Privacy Policy — 212 VBT

Last updated: November 15, 2026 (account emails sent through Resend; web page to delete your account; full list of synced fields; app menus; pages moved to 212vbt.com)

212 VBT ("the app") measures barbell speed from videos of your lifting sets. This policy explains, in plain words, what data the app uses, where it goes, and what it does not do.

Summary

• An account is required. You sign in with your email and a password, with Google or (when offered) with Apple. Your account (first name, last name, email), the optional profile you fill in and your training numbers (sessions, sets, loads, RPE, reps and bar speeds, program) are stored on our server, so you find them on all your phones. See "Your account and sync".
• Your videos never go to our account server. They stay on your phone (the only exception is the beta, see below). All analysis runs on your phone. The app has no analytics and no advertising tools.
• Beta test: joining the beta means sending your set videos. The beta exists to train the app on real lifts, so the beta can only be used after you agree (box unchecked until you check it). Your set videos and their analysis are sent over Wi-Fi to our storage, used only to improve the app's models, and you can stop, delete them and leave the beta at any time (see "Helping train the app"). The public version of the app will not require it.
• We never sell or share your data, and never use it for advertising.

Data the app uses

All analysis runs on your device, including reading the text of a program screenshot (Apple Vision on iPhone, Google ML Kit's on-device text recognition on Android, built into the app). Nothing is uploaded to process it.

Your account and sync

• Why an account: so your history, profile and program follow you on all your phones and are not lost when you change phone. The app needs an account to be used.
• Signing in: Google Firebase Authentication. Accounts are managed by Firebase Authentication, a service of Google. When you create an account with your email and a password, Firebase stores your email, a protected (hashed) form of your password and a unique account identifier; we never see your password. If you sign in with Google or Apple, Firebase receives from them a unique identifier, your email and, with Google, your name (with Apple, your name only the first time, if you share it; you can also hide your email behind an Apple relay address). We never receive your Google or Apple password and get access to nothing else in those accounts. Google processes your IP address and device information to protect sign-in from abuse. Firebase may process this data outside the European Union (for example in the United States), under Google's data processing terms and the EU Standard Contractual Clauses.
• Account emails (confirming your email address, resetting a forgotten password) are sent by our server from our own domain (no-reply@212vbt.com) through Resend (resend.com), an email delivery service, from its European region (Ireland), with click and open tracking turned off. Resend receives your email address and the email itself only to deliver it, and keeps a delivery record for a limited time under its data processing terms (Resend, Inc. is a US company: it may process this data outside the European Union, under the EU Standard Contractual Clauses). Your email address is used only to send you these emails: no newsletter, no advertising, no tracking pixel, no remote image. To build the link, our server asks Firebase for a one-time code (with the project's service account; Google sends nothing itself). The link opens our page, which confirms the address or saves the new password directly with Firebase from your browser. To stop abuse (at most 3 emails per hour per address or account, 10 per IP address), our server keeps for 24 hours a non-reversible fingerprint (keyed hash) of the email address or account and of the IP address that asked for an email, never the address or the IP itself. If our email service is unavailable, the app asks Firebase to send the email instead, from a firebaseapp.com address.
• What is stored on our server (Cloudflare D1 database, European Union): your account identifier, first and last name, the optional profile fields you fill in, and the training numbers listed in the table above (sets you marked "Not me" are synced too, with that mark, and never count in your stats). Not your email and not your password (only the 24-hour fingerprint described above).
• What is never stored on our server: your videos, their file names or location on your phone, the detailed analysis drawn on the video (bar path, skeleton), the screenshots of your program, your photo library, your location or your contacts.
• Security: all traffic is encrypted (HTTPS). Each request carries a short-lived sign-in token from Firebase, checked by our server; each request only ever reads or writes the data of the signed-in account. Access to the database is limited to the developer's Cloudflare account. Like any internet service, Cloudflare's network sees your IP address when the app connects; our server does not log it, and keeps it only as the 24-hour fingerprint described above when you ask for an account email.
• How long: as long as you keep your account. When you delete something in the app, it is deleted from the server at the next sync (only a marker without content, saying that this item was deleted, is kept up to 400 days so your other phones delete it too).
• Legal basis (GDPR): the account and the sync are needed to provide the app you asked for (performance of a contract, art. 6(1)(b)). Some optional profile fields and your training numbers may say something about your health and fitness: they are processed only to provide the service, with your explicit consent (art. 9(2)(a)) given when you create your account and when you fill them in; you can remove them at any time (clear a profile field, delete a set, or delete your account).
• Who can see it: only you, from your phones. The developer can access the database only to keep the service running (fixing a problem, restoring a backup), never to read your training for another purpose. We never sell or share it, and never use it for advertising. Processors: Google (Firebase Authentication: sign-in, one-time codes of the account emails, and those emails if our own sending is unavailable), Cloudflare (server and database), Resend (sending of the account emails), and Apple only if you sign in with Apple.

Helping train the app (beta)

To make plate and skeleton detection work in more gyms and camera angles, the beta is a test program: taking part means sending your set videos. When you first open the beta, you check "I am 16 or older and I agree…" and tap "Join the beta"; without it, the beta cannot be used. If you do not want to share videos, do not join the beta and wait for the public version, where sending will be optional.

• What is sent: the video of each set (including the ones already in the app), and with it the lift and variation, load, RPE, set type, the day (not the time), the plate you marked and the analysis results (bar path, speeds, reps, body landmarks). No name, email, phone identifier, location or contacts. People filmed in the video (you, and anyone in the background) may be recognizable.
• Someone else's set: if someone else lifts (a friend you film), mark the set "Not me" in the app: it is then never sent.
• When: only on Wi-Fi, while the app is open.
• Where: first a private storage bucket at Cloudflare (R2, Western Europe), only in transit: the developer copies the files to their own computer (encrypted transfer) and they are then deleted from Cloudflare. Only the developer can read them. Each phone gets a random secret code: it lets your phone delete what it sent, and it is not linked to who you are.
• Why: only to train and test the app's own models (plate detection, skeleton, bar tracking). Never sold, never shared, never used for advertising. Pictures may be used to illustrate a detection error inside the development team, never published.
• How long: 24 months at most, then deleted automatically (also on the developer's computer).
• Stopping: you can turn sending off at any time (Me > Beta > "Help train the app"); during the beta this means leaving the beta, and the app locks until you join again (your sets stay on your phone). "Delete everything I sent" deletes every video and analysis your phone sent from Cloudflare right away, and from the developer's computer, with everything derived from them (training pictures and labels), at the next copy (within a week). Models already trained before your request are not retrained. You can also write to us (contact below) to access or delete your data.
• Legal basis (GDPR): your consent when you join the beta test, which you can withdraw at any time (by leaving the beta, see "Stopping"). You must be 16 or older to join the beta.

Sharing

Apart from your account sync and "Helping train the app" above, the app only shares something when you tap "Share" or "Send to my coach": your phone's share sheet opens and you choose where it goes (messages, email, social networks, AirDrop...). This can be a video (raw or with the analysis drawn on it) or your weekly training report (text or a spreadsheet file with your sets, loads, RPE and bar speeds). The app never shares anything on its own. Your coach's email, if you enter it in your profile, is only stored: the app never writes to your coach by itself.

Body pose detection (the skeleton on the video)

The skeleton drawn on your videos, the plate detection and the person detection are computed on your device by open-source models built into the app (RTMPose and YOLOX, Apache 2.0 license, plus our own plate detector). They run offline and send nothing to anyone: no images, no statistics. Google ML Kit (program screenshots, Android) normally sends anonymous usage statistics to Google; the app removes the component that sends them, so nothing leaves your phone.

Backups

• The app's copy of your videos is excluded from cloud backups (Google Drive backup on Android, iCloud backup on iPhone).
• Videos recorded in the app are also in your photo library. If you use a cloud photo service (iCloud Photos, Google Photos), your phone may sync them like any other video you film; this is controlled in your phone's settings, not by the app.
• Your training numbers are also on our server (see "Your account and sync"). On your phone, they (and the analysis results) can be included in your phone's own backup, if you have backups turned on, so you keep your history when you change phones. That backup belongs to your Google or Apple account; we have no access to it. You control it in your phone's settings.

Permissions

• Camera: to film your sets. Videos are recorded without sound; the app does not use the microphone.
• Photos / videos: only the videos and screenshots you choose with the system picker, to analyze them. The app cannot browse your library.
• Add to photo library: to save the videos you record in the app (and the ones you choose to save) to your photo library. The app only adds videos; it does not read your library.
• Notifications: to tell you when an analysis is finished. Optional.
• Background work (Android: "foreground service"): only while a set is being analyzed, with a visible notification, so the analysis can finish if you leave the app. On iPhone, the app asks iOS for a short time to finish an analysis in the background.
• Internet and network state: to sign in and sync your account, to send your set videos if you agreed to help train the app, and to check that you are on Wi-Fi.

Update check (iPhone, beta): when the app starts, it asks our server (Cloudflare) for the number of the latest beta version, to tell you when an update is available in TestFlight. Nothing about you or your training is sent with this request; like any internet request, it reveals your IP address to Cloudflare, which we do not log or keep.

The app does not use your location, contacts, microphone or any advertising identifier.

Deleting your data

• Delete a set in the app (trash icon on the set screen), a session or the program: the app's copy of its video and its data are removed once the "Undo" banner is gone (if the app is closed before that, at its next start). Temporary copies of a video made while you record, trim, import or share it are also deleted. A copy saved to your photo library stays there until you delete it from your gallery.
• Uninstalling the app removes all of its data from your device, but not your account: your training numbers stay on our server until you delete your account.
• Signing out (Me > My account > "Sign out"): the app asks whether to keep your sets and videos on this phone or delete them from this phone; nothing is deleted from our server. If someone else then signs in on this phone, the app asks whether to add the sets left on the phone to their account or to delete them: they are never added without asking.
• Delete your account in the app (Me > My account > "Delete my account"): your profile and all your synced training numbers are deleted from our server immediately, then your Firebase account (email, password, sign-in methods) is deleted. If you used Sign in with Apple, the app also asks Apple to revoke the app's access. Our database provider keeps an automatic recovery history for up to 7 days, used only to recover from a failure; after that, the deleted data is gone for good. Our server only keeps, for 400 days, a non-reversible fingerprint of your account identifier with the deletion date, so that a phone still signed in cannot upload your data again.
• Without the app: on the page https://212vbt.com/account/delete you can delete an email-and-password account by signing in (the same deletion as in the app; nothing you type there is stored). Accounts that use Google or Apple are deleted from the app, or ask us by email (contact below): we handle requests within 30 days.
• Get a copy of your data: "Export my data" (Me > My account) gives you a file (JSON) with everything our server holds about you.
• Videos you sent to help train the app: Me > Beta > "Help train the app" > "Delete everything I sent" (do it before uninstalling: the secret code that proves the videos are yours is on your phone), or write to us.

Security

Your data is stored in the app's private storage, protected by your phone's operating system: other apps cannot read it. On our server, see "Security" in "Your account and sync"; changing your password signs out your other phones. Videos you choose to send are transferred encrypted (HTTPS) to a private bucket that is not publicly readable; the app itself can only add files, never read them. Protect access to your phone with a lock screen: anyone who can unlock your phone can open the app.

Children

The app is not directed at children under 13. Creating an account and sending videos to help train the app require being 16 or older.

Changes

This policy is published at https://212vbt.com/privacy. If it changes, the new version will be published at the same address with a new date. A change that sends data off your phone would always be announced in the app first.

Contact

Questions: contact@212vbt.com