Perside Privacy Policy

The short version

• You sign in with an email link. Your email address is the only identifier Perside collects. There are no passwords, no social logins, no payments, no ads, no analytics services, and no tracking scripts.
• Everything else Perside stores is training data you enter yourself: your equipment, your programs, your logged sets, and optional fields like effort ratings, a pain flag, and free-text notes.
• Four outside companies touch this data: Vercel (hosting), Supabase (database, in Canada), Resend (sends the sign-in emails), and Sentry (automatic crash reports, with your content stripped out before anything is sent).
• I do not sell your data. I do not share it for advertising. Nobody profiles you.
• There is no self-service delete button yet. Deletion and export are handled by hand: email me and I will complete your request within 30 days.

What Perside stores about you

Your account. Your email address, the date your account was created, the date your email was verified, and a random internal user ID. The database has columns for a name and a profile photo, but Perside never asks for them and never fills them in. They stay empty.

Your training setup. The implements you own (types and weights), the movements you have told the app you are proficient in, and the names you give your programs.

Your training log. For each session: the sets, reps, and weights the engine prescribed, what you actually completed, the weight lifted, how long the session took, and the date. Perside also keeps every planned training day, including days you rescheduled or skipped. Taken together, these records show when you trained and when you did not.

Optional fields you may choose to fill in. These are the most personal things Perside holds, so I want to be specific:

• An effort rating (RPE) from 1 to 10 for how hard a set felt.
• A pain checkbox. If you flag pain during a session while your cycle is in manual mode, the app stores a short internal note that the pain flag was set. That note is kept until your next logged session, then replaced.
• A free-text session note, stored exactly as you write it. Please do not put medical information, diagnoses, or anything else sensitive in this field. It is meant for training notes like "grip slipped on set 3."
• Benchmark test results and sizing test results (sets of five per side, taken to failure) used to calibrate your programming.

One onboarding record. When you sign up, Perside records whether you took the "guided" or "veteran" onboarding path. This is stored permanently. No product feature reads it. I keep it so I can see, in aggregate, which signup path people take. That is the only measurement of this kind in the app.

What Perside collects without you typing it

• Your IP address, hashed. When you request a sign-in link, your IP address is run through a one-way SHA-256 hash and only the hash is stored, as part of rate limiting. The rate limiter only checks whether two values match, so it never needs the address itself, and the stored hash is never read back. A hash of an IPv4 address is pseudonymous rather than fully anonymous: it is short enough that a determined party holding the hash could brute-force it, so I am not overclaiming here.
• A trace of sign-in requests that never became accounts. If you enter an email address to request a sign-in link and never finish creating an account, Perside keeps a one-way hash of that address in its rate-limiting records, plus the unused sign-in token, which holds your address in readable form until it expires and is swept. The raw address is not otherwise stored. If you want these removed, email support@getperside.com: I can delete the hashed email record and the token. I cannot delete the per-IP rate-limiting hash, because it is not linked to your email and may cover other people on the same network; it clears on its own after 24 hours of no use.
• Timestamps. Most records carry creation and update times. As noted above, these can reconstruct your training schedule.

Perside does not collect device fingerprints, location data (beyond what an IP address implies), contacts, photos, or anything from other apps or sites.

A plain note about health-related data

Some of what you can log in Perside describes your body and how it feels: effort ratings, the pain flag, tests taken to muscular failure, and anything you choose to write in a note. Depending on where you live, the law may treat some of this as health data. Rather than argue about labels, here is the position:

• Every one of these fields is optional. You choose whether to log them.
• They are used for exactly one purpose: adjusting your own training program. Nothing else reads them.
• They are never sold, never shared for advertising, and never sent to anyone except the infrastructure providers listed below, who store or transmit them on my behalf.
• Perside is not a medical service and I am not a clinician. Do not use the notes field as a symptom diary. If you have logged something you regret, email me and I will remove it.

Cookies and local storage

Perside sets no analytics or advertising cookies. None. The complete list of what it puts on your device:

Because there is no cross-site tracking of any kind, browser signals like Do Not Track and Global Privacy Control do not change anything: there is no tracking for them to turn off, and no sale or sharing for them to opt you out of.

The only third parties that touch your data

1. Vercel (United States) hosts the app. Because Vercel terminates the secure connection, it can technically see all requests: page bodies, headers, and cookies. It also receives server error logs.
2. Supabase runs the Postgres database that holds everything described in this policy. The database lives in the AWS Canada Central region in Montreal, Quebec, Canada.
3. Resend delivers sign-in emails. It receives only three things: your email address, the subject line "Your Perside sign-in link", and the message body, which contains a live single-use sign-in link. It never receives any training data. Treat that email carefully: anyone who can read it while the link is fresh can sign in as you.
4. Sentry receives automatic error and crash reports when something breaks: stack traces and technical diagnostics, so I find out about failures without waiting to be told. It is configured to strip personal content before anything is sent, and it is set to collect crash reports only, with no performance or usage monitoring. It never receives your training data, session notes, effort ratings, pain flags, email address, or IP address. Reports are linked to an internal user ID, not to you by name.

That is the complete list. Perside makes no other outbound network calls: no analytics provider, no payment processor, no ad network, and nothing that tracks you across sites.

Where your data lives, and cross-border transfers

Perside is operated from the United States, but the database is in Canada. If you are in the US, this means your data is stored outside the US. If you are in the European Economic Area or the UK, your data is transferred to the US (Vercel for hosting, and Sentry for crash reports) and to Canada (Supabase for the database). The European Commission has recognized Canada as providing adequate protection, but only partially: the decision covers commercial organizations subject to Canada's federal private-sector privacy law (PIPEDA). For transfers not covered by an adequacy decision, I rely on the data processing agreements offered by these providers, which incorporate the European Commission's standard contractual clauses.

How your data is used

• To run the app: computing your programs, logging your sessions, keeping you signed in.
• To protect the sign-in system from abuse (rate limiting by IP and email).
• To understand, in aggregate, which onboarding path new users take.

That is the whole list. If you are in the EEA or UK, the legal bases are: performance of our contract (your account and training data), legitimate interest (rate limiting and security), and your consent for the optional fields described above. Every account confirms, by ticking a box, that they understand training data is stored including effort ratings, pain flags, and notes, and the date and time of that agreement is recorded. Existing accounts are asked the same thing the next time they open a page that shows their data. That consent is not a substitute for judgment: I still ask you to keep medical information out of the app, which is not built to be a medical record.

How long data is kept

Honestly: your account and training data are kept until you ask me to delete them. There is no automatic expiry on them today.

Rate-limiting records and expired sign-in tokens are swept whenever someone requests a sign-in link: records past their window and expired tokens are deleted then. Because that sweep is triggered by sign-in traffic rather than a fixed schedule, a record created just before a quiet stretch can outlive its cutoff until the next sign-in request arrives. The onboarding cookie expires after 48 hours, the session cookie after 30 days, and each sign-in token is deleted the moment it is used.

Deletion, export, and your rights

There is no delete-account or export button in the app yet. Both are done by hand. Email support@getperside.com from the address on your account and tell me what you want:

• Deletion. I will delete your account and all associated records, including rate-limiting entries tied to your email, within 30 days, and confirm by email.
• Export. I will send you a machine-readable copy of your data within 30 days.
• Correction or access. Same address, same 30 days.

I honor these requests from anyone, anywhere, regardless of whether a particular law requires it. If you are in the EEA or UK you also have the right to object to or restrict processing and to complain to your local supervisory authority. If you are a California resident, you will not be discriminated against for exercising any request, and Perside does not sell or share personal information as those terms are defined in California law.

Security

Data is encrypted in transit. Separation between users is enforced by the application code. The database is hosted by Supabase and is reachable over the internet by anyone holding its credentials; those credentials are held only by me and by the deployed app. To be precise, Perside does not use database-level row security, because the app's database role would bypass it anyway; the isolation guarantee lives in the application layer. No system run by one person, or by anyone, is perfectly secure, and I will not pretend otherwise. If I learn of a breach affecting your data, I will notify you as the law requires.

Children

Perside is for adults. You must be 18 or older to use it, and I do not knowingly collect data from anyone under 18. If you believe a minor has an account, email me and I will delete it.

Changes to this policy

If this policy changes in a way that matters, I will update the date at the top and, for significant changes, note it in the app or by email. The current version always lives at https://getperside.com.

Contact

William Ye, doing business as PerSide
Pennsylvania, United States
support@getperside.com