Privacy policy

Last updated 1 August 2026

Reckoner is a strength-training coach: a Garmin watch app, a website, and a server that adapts your programme from what you actually lifted. To do that it holds training and health data about you. This page says exactly what is kept, why, for how long, and how to get it back or have it deleted.

The short version.

Your account is an email address. There is no password; we email a 6-digit code.
We store your training log (sets, reps, weights, RPE, notes, a heart-rate summary) and a small profile (bodyweight, sex, height, date of birth, goal). That is health data, and it is only there because you enter it.
Everything lives in one SQLite database on one server in the EU. It is not sold, not shared, not used for advertising.
If you accept, we use Google Analytics to see which features get used. It sets its own cookies, so it runs only with your consent, carries no advertising, and does not follow you to other sites. It receives no account id, no training data and nothing you type, and that is enforced in the code rather than promised.
Two cookies are set without asking: the sign-in session, and one holding your answer to the analytics banner. Both are set out in full in the cookie policy.
Want it gone? Delete the account yourself on the Account page: it erases everything on the spot. Or email hello@reckoner.fit and we will do it for you.

Who is responsible

Reckoner is operated by Inner Skill Set, registered in the Netherlands with the Kamer van Koophandel under number 75619563, and it is the data controller for the personal data described here. The controller and the server are both in the European Union, so the GDPR applies to all of it.

Contact for anything on this page: access, correction, export, deletion, or a complaint at hello@reckoner.fit.

The terms of service, which set out the agreement this data is processed under, are at reckoner.fit/terms.

What we collect, and why

Account

Your email address, and the date the account was created. Signing in mails you a 6-digit code; the code is stored only as a hash, expires after 10 minutes, is single-use, dies after 5 wrong attempts, and you can request at most 5 codes an hour. A successful sign-in creates a session token, stored only as a hash, and sets one cookie, rk_session, which is HttpOnly, SameSite=Lax, Secure over HTTPS, and lasts 90 days or until you log out. It exists to keep you signed in. It is not used for tracking or profiling. That cookie, and everything else this site keeps in your browser, is listed key by key in the cookie policy.

The early-access waitlist

Reckoner is closed to new accounts right now. If you ask for a sign-in code and you haven't been invited, no account is created, but your email address is kept on a waitlist, with the date you asked and whether you have since been invited. It exists so we can let you in later, and it is used for nothing else. Ask us and we'll take you off it. Signing up does not remove the entry: it stays, marked as invited, alongside your new account. Deleting your account deletes it too.

Paired watches

When you pair a Garmin watch, the watch and the site exchange a short code and the watch receives its own long-lived token (again stored only as a hash). Against it we keep the label the watch sends (for example Garmin epix2), any name you give the device yourself, and the created and last-used timestamps. That is what the Devices page lists so you can recognise and revoke a watch. Device tokens do not expire on a timer; they stay valid until you revoke them on that page.

Athlete profile: health data

If you fill it in: bodyweight, sex, height, date of birth, your goal (cut, maintain or gain) and your preferred unit. These feed two things and nothing else: the calorie and macro targets on the Fuel page, and the strength standards on the Where you stand page. Leave them blank and those pages simply tell you what is missing.

Training data

Every session you log, from the watch or the website, is stored:

the training day and plan week, and per exercise the reps for each set, the weight for each set, your RPE, and whether the exercise was done or skipped;
flags: pain, swap, too hard, or skipped, including the free-text detail you type, and the free-text note you can leave at the end of a session (people describe injuries here, so treat it as health data, because we do);
a heart-rate summary for the session: average and maximum, and whether it came from a chest strap or the watch's wrist optical sensor. It is a summary only; Reckoner does not receive or store a continuous heart-rate stream;
provenance: a session id, start and end timestamps, the device label, the watch app version, and, if your watch app supplies one, the Garmin activity id, a number that lets you find the matching activity in your own Garmin account. We store it; we do not use it to fetch anything from Garmin.

From this the engine builds your history: per-exercise progressions, an estimated one-rep max per lift, and the weekly "what changed and why" log.

Kept only in your browser

The site uses localStorage (not cookies, and never sent to the server) for your light/dark theme choice, a local copy of the profile values above so pages render before the server answers, and, on the Fuel page, your diet preference, allergen filters (nut-free, gluten-free), meal picks and any dishes you build yourself. Meal and diet choices are only in your browser: the server never sees them, and clearing your browser data deletes them for good.

Server logs

The web server in front of the app keeps standard access logs (IP address, timestamp, the URL requested, and the browser's user-agent string) for security and troubleshooting. They rotate on the server's normal schedule and are not used to build any profile of you. The application itself writes no per-request log.

Analytics

If you accept it in the cookie banner, we use Google Analytics 4 to understand which features are actually used, so what gets built next follows behaviour instead of opinion. It sets its own cookies (named in the cookie policy) and loads only after you consent. Google Signals and advertising personalisation are switched off, so this data cannot be joined to an advertising profile or used to follow you to other sites.

What it can see is limited by the code, not by a promise. Every event the site counts goes through a single function, which drops any parameter that is not on a fixed list for that event and rejects any value that is not a number, a true or false, or a member of a fixed set of words. There is no other route to Google. That one rule is what makes it structurally impossible for a name, an email address or anything you typed to leave the page, and it is why the list below is a description of the software rather than an undertaking about our conduct.

What Google receives:

which page or screen you opened, as a plain word or a fixed address;
that a feature was used, as one of a fixed list of event names;
your browser and device type;
your IP address, which Google truncates, uses to derive an approximate location, and does not pass on to us.

What it never receives, on any of our analytics:

No account id of any kind. Not your email, not a hash of it, not a session token, not a number standing in for you. Until this page was last updated we did send your numeric account id as Google Analytics' User-ID. We stopped, and nothing replaced it, which means signed-in visits no longer join up over time. That is a real cost and it was accepted deliberately.
No training data. No loads, reps, RPE, one-rep-max estimates or tonnage; no bodyweight, body fat, height, age or sex. That a feature was used is counted; what you entered into it is not.
No free text. Nothing you write, in a note, a flag or a form, reaches an event.
No page titles from the signed-in app, since a title could carry a display name. The app sends a plain word for the screen instead.
Nothing identifying in an address. Query strings are stripped whole rather than filtered, and any address with a person in it is rewritten before it is sent.
No raw counts. Numbers are grouped first, even harmless ones: a session with five lifts is counted as "4 to 6".

One consequence is worth stating plainly, because it cuts the other way too. Because we send nothing that identifies you, there is nothing in Google Analytics keyed to you, and so deleting your account cannot delete anything there: there is nothing to find. We would rather say that than promise a deletion we could not carry out. Deletion of everything we do hold about you is covered under Your rights below.

You can withdraw consent at any time from the cookie policy page, which stops the analytics and clears its cookies. If you reject, or if your browser sends a Do Not Track or Global Privacy Control signal, none of it loads at all, and nothing runs quietly in its place. Google is a processor for this, acting on our instructions; details are in the third-parties section below, and the full cookie picture is in the cookie policy.

What we do not do

No advertising networks, no advertising identifiers, and no ad targeting. The one analytics tool we run is Google Analytics, only with your consent, described under Analytics above, and it carries nothing to any advertiser.
No selling, renting or sharing of your data with anyone. There are no data brokers involved.
No advertising or cross-site tracking cookies. The two cookies set without asking are the functional sign-in session and the record of your analytics answer, both described in the cookie policy; the analytics cookies are set only if you accept them.
No location data, no continuous heart-rate stream, no contacts, no photos.
We never ask for, receive or store your Garmin Connect password, and Reckoner does not read your Garmin Connect account. The watch app talks only to reckoner.fit, authenticated with the device token you granted it when you paired it.

Legal basis

Data	Why	Legal basis
Email, session, device tokens	To give you an account, keep you signed in, and let a watch you paired talk to the server	Performance of a contract, Art. 6(1)(b)
Waitlist email	To let you into early access when a place opens, after you asked for one	Steps taken at your request before entering a contract, Art. 6(1)(b)
Training log, plan, history	The service itself: storing what you lifted and adapting next week from it	Performance of a contract, Art. 6(1)(b)
Bodyweight, sex, height, date of birth, heart rate, pain and injury notes	Health-related data you choose to enter so the coach can set loads, targets and standards for you	Your explicit consent, Art. 9(2)(a), withdrawable at any time
Server access logs	Keeping the service up and secure	Legitimate interests, Art. 6(1)(f)
Analytics (page and event data, IP address; no account id)	Understanding how the site is used so it can be improved	Your consent, Art. 6(1)(a), given in the cookie banner and withdrawable at any time

Withdrawing consent for the health data means clearing those profile fields, or asking us to delete the account. It does not affect processing already carried out.

Automated adaptation

Reckoner automatically changes next week's numbers based on the sets, RPE and flags you logged. That is the product, and every change is explained in the weekly log. It produces no legal or similarly significant effect. When you leave a note, or flag pain or an exercise swap, the day is deliberately not auto-progressed: it is held aside for a person to rewrite. Your data is not sent to any third-party service for that review.

Where it is stored, and who else touches it

All account, profile and training data lives in a single SQLite database on one server rented from OVH in the EU. Each account's state is isolated by user id. Deployments push code to that server and explicitly never transfer the database, so your data does not travel to a developer machine as part of shipping a release.

Three third parties are involved, each narrowly:

OVH: hosting provider for the server in the EU. They hold the machine the data sits on.
Resend (Resend, Inc., United States): delivers the sign-in emails. Your email address and the one-time code are passed to them for that purpose only. This is a transfer of your email address outside the EU.
Google (Google Ireland Limited): runs Google Analytics, as our processor and on our instructions, but only for visitors who accept it. It receives page and event data and your IP address, and it sets analytics cookies in your browser. It receives no account id and no training data. Google may process some of this outside the EU under its standard data-transfer safeguards.

Two things can be loaded from outside reckoner.fit. Once you accept analytics, the Google tag is fetched from googletagmanager.com on every page except the three policy pages, the admin console and our own internal pages, so it never loads here at all. The second is an icon font from the public CDN cdn.jsdelivr.net, which the app draws the glyphs in its menus with. Signed out, this privacy page loads nothing from anywhere but reckoner.fit. Signed in, the top bar carries your account menu, and its glyphs come from that font, so your browser fetches it here as it already does on every other page of the app. Your browser's IP address is visible to each of them when it fetches their file, and the font CDN receives nothing else about you.

How long it is kept

Account, profile and training history: for as long as the account exists. Nothing is deleted automatically; it is your log and it is meant to be long-lived.
Waitlist entries: until you ask to be removed, or until an account made from that address is deleted, which takes the waitlist entry with it. Signing up does not by itself clear the entry: it stays, marked as invited, so we can tell who has taken up a place.
Sign-in codes: 10 minutes, and deleted the moment they are used.
Sessions: 90 days, or immediately when you log out.
Pairing codes: 5 to 10 minutes, single-use, deleted once the watch has its token.
Device tokens: until you revoke the device.
Server access logs: until the server's standard log rotation removes them.

Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, withdraw consent, and receive it in a portable format. You also have the right to complain to a data protection authority: your own national one, or ours, which is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). Telling us first is welcome but it is not a precondition, and you never have to go through us to reach them.

See and export your data. Signed in, the site's own JSON endpoints return it directly in your browser: /athlete, /plan/current, /history, /session/week, /week/changelog and /auth/devices. That is machine-readable JSON, the portable format. Or email us and we will send the full export.
Correct it. Profile values are editable on the Fuel and Where you stand pages; a device can be renamed on the Devices page.
Revoke a watch. Devices page; revoking deletes that device's token immediately.
Delete everything. Signed in, the Account page lets you do it yourself: type your own email address to confirm, and the account, the profile, the entire training history, every paired watch's token and your entry on the early-access waitlist are removed from the database immediately, not queued, not hidden, and with no backup to restore them from. Taking the waitlist entry too means your address is genuinely gone, at the cost of your place: getting back in means asking again. It happens while you wait, all of it or none of it, and signs you out. If you would rather we did it, email hello@reckoner.fit from your account address and we will run the same deletion, within 30 days and normally much sooner. We will confirm when it is done.

Security

Sign-in codes, session tokens and device tokens are never stored in readable form, only as SHA-256 hashes, so a copy of the database does not hand someone your sessions. The site is served over HTTPS only, and the session cookie is HttpOnly, Secure and SameSite=Lax. Each account's state is isolated per user id, and every request must present a valid session cookie or device token before any of it is returned. No system is perfect; if you believe something is wrong, tell us at hello@reckoner.fit.

Children

Reckoner is not intended for anyone under 13, and we do not knowingly hold data about children. Onboarding asks for a date of birth and refuses to build a program for anyone below that age. In some countries a person under 16 cannot give the explicit consent the health data above relies on without a parent or guardian, so if that is your situation, get it before filling in the profile. If you believe a child has an account, email us and we will remove it.

Not medical advice

Training loads, calorie targets and strength standards produced by Reckoner are approximate and evidence-informed, a starting point to adapt, not a medical or dietary prescription, and not a diagnosis.

Changes

If this policy changes, the date at the top changes with it, and material changes will be announced in the app. The current version is always at https://reckoner.fit/privacy.