Privacy Policy

This policy explains what armstats ("we") collects when you use armstats.com, what other people can see, who processes the data for us, and your choices. Questions: hello@armstats.com.

What we collect

• Account: your email address and password. Passwords are stored only as a secure hash; we cannot read them.
• Profile: display name, gender and, if you add them, body stats: height, bodyweight and wrist, forearm, bicep and palm measurements.
• Clans: clans you create or join (tag, full name, members) and invites you send or receive.
• Lifts: exercise, bodyweight, weight lifted, optional notes, the time you logged it, and the weight class, percentile and rank we calculate from it.
• Technical data: sign-in times and the IP address and browser details that reach our servers with each request, as recorded by our hosting and database providers.
• Messages: anything you send to hello@armstats.com.

What other people can see

Leaderboards and lifter profiles are public. Anyone, signed in or not, can see your display name, gender, and each non-flagged lift with its bodyweight, weight class, percentile, date and notes. Don't put anything in a note you wouldn't post publicly. Your clan, its members and its full name are public too.

Body stats you add (height, bodyweight and arm measurements) are public: sharing them is what armstats is for, and they may be used for measurement rankings. Leave a field empty if you don't want to share it. The bodyweight, height and arm measurements on your profile are visible to anyone, signed in or not, including your past measurements, your previous bodyweight and when you last changed it.

Not public: your email address, clan invites and join requests, and flagged lifts. Admins can see these to run the site and review flagged lifts.

How we use it

• To run your account: sign-in, email confirmation and password resets.
• To calculate percentiles, ranks and leaderboards from logged lifts.
• To keep the rankings honest and the site safe: flagging outlier lifts, the one-lift-a-day limit per exercise, and blocking automated sign-ups.
• To answer your messages.

We show no ads and never sell or rent your data or share it for advertising. To see how much the site is used, we use Cloudflare Web Analytics: it counts page views and basic visit details (such as page, referring site, country and device type) without cookies, and doesn't build a profile of you or follow you across other sites.

On the Rank your lift page we also count anonymous steps (a visit, a lift checked, a share or sign-up started) with the lift, the rank and which of our videos linked you there. These counts hold no account, IP address or weights. The lift you check stays in your browser (local storage) so it can fill in Log a Lift if you sign up.

Who processes it for us

• Supabase stores the database and handles accounts and sign-in.
• Cloudflare hosts the website, runs Turnstile (the check that blocks automated sign-ups, using signals from your browser to tell people from bots), and provides Web Analytics (cookie-free page-view counts).
• Resend sends account emails such as confirmations and password resets.
• YouTube (Google) and Dailymotion host the form reference videos. Nothing loads from them until you press play; once you do, that host's player receives the usual request data under its own privacy policy.

These providers process data only to provide their service to us and may do so in the United States and other countries.

Cookies and browser storage

We store two things in your browser: your sign-in session, so you stay signed in, and your kg/lb choice. Cloudflare Turnstile may store data it needs to detect bots. Cloudflare Web Analytics uses no cookies. We use no advertising or tracking cookies.

How long we keep it

We keep one current lift per exercise: logging a new lift deletes your previous lift for that exercise. We keep your account and lifts until you ask us to delete them. When you do, we delete your account, profile and lifts within 30 days. Our providers may keep technical logs for a short period under their own policies.

Your choices and rights

• Correct: change or clear your display name, gender and body stats on Edit profile.
• Delete: email hello@armstats.com from your account's address to delete your account and all its lifts.
• Access or copy: email us for a copy of your data.

Depending on where you live (for example the EU, UK or California), you may have further rights, such as to object to processing or to complain to your data protection authority. We don't sell or share personal information as defined by California law. Our reasons for processing are providing the service you signed up for and our legitimate interest in keeping it fair and secure.

Age

armstats is not for children. You must be at least 13 to create an account, or 16 in the EU and UK. If you believe a child has signed up, email us and we'll delete the account.

Security

Data travels over HTTPS, passwords are hashed, and database rules limit each account to its own private data. No system is perfectly secure; tell us at hello@armstats.com if you find a problem.

YouTube API Services

armstats Publisher, our internal posting tool, uses YouTube API Services to upload our own videos to the armstats YouTube channel. It only connects to channels we own, and the only YouTube data it stores is the channel's access token, name and avatar, used to schedule and publish those uploads. By using this feature you also agree to the YouTube Terms of Service, and Google's handling of the data is covered by the Google Privacy Policy. You can revoke the tool's access at any time from your Google security settings; we then delete the stored token within 7 days, or sooner if you email hello@armstats.com.

Changes

If we change this policy we'll update the date above, and for significant changes we'll tell signed-up users by email or on the site.