Privacy policy

Last updated: 10 November 2026

Who we are

tectonic plates is run by Stephanie Wilkinson. For anything in this policy, including a request to see or delete your data, write to support@tectonicplates.app.

What we store

Your account. An email address and a bcrypt hash of your password. We never store the password itself and cannot recover it, only reset it.

Your training. Sessions, sets, exercises, loads, rep counts, RPE ratings, training maxes, goals, your plate inventory and bar weight, your time zone, and any notes you write on a session or a movement. This is the substance of the service and the reason to have an account.

Assistant activity. If you connect an AI assistant, we record each call it makes that would change your data, including ones that were refused: which tool, when, whether it succeeded, and the arguments it was given. Calls that only read are not kept there; our server logs note the tool, the time and the outcome of every call, without its arguments. That means the contents of a write (a weight, a rep count, a note) appear in that log. It exists so that a change you did not expect can be traced to the call that made it.

What Withings sends, if you connect it. Only if you connect a Withings account, and only what Withings holds: your weight and body composition (lean mass, fat mass, fat percentage, muscle mass, hydration, bone mass), the heart rate taken with a measurement, how long you slept and over what window, the activities your watch recorded with their heart rate and calories, and the watch’s heart rate over each session you match to one of its recordings. Weights you type into the Withings app are included. We only read from Withings and never write anything back. Disconnecting stops any further reading.

Where you arrived from. When you create an account we record which website or link you arrived from: the referring site’s name only (for example www.reddit.com, never the page or anything you searched for), any ref or utm_source tag on the link, and the first page you opened here. It is held in your session cookie until you sign up, then saved with your account, so we can tell which places people find us through. It is never shared.

Nothing else. We do not ask for your name, date of birth, location or payment details, and we have nowhere to put them.

What we do not do

• We do not sell your data.
• We do not use your training data to train machine-learning models.
• We do not share it with advertisers, and there is no advertising on the service.

Cookies

One session cookie, so that being signed in survives loading the next page, and an optional “remember me” token if you ask to stay signed in. That is all. There is no consent banner because there is nothing to consent to: see Fathom below.

Who else handles it

• Render (United States, Oregon) hosts the app and the database, so it holds everything above.
• Fathom Analytics counts page views, referrers and a few named actions (an account created, a set completed), in aggregate. It is cookieless and builds no profile of you across sites.
• Sentry receives error reports: the exception, where in the code it happened, which tool was running, your account number, and the names (never the values) of the fields involved. It is set up not to send request headers or IP addresses. An error message could in principle contain a value you entered; we do not send them on purpose and do not look for them.
• Resend receives your email address when we send you a confirmation link or a password reset.
• Withings, only if you connect it, receives the access you granted it and our requests to read your data. Nothing from your training is sent to it, and we never write to it.
• Your AI assistant’s operator, if you connect one, handles whatever you say to it and whatever it reads from your account, under its own privacy policy. We see the tool calls it makes, not what you said to it.

How long we keep it

For as long as you have an account, assistant activity logs included. To delete your account and everything in it, write to support@tectonicplates.app.

Your rights

Whatever your jurisdiction gives you, and at minimum: you can ask for a copy of everything we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to support@tectonicplates.app. We will respond within 30 days.

If you are in the UK or EU, the lawful basis for storing your training data is performance of the contract between us (the service does not work without it), and for analytics and error reporting, our legitimate interest in the service working and improving. What Withings sends is health data, which we process only with your explicit consent: you give it by connecting Withings, and you withdraw it by disconnecting, after which nothing more is read.

Where your data lives

On servers in the United States (Oregon). If you are outside the US, using the service means your data is transferred there.

Security

Passwords are hashed with bcrypt and every page is served over HTTPS. Your account is reached either with your password or with a token you granted to an assistant, and you can revoke any of those at any time from your connections page. We are a small operation and cannot promise a breach will never happen. If one does, we will tell affected people by email.

Changes

If this policy changes materially, we will email the address on your account before the change takes effect.