Privacy Policy

What we store

• Account details: your name, email address and username, whether and when you verified your email, and when your account was created and last changed. Your password is stored only as a one-way (BCrypt) hash. If you use Sign in with Google, also your Google account’s ID, the email address it had when you connected it, and when you last signed in with it.
• Sign-in records: to keep you signed in, the server stores a hash of each sign-in token, not the token itself. Email verification and password-reset codes are also stored only as hashes, and expire after 10 minutes.
• Training data you enter: exercises, programs and their targets, workout sessions and sets (such as weight, reps, RPE and notes), planner entries, bodyweight entries and, if you upload one, a profile picture.
• Results calculated from your training, such as personal records and strength rankings.
• Getting-started progress: whether you finished or skipped the guided tour, the first-week setup, the first-workout tips and the getting-started checklist, and which “what’s new” notes you have seen. It only decides what the app offers you next.
• Nutrition data, if you use nutrition tracking: the foods and amounts you log in your food diary, with their calories and nutrients; foods and recipes you create; your favorite foods; and, if you set up a calorie target, the details it is calculated from and the targets that result (see Nutrition tracking).
• AI training reviews you choose to generate, and the training facts each one was based on (see AI training reviews).
• Tarnished Lab experiments you start, their results, and any AI summary you ask for (see Tarnished Lab).
• Subscription records: your plan, its status and billing history, Razorpay’s reference IDs, and a short summary of each payment notice Razorpay sends (see Payments).
• Free trial, security and service records, described in their own sections below.

Nutrition tracking

Nutrition tracking is optional. If you use it, we store your food diary (each food and amount you log, the meal and day, and the calories and nutrients it adds up to), the foods and recipes you create, and your favorite foods. If you set up a calorie target, we also store your sex, date of birth, height, activity level, goal and target rate, an optional goal weight, the body weight the target was calculated from, and the calorie and macro targets that result, with their history so your trends compare each day with the target you had then.

Some of this, such as what you eat, your body measurements and your goals, is health-related information. It is used only to show you your diary, targets and trends, and, if your plan includes Tarnished Lab, the patterns and experiments calculated from it on our servers. It is not shared with other users, not sent to OpenAI or any other third party, and never used for advertising. Foods and recipes you create are visible only to you.

To improve the food catalog, we count what is searched in it: the search text (3 to 50 characters), how many times it was searched each day and whether it found anything, so we can see which foods are missing. We also count how many people logged each catalog food each day, to rank search results. Neither count stores who searched or logged anything.

Free trial fairness

Each person gets one free trial. To keep it that way, when you sign up and verify your email, or sign up with Google, we record keyed one-way hashes of: your email inbox (so that variations of one address count once), a random identifier this app creates for your browser or phone (it is not a fingerprint and reads nothing about your device), and the network you connected from. We may also check whether that network belongs to a VPN, proxy, Tor or hosting provider; for that check your IP address alone is sent to our IP-reputation provider, ipapi.is.

These records are used only to decide whether an account gets the free trial. A VPN or a shared network never rules one out on its own. Not getting a trial never affects buying a plan or using your account.

The outcome is kept with your account: whether a trial was granted, the reasons for that decision, and the type of network you signed up from (for example, a VPN or hosting network).

Retention: the network and browser hashes kept with your account are cleared 90 days after sign-up. Separate trial records are kept even if an account is deleted, so that deleting and re-creating an account does not restart a trial: network records for 90 days, browser or phone records for 1 year and inbox records for 2 years, then they are deleted automatically. When a verified account is deleted without ever having had a trial, an inbox record is created for it then and kept for 2 years, so a new account with the same address does not get one either.

These records hold keyed one-way hashes, not the email address or IP address itself. A hash is designed not to be turned back into the address, but it is not anonymous: the same address always gives the same hash, which is how a repeat is recognised, and each record stays linked to the trial it belongs to.

Security and service records

To keep Tarnished secure and running fairly, we keep records of how accounts use the service: when you last signed in and last used the app; how many requests your account makes each day, including errors and AI review requests; security events such as sign-ins, failed sign-ins, password changes and rate limits; and automatic flags when an account’s usage looks unusual.

Where these records include the IP address a request came from, they store a keyed one-way hash of it rather than the address itself, so that repeated activity from one network can still be recognised.

These records are used only for security, preventing abuse, enforcing usage limits and fixing problems, never for advertising. Unusual-usage flags are for an administrator to review; they do not block an account on their own.

Tarnished’s admin tools show administrators your account details, plan and billing status, these records, and counts of what you have logged (for example, how many workouts), but not the content of your workouts. Each time an administrator opens an account’s full details, and each action an administrator takes on an account, such as suspending it, is logged.

Retention: daily usage records and unusual-usage flags are deleted after 180 days, security events after 90 days, and administrator action logs after 2 years. Your last sign-in and last-activity times are kept while your account exists. Service-wide statistics (request counts and response times for each part of the API, per hour) are not linked to any account and are deleted after 90 days.

Server logs

Our servers write technical logs so that problems can be found and fixed. They record events such as email verification, emails sent and errors using your account’s internal number, not your name or email address. When too many sign-in or code requests come from one IP address, the log records that address. These logs are kept by our hosting provider for a limited time, and the provider may keep its own records of requests, such as IP addresses, to run and protect its network.

Why we use it

Your data is used to run the service for you: to show your history, calculate your analytics, records and insights, decide which plan features your account can use, and keep the service secure. It is not sold, and it is not used for advertising.

AI training reviews

Reviews are generated only when you ask for one. To produce it, a summary of your logged training for the selected period and the period before it is sent to OpenAI: session counts and dates, planned and completed sessions, totals for volume and working sets, your exercise names (as you wrote them) with their muscle groups, top sets and personal records, bodyweight entries with their dates, and workload per muscle group. Your name, email address, username, password, notes and profile picture are not included.

The review that comes back, and the training facts it was based on, are stored with your account so you can read them again, and are included in your data export. Reviews cannot currently be deleted one by one. OpenAI handles the request under its own terms and policies.

Tarnished Lab

Tarnished Lab looks for patterns in your own logs by comparing your weeks with each other: your training, and, where you have logged them, your nutrition, bodyweight and planner. This is calculated on our servers each time you open Lab; patterns themselves are not stored, and nothing is shared with other users.

An experiment you start is stored with your account: the lift, what you chose to change and your target, the dates, a frozen copy of the lift’s recent results used as its baseline, and the result once it ends. Experiments stay readable whatever your plan, are included in your data export, and are deleted with your account.

An AI summary of an experiment is generated only when you ask for one, and only for experiments that change your training (sessions per week or weekly sets). To produce it, facts about that one experiment are sent to OpenAI: the lift’s name and muscle group, its top sets and estimated one-rep maxes before and during the experiment, the weekly session or set counts, how many weeks met the target, the projection and the verdict. Nothing about what you eat or your bodyweight is sent, and protein and calorie experiments do not get an AI summary. Your name, email address, username, password, notes and profile picture are not included. The summary is stored with the experiment like an AI training review and counts toward the same monthly allowance.

Payments

Subscriptions are processed by Razorpay. Your card, bank and UPI details are entered in Razorpay’s checkout and handled by Razorpay; Tarnished never receives or stores them.

When you start a payment, Tarnished gives Razorpay your name and email address to fill in its checkout, and labels the subscription or order with your Tarnished account number and the plan so the payment can be matched to your account. Razorpay may email you about your subscription.

Razorpay notifies Tarnished of each payment and subscription change. From those notices Tarnished keeps only what billing needs: reference IDs, the plan, amounts and currency, statuses and dates. Any contact or payment-method details a notice carries are discarded before anything is stored.

Service providers

• Hosting for the web app and the API, and a managed database, which store and serve your data.
• Cloudflare, which delivers this website and protects it from automated abuse. Every visit to the website passes through Cloudflare, which receives your IP address and browser details and may ask you to confirm you are human. The sign-up, resend-code and password-reset forms also run Cloudflare’s Turnstile check in your browser; our server then sends Cloudflare the check’s result and the IP address of the request to confirm it, and nothing about your account. Cloudflare also stores the Android app’s installation files and its public release information: when you download the app or the app checks for an update, Cloudflare receives your IP address and device details, but nothing about your account.
• A managed cache, which can hold copies of some of your training views, such as your dashboard and records, for up to an hour so pages load faster.
• Razorpay, for payments (see Payments).
• Google, for Sign in with Google. Its sign-in button loads from Google when you open the sign-in or sign-up page, so Google receives your IP address and browser details. If you choose a Google account, Google sends us your name, email address, whether Google has verified it, and your Google account ID; we never receive your Google password or anything else in your Google account.
• Brevo, which sends account emails: sign-up verification and password-reset codes; confirmations when your free trial starts, when you buy, upgrade or cancel a plan, and when you ask to delete your account; and reminders before a plan or trial ends. It receives your email address and the content of those emails.
• OpenAI, only when you generate an AI training review or an AI summary of a training experiment (see AI training reviews and Tarnished Lab).
• ipapi.is, which receives only the IP address you verify your email or sign up with Google from, to check whether it belongs to a VPN, proxy, Tor or hosting network.
• Google Fonts, which serves the typefaces on this website’s public pages, such as the home and legal pages. The website connects to it when it loads, so Google receives your IP address.
• YouTube (Google), whose embedded player shows exercise tutorial videos when you open one (see Exercise tutorial videos below).

Exercise tutorial videos

Exercise tutorials are YouTube videos shown in YouTube’s embedded player, which is one of the YouTube API Services. Tarnished uses YouTube API Services for this feature. Tarnished stores only each video’s YouTube ID. The videos are hosted and played by YouTube, and Tarnished does not send YouTube your name, email address, username or training data.

The player is loaded only when you open a tutorial, and it uses YouTube’s privacy-enhanced mode. As soon as it loads, before you press play, your browser connects to YouTube and other Google servers. YouTube receives your IP address, details of your browser, the video you opened and the fact that it was opened from Tarnished (our website address, not the page you were on). Google says the player uses this to show the video’s thumbnail and title, check whether the video can be played, and prevent fraud and abuse. More data is collected and shared with YouTube when you play the video.

YouTube may store and read cookies or similar data, such as local storage, on your device when the player loads and when you play a video, and it may show ads in the player. In privacy-enhanced mode, YouTube says your views are not used to personalise your YouTube experience or the ads you see elsewhere, and that ads in the player are not personalised. This limits how YouTube uses the data; it does not stop the data from being collected. How Google handles it is described in the Google Privacy Policy.

Tarnished does not receive or keep any record of which tutorials you open or watch.

• Google Privacy Policy

On your device

The website keeps your sign-in session, preferences, its random browser identifier and short sign-in waiting times in your browser’s local storage, as described in the Cookie Policy. The Android app keeps your sign-in session and its random identifier in Android’s encrypted storage, and your preferences, rest-timer state, last username and any workout you have not yet saved in its own storage on your phone.

How long we keep it

Different records are kept for different lengths of time:

• Account details, training data, nutrition data, calculated results, AI training reviews, Tarnished Lab experiments and subscription records: while your account exists. Ending or cancelling a subscription never deletes them; your account stays readable and exportable.
• When you delete your account: it is locked at once and permanently deleted 7 days later, together with everything listed above. Subscription and payment records (plan, dates, amounts and Razorpay references) are kept afterwards for accounting and payment disputes, with nothing linking them to you. Free trial, security and service records are kept for the periods given in their sections.
• Anything you delete in the app, such as a session, set, bodyweight entry, food diary entry, program, exercise or your profile picture: removed from our database when you delete it.
• Foods and recipes you create and then delete: removed from your lists and from search at once, but kept, unused, while your account exists, and deleted with it.
• Food search counts: 90 days. Daily counts of how many people logged each catalog food: 120 days. Neither is linked to any account.
• Sign-in tokens: kept as hashes until they expire; expired ones are deleted the next time you sign in. Email codes: expire after 10 minutes and are then deleted automatically.
• Security and service records, and free trial records: for the periods listed in those sections, from 90 days to 2 years.
• Records of when you exported your data, used to limit how often exports run: once older than a day, they are deleted the next time you export.
• Cached copies of your training views: up to an hour.
• Copies of data may remain for a limited time in backups kept by our database provider.

Your controls

• Export everything you have tracked, with your AI training reviews, Tarnished Lab experiments and subscription history, as a JSON file from Plan & billing, whatever your plan (up to 5 times an hour and 10 times a day).
• Edit or delete sessions, sets, bodyweight entries, programs and exercises from within the app.
• Edit or delete food diary entries from the last 7 days, edit or delete your own foods and recipes, and change your calorie target at any time. Older diary entries stay in your trends and export but can no longer be changed in the app; email us if you want them removed.
• Change your display name and password, or remove your profile picture, from your profile menu.
• Delete your whole account, and everything in it, from your profile menu on the web or the You tab in the Android app. You confirm with your password. For 7 days you can change your mind by signing in and choosing Restore account; after that the deletion is permanent. You can export your data first.
• For any other request about your data, including if you cannot sign in to delete your account, email [email protected] from your account’s email address.

Contact

Questions about this page: [email protected]