Privacy Policy
Zor ("the app", "we", "us") is a strength-training app: it helps you follow a structured training program, log your workouts, and track your recovery. This policy explains what data the app collects, why, where it is stored, and how you can delete it. We have tried to write it in plain language.
The app and this website are operated under the name Zor, and the data controller for the data described here is reachable at support@zor.training.
The short version
- We collect your email address (to create your account) and the training and wellness data you enter (workouts, bodyweight, sleep/soreness ratings, and similar).
- We use this data for one purpose: to run the app for you, showing your program, your history, and your recovery trends.
- We do not use third-party analytics or advertising trackers, and we do not sell your data. Ever.
- Heart-rate data (from a Bluetooth device, Apple Health, or Health Connect on Android) is optional, used only for cardio sessions, asked for with your explicit consent, and can be turned off and deleted at any time.
- Deleting your account deletes your data.
Data we collect
Account data
- Email address and password. You sign up with an email address and password. Authentication is handled by our cloud database & authentication provider; your password is processed and stored (in hashed form) by that provider's authentication service and is never seen by our own application servers.
- A short numeric code is emailed to you to confirm your address at sign-up.
- Sign in with Google or Sign in with Apple (optional). You can create your account or sign in with Google or Apple instead of an email and password. If you choose one, that provider handles the sign-in and learns that you use Zor. In return we receive only your name and email address (for Apple, an address you can choose to hide, in which case Apple relays your mail through a private address). We never receive your password, contacts, files, or activity from them, and we do not post anything back to your Google or Apple account.
Profile data (entered during onboarding, editable later)
- Your training goal (building muscle, strength and powerlifting, training for a sport, or general fitness) and an optional goal end date (e.g. a competition date).
- How long you have been weight training and whether you have used RPE (a training intensity scale) before.
- Bodyweight at sign-up (optional).
- Optional preference fields: gender (male/female, or leave unset; unset means "prefer not to say"), height, an intensity-vs-volume training preference, your target session length, training days per week, and how busy your gym usually is (quiet / moderate / busy), which we use only to decide whether we can pair exercises back to back to save you time.
Training and wellness data (entered as you use the app)
- Training programs you create or that the app generates for you (blocks, weeks, training days, exercises, target sets/reps/RPE), and any custom exercises you add to your library (their names and details).
- Logged sets: for every working set you record: the exercise, date and time, weight lifted, reps completed, and your reported RPE (perceived effort).
- Workout sessions: when a session started and ended, its duration, and the session difficulty rating (1 easy – hard) you give at the end.
- Daily check-ins: your bodyweight, and 1–5 ratings for yesterday's nutrition, last night's sleep, how strong you feel, your readiness to train, and per-muscle soreness across 15 muscle groups.
- Derived values we compute from the above, such as estimated one-rep-max strength figures and recovery/training-load metrics. These are calculated from your own data only.
This is health-and-fitness data and we treat it as sensitive: it is used only to provide the app's features to you, it is visible only to you (there are no social or sharing features), and it is protected by the security measures below.
Heart-rate data (optional, for cardio sessions)
If you use the app's paid cardio features and choose to connect a heart-rate source, the app reads your heart rate during a cardio session. There are three ways to connect one, and all of them are optional and stay off until you turn them on:
- A Bluetooth heart-rate device (for example a chest strap): the app reads the live heart-rate signal it broadcasts while you train.
- Apple Health (HealthKit): with your permission, the app reads the heart-rate samples recorded during your cardio session. That can be live from an Apple Watch workout, or afterwards from samples another device (for example a fitness tracker) has written to Apple Health. We only ever read heart rate, and only for the time window of your session. We do not read any other Apple Health data, and we never write anything back to Apple Health.
- Health Connect (Android): with your permission, the app reads the heart-rate records your watch or fitness tracker has synced into Google Health Connect. That can be while you train, or afterwards for the time window of your session. We ask Health Connect for read access to heart rate only, and we only read the time window of your session. We do not read any other Health Connect data, and we never write anything back to Health Connect. You need the Google Health Connect app on your phone with a watch or fitness app syncing heart rate into it.
For a cardio session with heart rate, we store on our servers: the average and maximum heart rate for the session, a heart-rate reading roughly once per minute across the session, and which kind of source it came from. We use this only to measure how hard the session was and to make your recovery and training-load figures more accurate. We do not store a second-by-second stream, and we do not collect location, route, or GPS data.
This is health data and we treat it with extra care. Your heart-rate data is never used for advertising or marketing, never sold, and never shared with third parties or data brokers, and we do not store it in iCloud or any other consumer cloud service. It is kept on our own servers, attached only to your account, and used only to run the app's features for you.
It is optional, and you can turn it off at any time. You can disconnect a heart-rate source in the app, and you can revoke the app's access to Apple Health whenever you like, in the iPhone Settings app under Privacy & Security, then Health, or in the Apple Health app itself. On Android you can withdraw the app's access in the Google Health Connect app, under its app-permissions settings. The cardio features work fully without heart rate. You can also delete the heart-rate data we hold without deleting the rest of your account (see deleting your data, below).
Consent. Because heart-rate data is a special category of personal data under laws such as the UK and EU GDPR, we ask for your explicit consent in the app before the first time we store any heart-rate data. You can withdraw that consent at any time by disconnecting the source and deleting the data. Withdrawing consent does not affect anything we did while the consent was in place.
Product-interaction data (in-app choices)
To understand whether the app's features are actually helping, we keep a record of certain prompts the app showed you and how you responded. For example, when the app suggests an adjustment to your training, we record that it was shown and whether you accepted it or chose something else. This is a first-party record: it is linked to your account, kept on our own servers, and used only to improve the app for everyone. We do not use a third-party analytics service for it, we do not use it for advertising, and it is deleted with your account.
Diagnostic data (crash and error reports)
When the app hits an error or crashes, it sends us a diagnostic report so we can find and fix the problem. A report contains technical details about the failure: the error and where in the app it happened (including a technical stack trace), the app version and build, your device platform and operating-system version, and the time it happened. It is linked to your account so we can tell whether a problem is affecting one person or many. We use it only to diagnose and fix problems, never for advertising, and it is deleted with your account. These reports go to our own servers, not to a third-party crash-reporting service.
Data we do NOT collect
- No third-party analytics SDKs, no advertising identifiers, no ad tracking.
- No location data, contacts, photos, or microphone access.
- No health-platform data beyond heart rate: the only thing we read from Apple Health or Google Health Connect is heart rate, only for your cardio sessions, and only with your permission (described above). We do not read any other Apple Health, Health Connect, or Google Fit data.
How we use your data
We use your data solely to provide the app:
- Run your account: sign you in, keep your data attached to you.
- Show you your own training: your program, workout history, progression charts, weekly training volume, and check-in trends.
- Compute your recovery and training-load metrics: the app's recovery model runs on our servers using your logged sets, check-ins, session difficulty, and session duration, and adjusts guidance (e.g. suggested weights) accordingly.
- Send you essential account emails: sign-up confirmation and similar account/security messages. We do not send marketing email.
We do not use your data for advertising, we do not build profiles for third parties, and we do not sell or rent your data to anyone.
Where your data is stored (service providers)
We use a small number of infrastructure providers to run the app. They process data on our behalf under their own security and privacy commitments; none of them may use your data for their own purposes.
| Provider | What it does | Where |
|---|---|---|
| Cloud database & authentication provider | Account authentication and our database (all data listed above) | Outside your country of residence (see international transfers below) |
| Cloud application-hosting provider | Hosts our API servers, which process your requests | Outside your country of residence (see international transfers below) |
| Transactional email provider | Delivers account emails (e.g. the sign-up confirmation code); processes your email address | Outside your country of residence (see international transfers below) |
| Website & email-routing provider | Serves this website and routes email you send to support@zor.training to our inbox (Email Routing) | Outside your country of residence (see international transfers below) |
International transfers: your account and training data may be processed and stored outside the country where you live. Where your data is transferred across borders, for example if you use Zor from the EU or UK, we rely on appropriate legal safeguards for such transfers, such as Standard Contractual Clauses in our providers' data-processing terms. You can request more detail about these safeguards by emailing support@zor.training.
Data in transit is encrypted (HTTPS/TLS). Access to production systems is restricted to the operator.
Data stored on your device
The app works offline: workouts and check-ins you log without an internet connection are stored on your device and synced to our servers when you are back online. Your device also caches your program and recent data so the app loads quickly. This on-device data is the same data described above, not an extra category. It is removed when you delete the app or delete your account; signing out clears your cached data too, except that workouts logged offline and not yet synced are kept on the device so they are not lost, and upload after you next sign in.
Deleting your account and your data
You can delete your account in two ways:
- In the app: Settings → Account → Delete account (press and hold to confirm). Deletion is immediate and permanent.
- By email: send a deletion request from your account email address to support@zor.training. We will verify the request came from your address and process it within 30 days.
Deleting your account deletes your authentication record and all data linked to it: profile, programs, custom exercises, workout sessions, logged sets, check-ins, soreness ratings, cardio sessions and any heart-rate data, crash and diagnostic reports, and derived strength/recovery values. This is enforced at the database level (all your data is keyed to your account and is removed with it), and the data is deleted immediately from our live database.
Backups. Our database provider takes an encrypted daily backup of the whole database so we can recover from a failure, and each backup is kept for 7 days before it is overwritten. Your data is removed from the live database immediately when you delete your account, and any remaining copy of it inside those backups ages out of the rotation within 7 days. We do not use backups to bring a deleted account back.
Deleting only your heart-rate data. If you want to remove the heart-rate data we hold but keep the rest of your account, you can do that in the app by disconnecting your heart-rate source and choosing to delete your heart-rate data. Your cardio sessions themselves stay (their duration and how hard they felt), but the stored heart-rate figures and per-minute readings are removed, and your consent is withdrawn.
See also the step-by-step instructions on our account deletion page.
Data retention
We keep your data for as long as your account exists, because the app's purpose is your long-term training history. We do not have time-based deletion of old training data; your history is the product. When you delete your account, everything goes with it (see above).
Your rights
Depending on where you live (e.g. GDPR in the EU/UK, CCPA in California), you may have rights to access, correct, export, or delete your personal data, and to complain to a supervisory authority. You can exercise access and deletion directly: the app shows you all your data, and account deletion is described above. Where we rely on your consent (for heart-rate data), you can withdraw it at any time in the app, as described above. For an export of your data, or any other request, email support@zor.training.
Children
Zor is not directed at children. You must be at least 18 to create an account. We do not knowingly collect data from children below that age; if you believe a child has created an account, contact us and we will delete it.
Not medical advice
Zor provides fitness and training information only. It is not medical advice, and it is not a medical device. The app's recovery scores, training recommendations, and any other guidance are for general fitness purposes. Consult a qualified healthcare professional before starting a training program, and stop and seek medical advice if you experience pain, injury, or other symptoms. You are responsible for training within your own limits.
Changes to this policy
If we change what we collect or how we use it, we will update this policy and change the "Last updated" date before the change takes effect, and, for significant changes, tell you in the app. In particular, if the app ever starts sharing data with a new category of provider, this policy will be updated before that happens.
Contact
Questions about this policy or your data: support@zor.training. See also our support page.