Still Varsity privacy policy

Last updated 5 November 2026. Still Varsity is a personal training app at stillvarsity.app.

What we collect

• Account: your email address and first name. If you sign in with email, a scrambled (hashed) version of your password; we never store the password itself. If you sign in with Google, we receive your email address and first name from Google, and nothing else.
• What you save in the app: your goals and settings, workout plan and history, food and water logs, fasts, measurements and weigh-ins, and reminder preferences.
• Athlete Passport photo (optional): if you upload a photo, a small cropped copy is stored with your account. Others can see it only if you make your Passport public and turn on showing your photo. You can remove it at any time.
• Foods you share: when you add your own food, you can choose to share it. A shared food (its name, serving and nutrition numbers) is visible to everyone using the app. We keep an anonymous device identifier with it to prevent abuse; it is never shown to others. Sharing is on by default for a new food and you can turn it off before saving. Other people can report a shared food, and foods reported by several people are hidden.
• The Club (when it is open): if you join, your posts, comments, likes, saves, who you follow, who you block or mute, and the reports you make. Your display name, username and avatar are shown with your posts and comments, and anyone you allow can see them. Depending on the Club's moderation mode, flagged posts and comments may be held for review or remain visible until reports are reviewed. Moderators can see reported and held content and record their decisions, which you can see and appeal. We store your confirmation that you are 18 or older (you declare it yourself; we do not verify it) and the version of the Community Guidelines you accepted. Your workouts, body measurements and health details are never shared through the Club unless you choose to share a specific achievement.
• Messages, groups and meet-ups: direct messages are stored on our servers so you and the other person can read them; only the two of you can see them, and a moderator can open a message only after it is reported. Deleting a message hides it from both of you, but we keep the text for safety review. Groups, group posts, and meet-ups (title, time, place you write, who said they are going) are visible to the people the group or meet-up is open to. We also keep an activity record of what happens in the Club (for example a post, follow, message sent, group or meet-up created, or report made, with who and when) without the text of posts or messages. A copy is kept in private storage so we can investigate problems and answer legal requests. We keep it while we need it for safety and legal reasons.
• Photos and videos (when turned on): photos and short videos you post in the Club, and your profile photo, are stored privately and shown to other members through short-lived links. They appear as soon as they are uploaded; members can report them and moderators review reports. If an automated image-screening service is switched on (currently OpenAI’s moderation service), photos are also sent to it. Photos are re-saved on your device without location or camera details; videos are not altered, so a video can contain its own location data. We keep a record of each screening result and each moderator decision. Rejected files are deleted after 30 days unless they must be kept to meet a legal duty, such as reporting required by law, in which case they are kept restricted for at least one year.
• Reminders and coach check-ins: if you turn on workout reminders, your browser's push notification address, your chosen reminder time and days, and your time zone. If you also leave coach check-ins on, the app sends our server a small summary so your coach can message you with the app closed: your calorie total and target for the day and how many meals were logged (never what you ate), whether yesterday was logged, your fasting schedule and the start and end times of a fast in progress, and which coach picture to show. You can turn these off in Settings.
• Run tracking: if you turn on distance tracking for a run or walk, the app reads your phone's location during that run to measure distance, pace and route. The route stays on your phone; only the totals (time and distance) are saved to your account, and challenge totals if you join one.
• Club notifications: if you turn them on, your device's push address is linked to your Club account so we can tell you about likes, comments, follows, tags and messages. Message text is never put in a notification. Notifications are kept in your Club account until you delete it.
• Challenges and leaderboards: if you join a Club challenge, the app sends totals worked out on your device (workouts, miles, fasts, and pounds and percent of body weight lost; never your weight or logs). Totals appear on the challenge leaderboard with your Club name unless you choose to hide yourself from it.
• Technical: standard server logs such as IP address and time, used to keep the service running and to prevent abuse.

How we use it

Only to run the app for you: to keep your data available on your devices, to build and adjust your training plan, and to send the reminders you asked for. We do not sell your data, show ads, or use it for advertising or to train AI models.

Food lookups

When you scan a barcode or search for a food, only the barcode number or the search words are sent to our server, which asks Open Food Facts and the USDA FoodData Central database. Your account is not attached to those requests.

Password recovery

When email recovery is enabled and you request a reset, we send your email address and a reset link through our email delivery provider, Resend. Links expire after 30 minutes and can be used once. A successful reset signs out existing sessions. If recovery is not configured, the app explains that email reset is unavailable.

Where it is stored and for how long

Your data is stored on our hosting provider's servers (Railway). It is kept while your account is active. An account that has not been opened for two years is deleted automatically, along with its standard account data, unless an existing preservation hold requires a review first. Independent safety logs and private archives may remain as described above.

Your choices

• Request account deletion in Settings, Account, Delete my account. Existing preservation holds may delay removal until review; the app will tell you when review is required. Independent safety logs and archives may be retained as described above.
• Turn reminders, coach check-ins and Club notifications off in Settings, or block notifications in your browser. Leave a challenge track at any time.
• Use the app without an account; in that case your data stays on your device only.

Health information

Still Varsity gives general fitness guidance. It is not medical advice, and it does not diagnose or treat any condition. Talk to a doctor or physical therapist before starting a new program, especially if you have an injury or health condition.

Children

The app is not meant for children under 13, and we do not knowingly collect their data.

Changes and contact

If this policy changes, we will update the date above. Questions or requests: support@stillvarsity.app.