Privacy Policy

Last updated: July 20, 2026

RavenForge Solutions LLC ("we," "us," or "our") operates the NextSet mobile application and the website nextsettrainer.com (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address and password. Your password is hashed before storage and is never stored in plain text.

1.2 Profile Information

To personalize your workout plans, we collect information you provide during onboarding and in your settings:

• Name, age, birthday, and gender
• Height and weight
• Fitness goals and training preferences
• Sport and position (if applicable)
• Gym type and available equipment
• Training days and preferred workout split

1.3 Health and Fitness Data (Sensitive Data)

We collect data that may be considered sensitive under applicable privacy laws, including:

• Injuries and physical limitations
• Workout logs (exercises performed, weights, repetitions, sets, dates)
• Body metrics (height, weight)
• Personal records and performance history
• Fitness condition and experience level

We treat this data as sensitive personal data and process it only with your consent, which you provide when you create your account and agree to this Privacy Policy. You may withdraw your consent at any time by deleting your account.

1.4 Subscription and Billing Data

If you subscribe to a paid plan, your payment is processed by Apple (App Store) or Google (Google Play). We receive a record of your subscription status and tier (e.g., trial, standard, pro) but we do not receive or store your credit card number, bank account, or full payment details.

1.5 Crash and Error Reports

We use Sentry for crash reporting. If the app crashes, Sentry collects technical diagnostic data such as device type, operating system version, an app installation identifier (see Section 1.6), stack traces, and error messages. Sentry does not collect your name, email, workout data, or health information.

1.6 App Installation Identifiers

Three of our service providers use a randomly generated identifier for your installation of the app. These identifiers are generated by software, not assigned to you by your device or its operating system:

• Expo: sent when the app checks for updates.
• Sentry: included with crash reports.
• RevenueCat: used to manage your subscription.

These identifiers are random and apply only to your installation of NextSet. They are not advertising identifiers, and they are not used for advertising, for tracking you across other apps or websites, or for fraud prevention. We do not store these identifiers in our own database.

1.7 Information We Do NOT Collect

NextSet does not collect or access:

• Location data (GPS, IP-based geolocation, or cell tower data)
• Contacts or address book
• Photos, camera, or microphone
• Browsing history
• Advertising identifiers

2. How We Use Your Information

We use your information for the following purposes:

• Account management: to create and maintain your account, authenticate you, and manage your subscription status.
• AI-powered plan generation: to send relevant profile and training data to our AI provider (Anthropic) for generating personalized workout plans (see Section 3).
• AI coaching: to provide personalized coaching responses, exercise swaps, and training guidance through the in-app chat.
• Workout logging: to record your workouts, track progress, detect personal records, and inform future plan generation.
• Service improvement: to identify and fix bugs and crashes using Sentry's crash reports.
• Communication: to send you transactional emails related to your account (e.g., password resets, subscription confirmations). We do not send marketing emails.

We do not use your data for advertising, targeted marketing, profiling for purposes unrelated to the Service, or any purpose not disclosed in this policy.

3. AI-Powered Features and Data Processing

3.1 What Data Is Sent to Our AI Provider

To generate your workout plans and coaching responses, we send the following data to Anthropic via the Claude API:

• Your fitness goals, sport, and position
• Training preferences (days per week, workout split, session length)
• Gym type and available equipment
• Injuries and physical limitations
• Recent workout history (exercises, weights, performance trends)
• Your name
• Age, gender, height, weight, and experience level

We do not send your email address, password, or account credentials to Anthropic.

3.2 How the AI Provider Handles Your Data

Anthropic processes your data solely to generate responses for NextSet. Under Anthropic's commercial API terms:

• Anthropic does not use API inputs or outputs to train its AI models.
• API conversation content (prompts and responses) is retained by Anthropic on its backend for up to 30 days and then deleted. It is not used to train AI models.
• If a prompt is flagged by Anthropic's automated trust and safety systems, the flagged inputs and outputs may be retained for up to 2 years, and the associated trust and safety classification scores for up to 7 years.

Anthropic acts as our data processor. We maintain a data processing agreement with Anthropic that includes confidentiality, data security, and deletion obligations.

3.3 LLM Training Disclosure

As required by Connecticut law (Public Act 25-113, effective July 1, 2026): We do not collect, use, or sell personal data to train large language models (LLMs). The AI provider (Anthropic) does not use data submitted through its commercial API to train its models.

3.4 AI Content Disclaimer

AI-generated workout plans and coaching responses may contain errors or recommendations that are not appropriate for your individual circumstances. AI-generated content is not reviewed by a licensed medical or fitness professional. See our Terms of Service for important health and safety disclaimers.

4. Service Providers (Subprocessors)

We share your data only with the following service providers, each of which acts as a data processor on our behalf:

Provider	Purpose	Data Accessed
Supabase	Cloud database, authentication, and hosting (US servers)	All account and app data
Railway	Application server hosting (processes requests between the app and our AI provider)	Profile, workout, and health data in transit; server logs
Anthropic	AI plan generation and coaching (Claude API)	Profile, training preferences, workout history, health data, name (no email or password)
Sentry	Crash reporting and error monitoring	Device type, OS version, app installation identifier, crash logs (no personal or health data)
RevenueCat	Subscription management and billing (when active)	Subscription status, purchase history, account user ID, app installation identifier
Expo	Over-the-air app updates	App installation identifier, app version, platform
Apple / Google	App distribution, in-app purchase processing	Subscription status (payment is processed by Apple or Google; we do not receive card or bank details)

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertisers. Our service providers process your data only on our instructions and are bound by contractual confidentiality and data protection obligations.

5. Data Storage and Security

Your data is stored in Supabase's cloud infrastructure located in the United States. We implement the following security measures:

• All data is encrypted in transit using TLS/HTTPS.
• Data is encrypted at rest in Supabase's infrastructure.
• Passwords are cryptographically hashed before storage.
• Row-level security (RLS) policies restrict database access so users can only access their own data.
• API requests are authenticated using JSON Web Tokens (JWT).
• Server-side rate limiting protects against abuse.

No method of transmission or storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your data as follows:

• Account and profile data: retained for as long as your account is active. Deleted immediately from our database when you delete your account.
• Workout logs and plans: retained for as long as your account is active. Deleted immediately from our database when you delete your account.
• Crash reports (Sentry): retained by Sentry per their standard retention policy (typically 90 days).
• Subscription records: your subscription record in our database is deleted when you delete your account. Apple, Google, and RevenueCat may independently retain purchase and transaction records as required by their own policies and applicable tax and accounting law.
• Backup copies: our database backups are retained on a rolling 7-day cycle, so backup copies containing your data are purged within 7 days of account deletion.
• Anonymized or aggregated data: may be retained indefinitely in a form that cannot identify you.

7. Your Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

7.1 All Users

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate data. You can also update most information directly in the app's Settings.
• Deletion: request deletion of your account and personal data. You can initiate this in the app (Settings > Account & Data > Delete Account) or via our account deletion page.
• Portability: request your data in a structured, machine-readable format.
• Withdraw consent: withdraw your consent to the processing of sensitive/health data at any time. Withdrawal may require account deletion, as this data is necessary for the Service to function.

7.2 Connecticut Residents (CTDPA)

If you are a Connecticut resident, the Connecticut Data Privacy Act (CGS §§ 42-515 to 42-525) provides you with additional rights:

• Right to confirm whether we are processing your personal data and to access that data.
• Right to correct inaccuracies in your personal data.
• Right to delete your personal data.
• Right to obtain a portable copy of your personal data.
• Right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of any automated decision that produces a legal or similarly significant effect. We do not sell your data, engage in targeted advertising, or make automated decisions that produce legal or similarly significant effects about you. Generating a workout plan is not such a decision.
• Right to know what inferences have been drawn from your data.
• Right to obtain a list of the third parties to which we have sold your personal data. We have never sold personal data to any third party, so this list is empty.
• Where personal data has been processed for profiling in furtherance of an automated decision producing a legal or similarly significant effect: the right to question the result, to be informed of the reason the profiling produced that decision, and to review the personal data used. We do not make such decisions, so these rights do not currently arise.
• Right to withdraw consent to our processing of your sensitive data. Where you withdraw consent, we will cease the relevant processing as soon as practicable and no later than 15 days after receiving your request.

We will respond to verified requests within 45 days. If we need additional time, we will notify you within that first 45-day period, explain why, and may extend the response period by up to 45 additional days. If we decline a request, we will tell you why and explain how to appeal; you may appeal by replying to our decision or writing to privacy@nextsettrainer.com with "Appeal" in the subject line. We will respond to appeals in writing within 60 days. If your appeal is denied, you may file a complaint with the Connecticut Attorney General at portal.ct.gov/AG.

We honor Global Privacy Control (GPC) signals as opt-out-of-sale/targeted-advertising requests where applicable.

7.3 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) may provide you with additional rights. We make the following disclosures:

• Categories of personal information collected: identifiers (name, email, app installation identifiers), personal characteristics (age, gender, height, weight), health information (injuries, fitness data, workout logs), commercial information (subscription status), and internet/electronic activity (crash logs).
• We do not sell or share your personal information as defined by the CCPA/CPRA.
• We do not use or disclose sensitive personal information for purposes other than providing the Service.
• You have the right to know, delete, correct, and opt out. We will not discriminate against you for exercising these rights.

7.4 European Economic Area and United Kingdom (GDPR)

If you are located in the EEA or UK, the following applies:

• Data controller: RavenForge Solutions LLC, Connecticut, United States.
• Legal bases: we process your data based on (a) your consent for sensitive/health data, (b) performance of a contract for account and service data, and (c) our legitimate interests for crash reporting and service improvement.
• International transfers: your data is stored and processed in the United States. By using the Service, you consent to this transfer. We rely on standard contractual clauses or other approved transfer mechanisms where required.
• Your rights: access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint with your local supervisory authority.

7.5 How to Exercise Your Rights

To make a privacy rights request, contact us at privacy@nextsettrainer.com. Include "Privacy Rights Request" in the subject line and specify which right(s) you wish to exercise. We may need to verify your identity before processing your request.

8. Children's Privacy

NextSet is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from individuals under 18. If you are under 18, do not use the Service or provide any personal information.

If we learn that we have collected personal data from a person under 18, we will delete that data promptly. If you believe a child under 18 has provided us with personal information, please contact us at privacy@nextsettrainer.com.

9. "Do Not Sell or Share" Disclosure

We do not sell your personal data. We do not share your personal data with third parties for their own commercial or marketing purposes. We do not engage in targeted advertising. We have never sold personal data and have no plans to do so.

10. Cookies and Tracking Technologies

The NextSet mobile app does not use cookies or web-based tracking technologies. The nextsettrainer.com website may use essential cookies for basic functionality (e.g., session management) but does not use analytics cookies, advertising cookies, or tracking pixels.

11. Data Breach Notification

In the event of a data breach involving your personal information, we will notify you and the appropriate authorities as required by law. Under Connecticut law (CGS § 36a-701b), we will provide notice within 60 days of discovering a breach. Notification will include the nature of the breach, the types of data involved, and steps you can take to protect yourself.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and may notify you via email or an in-app notification. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:

RavenForge Solutions LLC
Email: privacy@nextsettrainer.com
Website: nextsettrainer.com