CITADELWhat we collect
Citadel Fitness is a workout tracker. Almost everything we store exists because you typed it in, logged it, or uploaded it yourself.
| Data | Why we have it |
|---|---|
| Email address | Creates and secures your account; used for sign-in and password reset. |
| Password | Stored as a salted hash by our authentication provider; we never see or store it in plain text. |
| Display name & photo | Optional. Shown back to you in the app, and shown to other users where a leaderboard applies — the app-wide activity leaderboard and any private group you join. See Section 8 for the full list of what those show. |
| Workout history | Exercises, sets, reps, weight, and cardio duration/distance you log: the core of the app's charts and streaks. |
| Preferences | Unit system, theme, and which newsletter categories you want alerts for. |
| Favorited articles | Which newsletter posts you've saved, so they show up under Favorites. |
| Feedback messages | If you submit feedback from Account → Help & feedback, we store your message and the email you're signed in with, so we can read and reply to it. |
| Product analytics | Which screens you open and whether a few key flows finish — signing up, logging a workout, joining a plan. Sent to PostHog against your account's random identifier only. No name, email, photo, workout contents, or anything else you typed is included, and nothing is captured automatically: every event is one the app was written to send. Section 8 has the provider detail. |
| Membership tier | Which plan your account is on (free, Fortress, or Valhalla), so the app knows which features to give you. Today this is still set by us directly: no plan can be bought yet. The row below covers what changes when they can be. |
| Purchases, when paid plans open | The app carries the store's purchase library from build 6 onwards, and it does nothing until a store account is connected to it. When one is, buying a plan works like this: Google Play or Apple takes the payment and we never see your card, the store tells RevenueCat, and RevenueCat tells our server your account id, which product you bought, and whether the subscription is still running. That is the whole of what we keep about a purchase. If you start a free trial, we also record that the period is a trial, so a trial is never counted as a sale. |
| Run Club, if you hold a place on a run | Which run you are going to, whether you checked in at the start and out at the finish and when, the pace you chose, whether you asked for company to your transport afterwards, and who you were paired with as a buddy. The point of it is the headcount: the number who set off has to be the number who come back, and the run lead has to know who is still out while that still matters. It says nothing about where you are; there is no location tracking of any kind, only the times you tapped check in and check out. |
| Testing, if you join it | Open to anyone with an account, at citadelfitness.app/testers, and separate from ordinary use of the app. We keep your email, when you joined, and whatever you send us: which of the three test categories a report is about, the part of the app it concerns if you name one, your words, and any screenshots or recordings you attach, which go to a private storage bucket only you and we can read. It is kept while your account exists and deleted with it, screenshots and recordings included. To have it deleted sooner, write to the address in Section 12. |
| Crash & error diagnostics | If the app crashes or hits an unexpected error, technical details — device model, OS version, app version, and the error itself — are sent to Sentry, our crash-reporting tool, so we can find and fix the bug. See Section 8 for what's deliberately excluded from that. |
We don't ask for your location, don't integrate with Apple Health or Google Fit, and don't request camera access. Photo uploads use your device's photo library picker only and land in a Supabase Storage bucket scoped to your account, at a path only your account can write to.
We don't generate or store a push-notification token for your device — see Section 4 for how reminders actually reach you without one.
How we use it
In plain terms: to run the app for you, and nothing beyond that.
- Signing you in and keeping your session secure across devices.
- Saving and syncing your workouts, so your history is there the next time you open the app.
- Calculating streaks, weekly volume, and the progress charts on the Activity tab.
- Formatting numbers in the units you chose (lb/kg, mi/km).
- Deciding which newsletter articles to notify you about, based on the categories you've enabled.
- Sending the emails a normal account needs: confirming your sign-up, a password-reset link if you request one, and a one-time welcome email.
- Emailing you about new newsletter articles and app news, but only if you've turned that on — it's off by default.
- Reading and replying to feedback you submit from Account → Help & feedback.
- Diagnosing crashes and bugs using the technical details described in Section 1, so issues get fixed faster.
We do not use your data for advertising, we do not build behavioral profiles, and we do not use it to train any model.
Where it's stored
Your data is stored and served by Supabase, our backend infrastructure provider, which handles authentication, our database, and file storage on our behalf. We don't run our own servers for this data; Supabase is a data processor acting under our instructions, not an independent user of your information.
Access is enforced with row-level security policies at the database level: every request is scoped to your own account, so there is no path, accidental or otherwise, for one user's app session to read another user's workouts, profile, or preferences.
Your profile photo, if you upload one, is stored in a Supabase Storage bucket at a URL scoped to your account folder.
Notifications
Your daily workout reminder and the in-app alerts for new newsletter articles are scheduled locally, on your own device, using the operating system's own notification scheduler. There is no push server involved: the app checks for new articles when you open it, and if there's anything new in a category you follow, it asks your device's OS to show a notification right then. Nothing about the content or timing of these is transmitted to us or to any third party. If you deny notification permission, or you're using the web version, this feature simply does nothing; it fails silently rather than nagging you.
Separately, if you turn on Email me about new articles & app news in Account → Preferences → Notifications, we send you an actual email — through Resend, our transactional email provider — whenever something new is published. This is off by default, is entirely independent of the on-device reminders above, and turning it off stops the emails without touching your other notification settings.
Your controls
Everything here is available directly in the app; none of it requires emailing us and waiting.
- View & edit your name and photo from Account → Profile settings.
- Change your password from Account → Account management → Change password.
- Adjust weight/distance units from Account → Preferences → Units, and workout reminders, article alerts, and the newsletter email toggle from Account → Preferences → Notifications.
- Send feedback, which we read and can reply to at the email you're signed in with, from Account → Help & feedback.
Account → Account management → Delete account permanently removes your account and everything tied to it: your profile, every logged workout and set, your saved favorites, and your uploaded photo. This runs immediately, cannot be undone from within the app, and does not require contacting support first.
Retention
We keep your data for as long as your account exists, so your workout history stays available to you. If you delete your account, your data is deleted immediately and permanently as described above; we do not keep a backup copy for any further period.
Age requirement
Citadel Fitness is for adults. You must be 18 or over to create an account, and we don't knowingly collect information from anyone under 18. If you believe someone under 18 has created an account, contact us and we'll delete it.
This is not boilerplate. Three things in the app are the reason for it: the activity leaderboard shows a display name and photo to every signed-in user, form check accepts video of you training, and nutrition coaching asks for body weight and height. None of those is something we are willing to hold for a minor.
Sharing & sale
We do not sell your data. We don't share it with advertisers, and the app contains no ad network and no social-media SDK. It does contain one product-analytics SDK, PostHog, described in the table below — an earlier version of this policy said otherwise, which stopped being accurate when analytics were added on 19 August 2026. A small, fixed set of infrastructure providers process data strictly on our behalf, only to run the features described above, and none of them are permitted to use it for their own purposes:
| Provider | What they get, and why |
|---|---|
| Supabase | Our database, authentication, and file storage. Holds everything in the Section 1 table — this is the app's backend. |
| Resend | Our transactional email provider. Sees your email address (and display name, for the welcome email) only when the app needs to send you something you triggered or opted into: sign-up confirmation, a password-reset link, the one-time welcome email, a feedback reply, or a newsletter alert you've turned on. |
| Sentry | Our crash-reporting tool. Receives the technical crash details from Section 1 when the app hits an unexpected error. It's configured not to attach your IP address, name, or email to those reports. |
| RevenueCat | Our subscription service, and only from the point where paid plans open. It sits between the app stores and our server: it receives your Citadel account id, the product you bought and the state of the subscription, and it tells our server when that changes. It never receives your card details, because neither do we. Until a store account is connected the library in the app is never started and RevenueCat receives nothing at all. |
| PostHog | Our product-analytics tool, added 19 August 2026, hosted in the EU. Receives the events in Section 1 tied to your account's random identifier. Autocapture and session replay are both switched off, so no screen you look at is ever recorded, and the app sends only a fixed, closed list of events rather than anything it happens to observe. There is currently no in-app switch to turn this off; if you would rather we did not collect it, email us and we will exclude your account. |
What other people using the app can see
This is separate from the providers above: it is other Citadel Fitness users, not companies. Three features show your information to other people. The first two are on by default; the third only applies if you take a place on a Run Club run.
| Where | Who sees it, and what |
|---|---|
| Activity leaderboard | Every signed-in user. If you logged a workout on the day you did it within the last seven days, you can appear in a top-50 list showing your display name, your photo, and the number of days you trained. It does not show what you lifted, only how many days. If you have not set a display name you appear as “Member”, and if you have logged nothing in that window you do not appear at all. |
| Run Club | Your buddy, the run lead, and whoever is organising the run. Your buddy is shown your first name only, so you can find each other at the start. The lead and the organiser see your name, whether you have checked in and out and at what time, the pace you chose, and whether you asked for company to your transport. That is the safety system working as intended: somebody has to be able to say who is still out. Nobody else on a run sees any of it, and cancelling your place removes you from the list. |
| Private groups | Only the other members of a group you joined. The same three things — display name, photo, days trained in the period shown. Nobody outside the group can read it, and you can leave a group at any time, which removes you from it. |
Neither shows your workout contents: no exercise, weight, rep, or note you have written is visible to anyone else. If you would rather not appear at all, clearing your display name and photo reduces you to “Member” with no picture, and not logging on the same day keeps you off the activity leaderboard entirely.
We would only disclose information beyond this if legally required to, for example in response to a valid court order, and would limit that disclosure to exactly what's requested.
Security
Traffic between the app and our backend is encrypted in transit. Passwords are hashed, never stored as plain text. Database access is governed by row-level security rules scoped to each account, and account deletion runs through a server-side process that verifies your identity before anything is removed.
No system is perfectly secure, and we can't guarantee absolute security, but these are the concrete measures in place today, not a generic promise.
International users
Your data may be stored or processed in a country other than the one you live in, wherever our infrastructure provider operates its servers. By using Citadel Fitness, you understand your information may be transferred internationally, subject to the protections described in this policy.
Changes to this policy
If we make a material change to how we handle your data, we'll update the effective date at the top of this page, and, for significant changes, notify you in the app before they take effect.
Contact us
Questions about this policy, or a request to access or delete your data outside the app, can go to:
tumi.citadel@gmail.com
Developed by Tumi Devz.