Privacy Policy

About this policy

This policy describes the Barrel & Brawn website and companion fitness app operated by Barrel and Brawn ("we," "us"). Contact support@barrelandbrawn.com about privacy or your account. Effective October 24, 2026.

What we collect

• On your device: workout history, exercise selections, timers, difficulty and readiness choices, equipment profiles, program progress, movement preferences, and workout feedback.
• Optional account: your email address, an account identifier, sign-in information, saved preferences and program progress, and your optional product-email preference.
• Cloud history: signed-in Pro users' workout entries, including completion dates, duration, exercises, levels and feedback. Uploading existing guest history requires the separate import action in the app.
• Subscriptions: account and purchase identifiers, product, trial, renewal, expiry and entitlement status. The app store processes payment details; we do not receive your full payment-card number.
• Service and support records: messages you send us, plus technical information such as IP address, request timestamps, device/app information and delivery or security logs processed by our providers.

The current app does not integrate with Apple Health or Health Connect and does not request precise location, contacts, microphone or camera access. Fitness preferences are not medical records or a diagnosis.

How we use information

We use information to deliver workouts and saved progress, authenticate accounts, send requested sign-in codes, verify Pro access, sync eligible history, provide support, and maintain service reliability and security. Product marketing email is optional and separate from necessary account messages. You can change that preference in the app.

We do not sell workout history or use it for targeted advertising in the current service. We do not include advertising trackers in the current app. Opening an external link is subject to that destination's practices.

Where information goes

Supabase provides account authentication and private cloud storage. Resend delivers account emails on our behalf. RevenueCat processes subscription and purchase information and reports access changes to our backend. Apple or Google processes store purchases under its own terms. Expo supports development-build distribution and app development tools. Website hosting and security providers may process request and security logs.

Providers receive information needed for their functions. We may also disclose information when required by law, to protect rights and service security, or in a business transfer subject to applicable requirements. We do not promise that information remains in a particular country: providers may process it in the United States and other locations. The current app database is hosted in the United States.

Guest mode and your choices

The free app can be used without an account. Guest workout data stays in the app's device storage unless you export a backup, share it yourself, or expressly import it into an account. Account preferences/program progress have explicit save and restore controls; Pro account history syncs automatically. You choose where exported files go and who receives them.

You may export a backup, decline guest import, use the free app without an account, turn off optional product email, or contact support for access, correction, export or deletion requests. We may verify ownership before responding. Additional privacy rights may apply where you live; we honor applicable legal requirements without limiting those rights.

Retention and deletion

Device data remains until cleared, overwritten, or removed with the app. Device and operating-system backups may have their own retention settings. Clearing local history does not delete cloud records, which may return on a later sync. Signing out does not delete your account.

Use Account → Delete account to request deletion of your account and associated cloud profiles, entitlement row and workout history. If the control is unavailable or fails, email support. Deleted active database records may remain in restricted backups until the provider's backup lifecycle removes them; security, legal and transaction records may be retained where needed or required. Store and RevenueCat transaction records are subject to their own retention obligations. We have not promised a fixed backup-deletion deadline.

Deleting an account or the app does not cancel an Apple or Google subscription. Cancel separately through the store. We retain active account data while needed to provide the service, including saved data after a subscription ends, unless you delete the account or a retention requirement applies.

Security, children, and updates

We use account authentication, restricted database policies, server-side entitlement checks, encrypted transport and platform secure storage for native sign-in credentials. No method of storage or transmission is perfectly secure. Keep verification codes and backups private and contact support if you suspect unauthorized access.

The service is intended for adults aged 18 and older. We do not knowingly solicit accounts from children under 13. Contact support if a child has provided personal information so we can investigate and take appropriate action.

We will update this policy when our practices change and provide additional notice where required. Material changes will not silently expand the use of previously collected information where consent or another legal step is required.