VibeLift is a workout tracker. This page explains what data exists, where it lives, and how you get rid of it. No legal maze — if anything here is unclear, email us and we'll explain it like a human.
What we store
Your email address — only if you create an account. Used to send your sign-up and password-reset codes, and to tell the operator that a new account was created. Nothing else.
Your workout data — exercises, sets, reps, weights, dates, and any custom exercises or profile settings (name, kg/lb) you enter.
One record that you accepted the Terms and Health Disclaimer — the version, the date and time you ticked the box, your browser's user-agent string, and a one-way hash of your email address. We keep this even if you delete your account, because it is the only thing that shows the disclaimer was accepted. The law allows this narrow exception (GDPR Art. 17(3)(e), keeping what is needed to defend legal claims). It contains no name, no email in readable form, and no workout data.
If you pay: the PayPal receipt number, the amount and the date, linked to your account, so we know the app is unlocked for you and can answer questions about your payment. We never see your card details.
Which link brought you, if any — saved on your account when you sign up: the label on the link you opened (for example "tiktok" and the name of the video) and the name of the website you came from. Never the page you were reading there. It is how we learn which posts bring people who stay. This is kept without asking, because knowing which posts work is a legitimate interest of a one-person app and it holds nothing about you beyond the link. Email us and we remove it. It is deleted with your account.
That's the whole list of what we store. No ad trackers, no contacts, no selling your data to anyone. Ever.
Who runs VibeLift
VibeLift is run by one private individual living in the Republic of Serbia, the same operator named in the Terms of Use. That person decides what data is kept and why, and answers every request at support@thevibelift.com.
Where it lives
On your device — the app saves everything locally first, so it works offline. This data is yours, on your hardware.
In the cloud (only with an account) — a mirror copy is stored with Supabase on servers in Frankfurt, Germany (European Union), so your workouts survive a lost phone and sync between devices.
Email delivery — Brevo (EU) sends the sign-up and password codes and the new-account notice.
Payments — handled by PayPal. The app itself runs on Vercel, whose servers see your IP address when the page loads. Vercel and PayPal may process data outside the European Union.
Who can see it
Your workouts: only you. Your email: you, and the operator (the new-account notice, and replies when you write to support). Database security rules (row level security) make your rows invisible to every other user and to anyone without your login. Sign-in and reset codes go to your email only.
Deleting your data
Cloud data: Settings → Account → "Delete account & cloud data". This permanently erases your account and every cloud row, immediately, no email required, no questions asked.
Device data: clear the site data in your browser, or uninstall the app.
Cookies & counting visits
The app stores a login token on your device so you stay signed in.
Fonts come from Google Fonts and code libraries from unpkg. Like any web server, they see your IP address when the page loads.
With your permission, we use Google Analytics, loaded through Google Tag Manager, to count visits, see which link brought a visitor, and see whether signing up and paying work. That is all it is for.
Before you choose, or if you tap No thanks: Google Analytics is not loaded, nothing is sent to it, and no analytics cookies are set. Only your answer and when you gave it are remembered on your device, so you are not asked again. Anything kept from an earlier OK is removed.
If you tap OK: Google Analytics sets two cookies, _ga and _ga_9DJSE2XJC4, so it can tell one visit from the next, and the app remembers on your device which link first brought you.
Google then receives: the page address, the site you came from, your browser, device type, screen size and language, your IP address (used for a rough location), and step names: "sign-up started", "account created", "first set logged", "first workout finished", "pay screen opened", "pay button tapped" (with the pay method), "payment completed" (with the pay method and the amount), "added to Home Screen".
Google never receives: your email, your password, anything you type, or what you lift (exercises, sets, reps, weights).
We do this only with your consent. No advertising cookies. Google keeps this data for up to 14 months, and its cookies last up to 2 years. Your answer is good for 12 months; after that the app asks again. Google processes this data and may do so outside the European Union.
Changes
If this policy changes in any way that matters, the "last updated" date above changes and significant changes will be announced in the app.