Privacy Policy

Capstan splits data into two buckets: on-device only and cloud (opt-in).

On-device only — never leaves your device unless you turn on sync

Stored locally (on iOS/Android in the app's local storage, on web in your browser's localStorage). We cannot see it, and it is not sent to our servers or anyone else — with the single, limited exception of the Coach (Section 4).

• Workouts: lifts and runs — sets (weight × reps), RPE, average heart rate, injury regions you tag, and free-text notes.
• Training maxes and 5/3/1 program state.
• Injury mode status and the muscle groups you flag.
• Profile: date of birth, biological sex, height, max heart rate, VO2max, and any weight / goal / injury notes you enter.
• Body measurements: weight, body-fat %, and circumference measurements.
• Food log: calories, protein/carbs/fat, and meal type.

If you never sign in, none of this data ever reaches our servers. Clearing the app's storage (or your browser data) deletes it.

Cloud — only after you sign in and enable sync (Cloudflare D1)

When you sign in, Capstan can back up and sync a narrow subset so it follows you across devices — stored in a Cloudflare D1 database, keyed only by an opaque account identifier (Section 3). We sync:

• Your workout history (lift and run sessions), stored as opaque data blobs.
• A settings subset only: injury mode, current week, cycle number, training maxes, and accessory weights.

We do not sync, and never upload to the cloud: your date of birth or biological sex, max heart rate, VO2max, body measurements, food log, or email address. Those stay on your device even when sync is on.

Capstan supports Sign in with Apple, Sign in with Google, and passkeys. Account records are intentionally minimal:

• The opaque subject identifier (sub) Apple or Google gives us — a meaningless-to-humans string that identifies your account without revealing who you are. For passkeys, the passkey credential.
• An optional display name (only if your sign-in provides one).
• The time you consented and the policy version you agreed to.

We do not receive or store your email address, real name, or any contact details. From our side, your account is an anonymous identifier plus your synced workout data.

The Coach gives training advice, powered by Anthropic's Claude (claude-haiku-4-5), which acts as a sub-processor for this feature.

What gets sent to Anthropic on each Coach message

Your message, plus a context block we build to make the advice relevant:

• Your program state: current week, cycle number, and training maxes.
• Your last 5 workout sessions, including the free-text notes you wrote on them.
• Only if you have entered them: the athlete details from your profile — height, weight, training goal, and injury notes — so the advice fits you. Leave them blank and nothing about your body or injuries is ever sent.

What is not sent

Your date of birth, biological sex, body measurements, food log, account identifiers, or email. (We don't have your email at all.)

How the data is used and retained

• Anthropic processes this context only to generate the reply. It is not used to train models — Anthropic's API terms exclude API traffic from model training.
• We do not store or log your Coach conversations. On the client, messages live only in memory and are gone when you close the screen. On our server, chats pass through and are not written to any database or log. The only thing we ever record about a Coach call is, if it fails, a diagnostic line with the error's status code and name — never your message or the reply.

If you don't use the Coach, none of this happens. For how Anthropic handles API data, see Anthropic's privacy policy.

To protect accounts against abuse, our backend keeps a small audit log of security-relevant events — sign-in, sign-out, data export, account deletion, and passkey changes.

Each entry records the event type, a timestamp, and — instead of your raw IP address — a SHA-256 hash of your IP. We do not store raw IP addresses. The hash lets us tell whether two events came from the same source without being able to read the underlying address.

A scheduled job on our backend enforces the audit-log and session cleanup above.

Because your account is keyed to a signed-in identifier, you can exercise these directly from the app (or the corresponding API endpoints):

• Access / export your data. A full export of everything we hold — synced workouts, settings subset, account record (sign-in providers shown only as linked/not-linked booleans, never raw identifiers), passkeys, sessions, and audit log. Served by GET /me/export. Your device-local data exports via Settings → Backup & restore → Save to file.
• Delete your account. A hard delete: DELETE /me removes your account and cascades to every associated record. A single erasure entry is logged, then aged out under the 365-day rule.
• Delete on-device data any time by clearing the app's storage — that data was never on our servers to begin with.

Deletion is immediate and irreversible, so export first if you want a copy.

Capstan is not directed to children and is intended for adults managing their own training. Please don't use it if you are under the age required in your region to consent to this kind of data processing.

When we change this policy we'll update the Last updated date and increment the Policy version. The version is mirrored in the app as CloudConfig.TERMS_VERSION, and the app records which version you agreed to. Continuing to use Capstan after a change means you accept the updated policy.

Questions about this policy or your data can be sent to the Capstan maintainers via the project's support channel. For account-specific requests, use the in-app export and delete controls in Section 7.