours.

Anthropic (Claude API). Text connected to the workout, such as captions, transcripts, and chapter lists, is sent to Anthropic's Claude API to extract workout structure, and Claude also reconciles the extraction results into one final workout.

In both cases we send only the content needed for extraction. We do not send your email address, your account details, or your training history to these providers. We use their commercial developer APIs, whose terms do not permit training their models on this content; providers may retain content briefly for processing and abuse prevention before deleting it.

Who processes data for us

SetList runs on a small set of service providers. Each one handles data only to provide its service to us.

We do not use providers beyond those needed to run the service, and we keep this list current. Each provider is bound by its own terms and data-processing commitments to protect your data to at least the standard described in this policy, and we only use providers whose terms allow that.

What we do not do

No ads. No selling or renting your data. No sharing your workouts, history, or account data with other users; everything in your account is private to you. No third-party analytics, tracking pixels, or advertising SDKs. No data brokers. We do not set any advertising or analytics cookies ourselves, and embedded YouTube videos play in YouTube's privacy-enhanced mode.

When we could be required to share data

Two narrow exceptions to the promises above. We may disclose data if required by law or a valid legal process, or where necessary to protect the security of the service or enforce our terms; where the law allows it, we will tell you before we do. And if SetList is ever acquired or transferred to a new operator, your data would move with the service under this same policy, and we would notify you before any material change in how it is handled.

Storage and security

Your data lives in a managed Postgres database (Supabase) with row-level security, which means the database itself enforces that only your account can read your rows. Uploaded videos are stored privately and served through an authenticated proxy, so they are not publicly reachable by URL. Data is encrypted in transit.

SetList is run by one person on established managed platforms rather than home-built infrastructure. No system is perfectly secure and we will not pretend otherwise, but the design keeps your data locked to your account by default.

Retention and deleting your account

We keep your data for as long as your account exists, so your history and streaks keep working. You can delete your account from inside the app (Profile, then "Delete account"). When you do:

• Your database records (account, workouts, sessions, custom exercises, and event log) are deleted right away.
• The media files linked to your account (uploaded videos and re-hosted media) are deleted as part of the same deletion.
• Copies in our providers' routine encrypted backups age out on their own schedule, within about 30 days.

If any part of deletion fails, email us and we will complete it.

Waitlist entries sit outside your account, because you can join before you have one. We keep yours until you are invited and have had a chance to sign up, and we clear the list out once early access is over. Email us before then and we will remove you.

Your rights

• Access. Nearly everything we hold about you is visible inside the app: your account, workouts, history, and custom exercises. The exceptions are your analytics event log and transient rate-limiting data; email us and we will include them in a data export.
• Export. Email us and we will send you a copy of your data. To protect you, we only fulfill export requests sent from, and delivered to, the email address on the account.
• Delete. Delete your account in-app at any time, with the retention terms above. If you are only on the waitlist and have no account, email us and we will remove your entry.

These rights apply to everyone who uses SetList, wherever you live. SetList is offered from the United States and your data is processed there. Because we do not track you across other sites or serve ads, browser Do Not Track and Global Privacy Control signals change nothing about the app: it already behaves as if they were on. On the website they do have an effect, in your favour: if your browser sends either signal, we skip the visit counting described above and record nothing.

Cookies and local storage

SetList uses browser storage for function only:

• Auth session. A token kept in your browser's local storage so you stay signed in.
• Media playback. A signed cookie (valid for 7 days) that proves you are signed in when your browser streams your private videos. It contains no personal data beyond your account reference and is used only by the video endpoint.
• YouTube playback. Embedded YouTube videos use YouTube's privacy-enhanced mode, which avoids setting tracking cookies unless you interact with the video.

There are no advertising cookies and no analytics cookies.

Children

SetList is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Changes to this policy

If we change this policy, we will update it here with a new effective date. If a change materially affects how your data is handled, we will say so plainly rather than bury it.

Contact

Questions, export requests, or anything else: support@usesetlist.com