Privacy policy

Steelset Performance ("Steelset") is a training app for strength gyms and the people who train with them, and for athletes who train on their own. It is made by QuestLabs LLC ("Quest Labs", "we", "us"). This policy explains what we collect, why, who receives it, how long we keep it, and the choices you have. It covers the Steelset app on iPhone, the Steelset website at app.steelsetperformance.com, and our public website at steelsetperformance.com.

We never sell your information, and we never use it for advertising.

Gyms and independent athletes

Steelset is used in two ways, and who is responsible for your information depends on which applies to you.

• If you train with a gym, or work at one, your gym is responsible for your information (it is the "controller") and decides what it records about you in Steelset; Quest Labs processes the information for your gym, following its instructions (we are its "processor"). Steelset asks for any consent on your gym's behalf and keeps the record. Your gym answers your requests, using Steelset's tools, and decides any appeal. If you send a request to us, we pass it to your gym within 3 business days and help your gym answer it.
• If you train on your own (an "independent athlete") or visit our public website, Quest Labs is responsible for your information (the "controller"): we decide what is collected, ask for and record any consent, answer your requests, and decide appeals.

Quest Labs is also responsible, for everyone, for what it decides on its own: securing Steelset, keeping it running, and its own business records.

What we collect

Everyone with an account

• Your name, email address, and role (athlete, trainer, or gym administrator), and which gym you belong to.
• Sign-in information: your password, which we store only in a scrambled form that can't be turned back into the password; your authenticator app's setup, stored encrypted; and passkeys, of which we keep only a public key (your fingerprint or face never leaves your device).
• For each device you're signed in on: its internet (IP) address and a description of the browser or phone, used to keep your account secure.
• Which version of our terms you agreed to, and when.

Athletes who train with a gym

• Your date of birth and, if your gym adds one, your phone number.
• Your profile: your trainer, body weight and target weight, training goals, school or team, injury notes, and the equipment you have.
• Your training: the programs your trainer writes, and what you log in each workout (weights, reps, times, distances, effort, notes, and any pain you report and where).
• Alerts your trainer receives about missed or difficult workouts.
• Class bookings, check-ins, and waitlist places.
• Your memberships and payments: the membership, its price and dates, a record of each automatic-renewal agreement (the words agreed to, who agreed, and when), payments you made at the gym, and late-cancellation fees. Card details are entered on our payment processor's pages; we never see or store card numbers.

Athletes under 18 (gym athletes only) need a parent or legal guardian's consent; see "Children and teenagers" below.

Independent athletes (18 and older)

• Your date of birth, to check your age.
• The answers you give when you ask for an AI training plan: your goals, experience, schedule, equipment, injuries, and how your last plan went.
• Your plans and everything you log, as above.
• Your subscription: its price, dates, and any free trial.

Gym staff (trainers and gym administrators)

• Your account and sign-in information, as above.
• The programs and templates you write, and a record of who changed them and when.
• For gym administrators: your gym's settings, logo, and color, and its billing status with us.

Notifications. If you turn them on, we keep your phone's or browser's notification address so we can send you notices.

What we don't collect. We don't collect your location, contacts, or photos, and we don't use advertising identifiers.

How we use it

• To run Steelset for you and your gym: your programs, workouts, bookings, memberships, alerts, and notices.
• To process payments through our payment processor.
• For independent athletes, to write AI training plans and weekly adjustments (see below).
• To send the emails the service needs: invitations, consent requests, payment links, confirmations when a membership or subscription starts or is canceled, a reminder before a free trial ends, account notices, and password resets. We don't send marketing email.
• To keep accounts secure, prevent misuse, and fix problems.
• To meet our legal obligations.

AI training plans

Independent athletes can ask for a 4-week training plan written by an AI model from Anthropic. To write it, we send Anthropic your answers and your training history from your earlier AI plans: each set you logged, pain you reported and where, the notes you typed when finishing a workout, and how each plan went. We count time in weeks ago, not dates.

We never send Anthropic your name, email, phone number, date of birth, or calendar dates, and we leave out any note that contains your name or contact details. Please don't type other people's names or personal details in your notes. We never send any gym athlete's information to an AI service. Under its terms with us, Anthropic deletes what we send within 30 days, except where it must keep it longer to enforce its usage policy or by law, and does not use it to train its models.

An AI plan is general training guidance, not medical advice.

Who receives your information

Your gym. Your gym's administrators can see everything Steelset holds about the people in their gym. Your trainer sees your profile, programs, workouts, age, phone number, and guardian details, and whether your membership is active, but not its price or payments. Other trainers at your gym see only your name and booking status on class lists. Other gyms and other athletes never see your information.

Quest Labs. Our staff use it only to run, support, and secure the service.

Companies that do work for us, each receiving only what it needs:

• Stripe processes payments. It receives the payer's email, the amounts, and the card details you enter on its pages. For an athlete under 18, Stripe has only the guardian's email. Gyms that take payments have their own Stripe accounts under Stripe's terms.
• Anthropic writes AI plans for independent athletes, as described above.
• Google Cloud hosts the service in the United States and keeps our server logs. The logs record what failed and where, never the content of your information.
• PlanetScale hosts our database, on Google Cloud in the United States.
• Postmark sends our emails. It receives each email's address and text.
• Expo, Apple, and Google deliver notices to phones. They receive the phone's notification address and the notice's text, which never includes names or health information. Browser notices to gym staff are encrypted so the browser's notification service can't read them.
• YouTube (Google) plays exercise videos. On our website we use YouTube's privacy-enhanced player. In the iPhone app, YouTube's player may receive your phone's IP address and set its own cookies, under Google's privacy policy.
• Have I Been Pwned checks new passwords against known data breaches. It receives only a short fragment of a scrambled form of the password, never the password itself.
• Firebase Hosting (Google) serves our public website and keeps its own request logs.
• Google Workspace (Google) holds our email, so it receives whatever you send us at our support address.

When the law requires it. We may share information when the law requires it, to protect someone's safety, or to protect our rights.

If our business changes hands. If Quest Labs, or the part of it that runs Steelset, is sold, merged, or otherwise transferred, your information is transferred with the business to the new owner.

Health information

Some of what Steelset holds is about your health: body weight, injuries, and pain you report during a workout. We ask for your consent before collecting it; for a gym athlete, Steelset asks on the gym's behalf and keeps the record. We use it only to provide the service (your trainer's alerts and programs, and your own AI plans), never for advertising, and we never sell it. Your gym's staff see it as described above. You can see, download, and delete it at any time (see "Your choices").

No one at Quest Labs reviews it medically. Pain reports and alerts go to your trainer automatically and aren't watched for emergencies. If you're hurt, get medical help.

For more about this information, see our Consumer health data policy.

Children and teenagers

Independent accounts are for adults (18 and older). AI plans are for adults only.

Athletes aged 13 to 17 use Steelset only through their gym, and only after a parent or legal guardian agrees on a page that explains what is collected. The guardian pays for the athlete's membership, and payment emails go to the guardian. The guardian can withdraw consent at any time by contacting the gym, which stops the athlete's account.

Children under 13 use Steelset only at a gym that Quest Labs has allowed to add them, and only with verifiable consent from a parent or legal guardian, as the Children's Online Privacy Protection Act (COPPA) requires:

• Before consent, the gym gives us only the child's name, date of birth, and sign-in email, and the parent's name and email, so we can email the parent a notice. If the signed consent form doesn't come back within 30 days of the last notice, we delete those details.
• The parent consents by signing a printed form and returning it to the gym, which keeps it. Only then can the child's account be used.
• After consent, we collect what we collect about any gym athlete (above), and a phone number only if the gym adds one. Children's information is never sent to an AI service, sold, or used for advertising.
• A parent can ask the gym, or us, at any time to see what is stored about their child, to delete it, or to stop further collection. Withdrawing consent stops the child's account.
• We keep a child's information only as long as the account exists, and delete it as described in "How long we keep it".

The operator responsible for children's information is QuestLabs LLC; see "Contact us" below for our address, telephone number, and email.

If you believe a child under 13 is using Steelset without a parent's consent, contact us and we will delete the account.

How long we keep it

• Your account and training information: as long as your account exists.
• Notices: 30 days.
• A child's details without a signed consent form: 30 days after the last notice.
• Sign-in records (each device's IP address and description): until you sign out, or 30 days after you last used that device.
• Our server logs: 30 days.
• Database backups: up to 14 days, so deleted information leaves our backups within 14 days.
• Emails at Postmark: up to 45 days.
• What we send Anthropic: up to 30 days, except where Anthropic must keep it longer to enforce its usage policy or by law.
• Copies your gym downloads: a copy of your information that your gym downloads is the gym's responsibility.
• Emails you send us: as long as we need to answer you and keep a record of your request.

When an account is deleted, we erase the person's name, email, phone, birth date, sign-in methods, devices, and notices, and delete their profile, injuries, programs, workouts, alerts, AI plan answers, and consents. The gym keeps the records it needs for its accounts, attached to a nameless "Deleted athlete" placeholder: memberships with their prices and dates and their automatic-renewal agreements, payments made at the gym, late-cancellation fees, and past class bookings. Programs a deleted trainer wrote stay with their athletes, shown as written by "a former staff member". Stripe keeps its own payment records, as the law requires, but we delete the saved card and email there. We keep a record that a copy was given or an account deleted (what, when, and by whom), without personal details, and our AI usage counts lose any link to the person.

Your choices

• See and download your information. In the app, go to Account and then "Everything stored about you" (you can share a copy). On the website, go to Account and then "Your data", which you can print or download as a file. Gym administrators can do the same for anyone in their gym, for example when a guardian asks.
• Delete your account. In the app, go to Account and then "Delete my account". It happens at once. Any membership or subscription ends right away, with no refund for the rest of the period (your gym may refund you). Gym staff and former athletes can ask their gym administrator, who can delete people who are no longer active.
• Correct your information. Change your password, authenticator app, and passkeys on the website's Account page. To correct your name or profile, ask your trainer or gym administrator; independent athletes, email us. To change your email address, email us. Independent athletes give new answers with each AI plan.
• Notifications. Turn them on or off for each phone or browser.
• Ask us. Email us with any request about your information, and we will confirm we received it within 7 days and complete it within 30 days. If you train with a gym, we pass your request to your gym within 3 business days and help it answer. We will need to confirm the request comes from you.

Appeals. If we decline your request, you can appeal by emailing us with "Appeal" in the subject line; if you train with a gym, appeal to your gym, which decides it. We'll answer in writing within 45 days and explain our decision. If you disagree with our answer to your appeal, you can contact your state's attorney general: in Virginia, at oag.state.va.us; in Washington, at atg.wa.gov.

We give these choices to everyone, wherever they live.

Security

Information travels encrypted between your device and our servers, and our hosting and database providers encrypt it where it's stored. Staff accounts must set up an authenticator app. Each gym's information is kept apart from every other gym's by the database itself. Passwords are checked against known data breaches. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Where your information is stored

In the United States. Steelset is offered in the United States only.

Cookies

The Steelset website sets one cookie, to keep you signed in, and remembers a few screen settings in your browser. Our public website sets no cookies. We use no advertising or analytics cookies, and if we ever add analytics, we'll update this policy first. YouTube's player in the iPhone app may set its own, as described above.

Changes to this policy

Each time we change this policy, we update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect if we can, and otherwise when it takes effect. If a change affects how we collect, use, or share children's information, we will ask for a parent's consent again where the law requires it.

Contact us

QuestLabs LLC
5913 Harbour Park Drive, Midlothian, VA 23112
Telephone: 804-601-0180
Email: support@steelsetperformance.com