Privacy notice

Last updated: 2026-10-04

In short: we only keep what Fast Sets needs to work. There are no ads, we don't sell data and we don't use third-party trackers. You can download your data and delete your account yourself whenever you like.

1. Who is responsible

The controller of your data is Wenbo Zhou, a private individual living in Spain who runs Fast Sets as a personal project ("we" in this notice). Contact: fastsetsemail@gmail.com.

2. What data we process

• Your account: username, password (stored hashed, never in plain text), preferences and, if you give it, your email address.
• Your training: what you log or import (exercises, categories, sets, notes and comments). If you upload a FitNotes backup file, we keep the whole file so we can hand it back to you updated; it may contain data Fast Sets doesn't show, such as body measurements.
• Waitlist: the email address you leave and the language of the page.
• Technical data: your open sessions (device and browser type, when you signed in and when you last used it), your IP address to stop abuse, and a technical server log with requests, errors and the diagnostics the administrator sends to fix faults.
• Access to your account: if you give a trainer access, when you accepted the terms and when they enter and leave; and every time the administrator enters.
• Donations: they are made on PayPal's website, and PayPal is the controller of that data. We only see the payment notice in the controller's PayPal account; the app receives and stores nothing from PayPal.

3. What we use it for, and our legal basis

Only to provide the service, keep it secure and avoid losing data. We don't use it for advertising or profiling, and we make no automated decisions about you.

• Providing the service (your account, your training, your email, your sessions and, before you have an account, your waitlist email): performance of the contract or of steps you ask for before it (GDPR Article 6(1)(b)).
• Your trainer's access: your consent (GDPR Article 6(1)(a)), which you withdraw at any time by removing their access.
• Security, abuse limits, the technical log, backups and the administrator's access to resolve incidents: our legitimate interest in keeping the service working, secure and without data loss (GDPR Article 6(1)(f)).

4. Your trainer's and the administrator's access

From your Profile you can generate a one-time code, valid for one day, for your trainer to enter your account. First you accept terms that explain what it allows. While access is active, your trainer can log, change and delete your workouts, exercises and categories, and import and export your data; they can't change your password or email, or delete your account. You remove their access whenever you like from your Profile, and they can remove it too.

The Fast Sets administrator can enter any account, only to resolve incidents or faults. Every entry, theirs or your trainer's, goes into a log that is kept for 180 days.

5. Who it is shared with

We don't sell or hand over your data. Only these providers are involved, processing it on our behalf:

• Cloudflare (privacy policy): the network in front of the server (all traffic goes through it and it logs IP addresses) and the storage of the encrypted backup, in the European Union.
• Resend (privacy policy): sending the app's emails (waitlist, invitation, confirming your email and resetting your password). It receives your address and the content of the email, never your training.

Both are US companies, so part of the data (traffic and emails) may be processed outside the European Economic Area, with the safeguards the GDPR requires. If you donate, PayPal handles it as the controller of that data, under its own privacy policy. Beyond this, we would only give data to an authority if the law requires it.

6. Security and backups

We protect data with reasonable measures (encrypted connection, hashed passwords, encrypted backups), but no system is infallible.

Every night an encrypted backup of the database is made and stored in Cloudflare R2, in the European Union. Only the controller has the key to open it, and it is only opened to restore the service after a failure or to check that the backup works. Each backup is deleted after 30 days, except in two cases: if some need to be kept longer so we're never left without valid backups, and if a backup comes out incomplete, which isn't deleted automatically and stays until the controller reviews it.

7. How long we keep it

• Your account and your training: for as long as you have the account. When you delete it, they're gone from the database at once, and from the backups when those expire (30 days).
• Your waitlist email: until you have an account and delete it, or until you ask us to remove it.
• The log of access to your account: 180 days.
• Signed-out sessions: 30 days after they were closed.
• Open sessions you don't use: 60 days after their last use.
• Links sent by email (confirming your email, resetting your password): they expire within a day at most and are deleted 30 days after expiring.
• Technical server log: it has no fixed period but a maximum size; the oldest entries are overwritten automatically when it fills up.

Automatic clean-ups aren't always instant: some data may take a little longer to disappear after its period.

8. Your rights

You can access your data, correct it, take it with you, delete it, object to its processing or ask for it to be restricted. The usual things you do yourself:

• See and correct it: in the app itself.
• Take it with you: in Statistics → Data, whenever you like.
• Delete your account: in Profile → "Delete my account", instantly.
• Remove your trainer's access: from your Profile.
• Everything else (for example, removing your email, leaving the waitlist or asking for the log of access to your account): write to fastsetsemail@gmail.com. Requests about your data are answered within a month, as the law requires.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD): aepd.es.

9. What is stored on your device

Fast Sets only sets the technical session cookie, to keep you signed in, and no other cookie of ours; that one doesn't need your permission because it can't be used to track you. There are no ads, no analytics and no third-party trackers, and the app loads nothing from other websites.

To work without signal, your browser stores a copy of your history, the app's files and your preferences. The copy of your history is deleted when you sign out or delete your account. If your trainer enters your account, their browser also stores a copy while they use it.

10. Minors

Fast Sets is not meant for anyone under 16. If we learn that an account belongs to someone under that age, we delete it.

11. Changes to this notice

If we change this notice, the date above will change. If the change is significant, we'll try to let you know in the app or by email.