Privacy Policy

We only collect information that you give us directly. We do not buy data, scrape data, or accept data from third-party sources.

Account information

• Name (provided when you request access).
• Email address (used as your sign-in identifier — LeanLab is passwordless and authenticates via Supabase magic links).
• Phone number (optional; not used for anything beyond reaching you if there is an access-related issue).

Body recomposition data

Everything below is logged voluntarily by you, lives in your account, and is visible only to you (and to a small set of operational sub-processors listed in §4):

• Weight logs and daily check-ins (weight, body fat %, sleep hours, mood, notes).
• Body measurements (waist, hip, neck) and optional body fat percentage (entered manually or estimated by the Navy formula from your measurements).
• Workout sessions, exercises, sets, reps, weights, rest-timer settings, notes.
• Diet logs (calories, protein, fat, carbs entered as totals per day — no food database).
• Supplement check-ins (which supplements you took on which day).

Profile preferences

Theme (dark / light / auto), units (metric / imperial), reminder schedule.

Technical information

When you use the web app we receive standard request data through our hosting provider (Vercel): IP address, timestamp, requested URL, User-Agent header. This is used for security (rate limiting, abuse detection) and is retained on Vercel's infrastructure under their terms.

We do not use third-party analytics (no Google Analytics, no Mixpanel, no Posthog). We do not use advertising pixels.

We process your information only for these purposes:

• Account management. Magic-link sign-in via Supabase Auth; access-request approval flow.
• App functionality. Computing your calorie and macro targets, rendering charts, projecting time-to-goal, surfacing diet-break recommendations after 12 continuous weeks of cutting.
• Transactional email. Welcome email after sign-up; access-decision email to the owner; magic-link emails delivered via Resend.
• Security and abuse prevention. Rate limiting on sign-up and authentication endpoints; Cloudflare Turnstile bot-challenge on the access-request form.
• Operating the service. Backups, error monitoring (via Sentry, with personally-identifying fields scrubbed before send), and performance debugging.

We do not profile you, automatically make decisions about you, sell your data, share it for advertising, or use it to train AI models.

For visitors in the EU / EEA / UK, the GDPR / UK GDPR require us to declare a lawful basis for each processing purpose:

• Contract (Art. 6(1)(b)) — running the Service you asked us to provide.
• Legitimate interest (Art. 6(1)(f)) — keeping the Service secure and abuse-free (rate limiting, Turnstile, Sentry).
• Consent (Art. 6(1)(a)) — for the body-recomposition data you choose to log. You can withdraw consent at any time by deleting individual entries or by deleting your entire account.
• Explicit consent under Art. 9(2)(a) for health-related data (body fat, measurements).
• Legal obligation (Art. 6(1)(c)) — if we are compelled by valid legal process to retain or disclose specific records.

Your data lives across these operational sub-processors. Each has its own data processing agreement in place where applicable:

We do not share your data with:

• Advertisers.
• Data brokers.
• Analytics vendors beyond the operational scope above.
• Any other LeanLab user.

We may share information if compelled by valid legal process (court order, subpoena), in which case we will notify you unless we are legally prohibited from doing so. If LeanLab is ever sold or merged, we will give you 30 days' notice and a chance to export and delete your account before any data is transferred.

LeanLab is operated from Norway, but the operational sub-processors listed in §4 are US-headquartered companies and may process or store your data on infrastructure outside the European Economic Area (EEA). Where data leaves the EEA, the transfer relies on a lawful safeguard under Chapter V of the GDPR.

Standard Contractual Clauses are the European Commission's approved contract terms for moving personal data outside the EEA. You can request a copy of the safeguard that applies to a specific transfer by emailing support@leanlab.dev.

We use one cookie: your Supabase session cookie, set when you sign in. It is HttpOnly, Secure, and SameSite=Lax, and it expires when your session does.

We do not use:

• Advertising cookies.
• Third-party analytics cookies.
• Tracking pixels or web beacons.
• Cross-site identifiers.

The Cloudflare Turnstile widget on the sign-up form may set its own short-lived cookies during the bot challenge; these are scoped to Cloudflare's domain and not readable by us.

We use localStorage to remember non-sensitive UI preferences (chosen theme, last-selected dashboard tab, rest-timer settings). Nothing in localStorage is sent to our servers.

For as long as your account is active. If you delete your account from Settings, all of your rows in our database are hard-deleted within 7 days (Supabase backups cycle through within that window). Backups are encrypted at rest and not human-accessible.

Access request rows (rejected applications) are retained for 12 months for abuse detection, then deleted.

• Encryption in transit on every connection.
• Strict data isolation — access is scoped so you can only ever reach your own records, enforced at the database level as well as in our application code.
• Passwordless sign-in (magic-link) — no passwords for you to lose or for us to leak.
• Abuse protection — rate limiting and bot challenges on sign-up and sign-in.
• Sensitive data minimised in diagnostics — personal fields are stripped before any error report is recorded.

No system is unbreakable. If we ever experience a breach affecting your data, we will notify you and the relevant supervisory authority within 72 hours of discovery, per GDPR Art. 33.

LeanLab is intended for adults (18+). We do not knowingly collect data from anyone under 18. If we learn we have done so we will delete the account. If you are a parent or guardian and believe your child has used LeanLab, contact us and we will act promptly.

If you are in the EU, EEA, UK, or Switzerland, you have the following rights under the GDPR / UK GDPR:

• Access — get a copy of your data. Use Settings → Export, or email us.
• Rectification— fix anything that's wrong. Most fields are editable directly in the app.
• Erasure — delete your data. Settings → Delete account hard-deletes everything.
• Restriction — limit further processing.
• Portability — receive your data in a structured, machine-readable format (the export gives you JSON + CSV).
• Objection — object to processing based on legitimate interest.
• Withdrawal of consent— withdraw any consent you've given, with no penalty.
• Lodge a complaint — with your national data protection authority (in Norway, Datatilsynet; in the UK, the ICO).

Users outside these regions have similar rights under their local laws and we'll honour any reasonable request.

To exercise any of these rights:

• Use the in-app controls (Account, Export, Delete).
• Or email us at support@leanlab.dev.

We respond within 30 days. We don't charge a fee. We don't require ID verification beyond confirming the request comes from the email address on the account.

We respect Do-Not-Track signals by default — there's nothing for us to disable, because we don't run any analytics or advertising tracking in the first place.

We will. If we make material changes (new sub-processor, new category of data, new purpose) we will notify you by email and in-app banner at least 30 days before they take effect, so you have time to export and delete before the change applies.

Minor wording changes (typos, clarifications) will simply update the “Last updated” date above.

Email: support@leanlab.dev

If you prefer post, contact us by email first and we will share a postal address.

Three options, in order of speed:

1. In the app — Settings → Account → edit display name, email, phone. Settings → Export → JSON + CSV of every table tied to your account. Settings → Delete account → typed-confirmation hard delete.
2. By email — send a data subject access request to support@leanlab.dev.
3. By complaint — to your national data protection authority if we have not resolved your concern to your satisfaction.

We treat all three the same. We respond within 30 days. We do not charge a fee.