Privacy policy

This page explains what happens to your information when you visit this website or join the early-access list for Strongy, a strength-training log for iPhone and Android. The app isn't out yet, and this page doesn't cover it.

Who we are

Strongy is run by Strongy, Lutfizade 24A, Baku 1142, Azerbaijan. We decide how your information is used. Questions about this page? Write to hello@strongy.app.

What we collect when you join the list

When you sign up with the form, we store:

• your email address
• which version of the consent sentence you saw under the form, so we can show what you agreed to
• whether your sign-up is pending (not confirmed yet), confirmed or unsubscribed, and when it was created, confirmed or unsubscribed

We don't ask for your name, and there's no account.

What we keep to stop abuse

To stop the form being flooded, our server keeps a keyed hash of your IP address and one of the email address you entered, and uses them to limit how often the form can be used and how many emails one address can be sent. A keyed hash is a one-way code made with a secret key: it lets the server spot repeat attempts without keeping the address itself. Our sign-up system never stores your IP address, and it deletes these hashes every day.

What we don't collect

• No cookies. This site doesn't set any.
• No analytics, no trackers and no third-party scripts.
• No tracking pixels. Our emails have no remote images, so opening one tells us nothing.
• Your light or dark theme choice stays in your browser (in localStorage) and is never sent to us.

Why we use it

We use your email address only to:

• send you an email asking you to confirm your address
• email you once when Strongy is ready
• send you a short note if someone enters your address again after you've confirmed it

We don't use it for anything else, and we don't sell it.

Legal basis

We rely on your consent. You give it when you send the form and confirm your address, and you can withdraw it at any time.

For the keyed hashes we keep to stop abuse, we rely on our legitimate interest in keeping the form and our emails from being misused. They can't be turned back into your IP address or email address, and they're deleted every day.

How long we keep it

• Sign-ups that are never confirmed: deleted automatically 30 days after the last request to join.
• Abuse hashes: deleted every day.
• Confirmed addresses: kept until we've sent the email saying Strongy is ready, then deleted.
• Unsubscribed addresses: kept and marked unsubscribed, so we never email them again, and deleted if you ask.

Who helps us run it

These services handle your information for us:

• Supabase runs our database and the server functions behind the form, in the EU (Frankfurt, Germany). It keeps short-lived request logs, which include IP addresses, to run and secure its service. We don't copy them anywhere.
• Resend sends our emails, from the EU (Ireland). It keeps a record of each email it sends: the address, the message and whether it was delivered.
• Vercel serves this website. It keeps short-lived access logs, which include IP addresses, to run and secure its network. We don't copy them anywhere.

Supabase, Resend and Vercel are US companies, and their staff or subprocessors may handle your information from outside the EU. Those transfers rely on the EU Standard Contractual Clauses in each provider's data processing agreement.

Your rights

You can ask us to show you what we hold about you, to correct it or to delete it. You can also:

• withdraw your consent at any time: every email has an unsubscribe link
• object to how we use your information
• complain to a data-protection authority, such as the one where you live

To do any of this, write to hello@strongy.app.

Changes

If we change this policy, we'll update this page and its effective date.