Privacy

Orbitrain (“we”, “us”) runs orbitrain.com and the Orbitrain app. We decide how your personal information is used, which makes us the “controller” under UK and EU data protection law. For anything in this policy, email hello@orbitrain.com.

In short: we keep what Orbitrain needs to plan and remember your training, we don’t sell it, we don’t show adverts, and we don’t track you. We only count, anonymously, how often things are used, to see what helps (see Technical information).

YOUR ACCOUNT

When you sign in with Google, Google shares your name, email address, profile picture link and an account identifier with us. We use them to know it’s you and to send account emails. We never see your Google password.

YOUR HOUSEHOLD

For each person you add: the name you give them, their colour, training level, the kit they own (for example dumbbell weights), training days, weekly goal and current plan. For the TV: voice, sound and display settings, and your time zone.

TRAINING RECORDS

Each session: the exercises, sets, weights and repetitions, how each set felt, personal bests, workouts you save, and exercises you mark “It hurts”.

REMINDERS

If you turn reminders on: the email address to send them to, the days and time, a record of each email we send, and whether you chose to skip a day or be reminded tomorrow.

PHONE REMOTE

Pairing creates random identifiers and signed tokens for your TV and phone, kept on those devices. The six-digit code exists for a few minutes only. Our relay passes button presses and the current screen between the two devices as they happen and doesn’t store them. Your phone also tells the TV its model and browser, and any name you give it, so you can tell phones apart in Settings; the TV keeps that on its own device.

MESSAGES TO US

If you use the contact form or email us: your name, email address and what you write.

TECHNICAL INFORMATION

Like any website, the services that host Orbitrain receive your IP address and basic request details, such as browser type and time, and keep them briefly in security logs.

Usage counts: we count which buttons are pressed and which screens are reached, by name, page and day only, such as “Start free pressed on the home page”. The counts include no cookies, identifiers, IP addresses or account details, and can’t be linked to you. If your browser is set to Do Not Track or Global Privacy Control, it sends none. Cloudflare, our host, also counts page visits for us without cookies.

Training records, and especially exercises marked “It hurts”, can reveal something about a person’s health. We treat this as special category data. We use it only to plan safer sessions for that person, never for anything else, and never share it except with the providers that store it for us.

We rely on your explicit consent, which you give when you choose to record a session or mark an exercise. You can withdraw it at any time by bringing an exercise back in Settings, removing sessions or people, or asking us to delete your data.

• To run Orbitrain for you: plan sessions, set weights, keep progress and sync your household across devices. Legal basis: performing our contract with you.
• To send the welcome email and account messages, such as notice of changes to these policies. Legal basis: performing our contract.
• To send reminders and the Sunday summary, only if you turn them on. Legal basis: your consent, which you can withdraw in Settings › Reminders.
• To answer your messages. Legal basis: our legitimate interest in helping the people who contact us.
• To keep Orbitrain secure: prevent abuse, rate-limit requests and fix faults. Legal basis: our legitimate interest in a safe, working service.
• To meet legal obligations, where the law requires us to keep or disclose information.

We do not sell personal information, use it for advertising, or make automated decisions about you that have legal or similarly significant effects. Adjusting your next session’s weights from how a set felt is the core of the service, and you can always change them.

These providers process information on our behalf, under contracts that require them to protect it and use it only to provide their service to us:

• Supabase: sign-in and the database that stores accounts, households and training records. Stored in London, United Kingdom (Amazon Web Services).
• Cloudflare: hosts and delivers the website, app, exercise demonstrations and sounds, through its global network, and checks that messages sent through our contact form come from a person (Cloudflare Turnstile).
• Railway: runs our phone-remote relay and the service that sends reminder and welcome emails, in the Netherlands.
• Resend: delivers our emails, in the United States.
• Google: provides “Sign in with Google”.

Some of these companies are based in, or may access data from, the United States or other countries outside the UK and European Economic Area. Where that happens, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension) or by the standard contractual clauses approved by the UK and EU authorities.

We may also disclose information if the law requires it, or to protect someone’s safety. If Orbitrain were ever sold or merged, your information would pass to the new owner only under this policy, and we would tell you first.

To work quickly and offline, Orbitrain stores some information in your browser’s local storage on the laptop and phone you use: a copy of your household, any session in progress, your sign-in session, setup progress, and the TV and phone remote identifiers. It also keeps the app, exercise demonstrations and sounds in the browser’s offline cache.

This storage is strictly necessary for the service you ask for, so we don’t ask for consent and we don’t use cookies for analytics or advertising. Our hosting provider may set a strictly necessary security cookie to protect the site from abuse. You can clear all of this at any time in your browser’s settings for orbitrain.com. A household that isn’t saved to an account is then gone for good.

• Account, household and training records: for as long as you have an account. Delete account in Settings › Account deletes it straight away; if you ask us by email, we delete it within 30 days. Either way, it leaves our providers’ backups within a further 30 days.
• Sessions or people you remove on the TV: removed from your account at the next sync.
• Records of reminder emails sent and skip choices: 12 months.
• Messages to us: 24 months after the conversation ends, so we can follow up on earlier questions.
• Security logs held by our hosting providers: for the short periods those providers set, usually no more than 30 days.
• Usage counts: kept as totals, which contain no personal information.

You have the right to ask for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did before.

You can delete your account yourself at any time in Settings › Account on the TV. To use any of these rights, email hello@orbitrain.com from the address you sign in with. We will reply within one month. There is no charge.

If you are unhappy with how we handle your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, or, if you live in the European Union, to the data protection authority where you live.

Accounts are only for adults. A parent or guardian may add a child to their household. We then keep only what the parent enters, such as a name and training records, and we never email a child unless the parent sets up reminders to that child’s address. If you think a child has created an account, email us and we will delete it.

Information travels encrypted between your devices and our services. Each household’s data in our database can only be read by its own account, phone-remote tokens are signed so they can’t be forged, and only the few people who run Orbitrain can reach our systems, using strong authentication. No system is perfectly secure, so if a breach ever puts your information at risk we will tell you and the regulator as the law requires.

When Orbitrain changes how it uses information we will update this policy and the date at the top. If a change is significant, we will email the account holder before it takes effect.