Privacy
Effective October 19, 2026
Proofpad is a calisthenics workout log for iPhone. This page says plainly what the app stores, what is public, and how to delete all of it. There are no advertising or analytics SDKs in the app, and nothing is sold or shared for marketing.
Your account
You sign in with Apple, with Google, or with your email address. With Apple we receive Apple's identifier for your account and your email address — the relay address Apple makes for you if you choose Hide My Email — and we do not ask for your name. With Google we receive your Google account's identifier and its email address. With email you type an address and we send a six-digit sign-in code to it; there is no password. We keep an email address only to identify your account, we never show it to anyone, and the sign-in code is the only mail we send. An address is one account however you sign in with it: the address of a Google account, typed in as an email sign-in, opens that same account. You then choose a username, which is public: it names every board entry and profile of yours. Everything else you set in the app — your starred exercises, your daily goals, your saved workouts, the logging-reminder interval, your home region, the Proof tab's period, the name you use in Bouts — is stored with your account, so it follows you to a new phone and leaves with a sign-out.
Your training log
Every workout you record — exercises, sets, reps, holds, the date — is saved on your phone and synced to our servers so it survives a new phone and backs up your log. Custom exercises you add are synced the same way. Deleting an exercise in the app erases every set of it from every workout, on your phone and on our servers, and keeps a note of the deleted exercise's name so it stays deleted on every phone you sign in on. Signing out clears the log from that phone; signing back in restores it from our servers.
In the app your saved workouts are called proofs. Your proofs are public by default under your username, so another athlete can open them and see your workouts and records. You can switch this off at any time in Settings → Let anyone see my proofs; your username stays visible, your proofs do not. Workouts you post to a board are always public (see Boards).
Boards
When you post a workout to a regional leaderboard, that workout becomes public on the board. To place you in the right region, the app reads your location once, at the moment you complete a workout that is being posted — never in the background. That single fix is stored privately with the posted workout. It is never shown to anyone, and it is used only to verify the region you compete in.
You can take any post off a board at any time in Settings → My rankings. The board entry is deleted for good; the workout itself stays in your proofs. Whether Proofpad offers to post at all is a setting stored with your account (Settings → Ask me to post to the boards), so it holds on every device you sign in on. Before your first post you agree to the board rules once, in the app; we store the moment you did with your account.
The United States is one region, and local regions open inside it as places get busy; a posted workout stands on its local board (where one is open) and on the national one, from the same single fix. If you train outside the United States, where no board is open yet, nothing is posted — the workout is saved privately to your log like any other. You can ask us to open a board where you train. That records your account and the location fix already read a moment earlier for the board check, so we can see where people are asking. No extra location reading happens for it — but the fix is kept current: each later workout you complete outside a board's reach replaces it with that workout's fix, so the ask follows where you train now. The request stays on file until you delete your account; nothing else removes it. The switch in Settings → Notifications → Tell me when a board opens here only controls whether we notify you — turning it off does not withdraw the request.
You can attach your Instagram handle so it appears beside your name as a link. To prove the account is yours, the app opens a chat with @proofpad and you send one message. Meta delivers that message to our server, which reads the sender's Instagram username from Meta and saves it with Meta's identifier for your account and the time. We act only on that one message — its hidden verification tag — and do not store message content. You can remove the handle at any time in Settings → Instagram → Disconnect. Never share a handle you don't own; only the account that actually sent the message is ever attached. The app offers the connection once, right after you claim your username; we store with your account the moment you answered that offer — connect or skip — and nothing else about it.
Bouts
A Bout is a private competition between friends. When you create or join one, Proofpad stores the Bout's name, format, dates and stakes text, your membership, and a snapshot of each of your workouts that counted toward it. The other members of that Bout can see all of this; nobody else can. Members see each other by Proofpad username. While your log is public, a member can also open it from your name in the Bout — the same log anyone can reach by searching your username — along with your Instagram handle if you linked one. Turn your log private and that door closes.
The invite link shows the Bout's terms and its members' usernames to anyone who has it. Share it with the people you mean to.
You can take a workout off a Bout on the Bout's page, and leave a Bout at any time. Leaving one that has started keeps your counted workouts on its scoreboard, marked as left, and the Bout disappears from your app. Deleting your account removes your membership and workout snapshots from every Bout, and deletes a Bout you created that nobody else joined; a Bout with other members keeps running without you. A Bout's creator can cancel it before it starts.
Notifications
If you allow notifications, we keep your device's push token so the app can tell you when you are overtaken on a board, when a board opens where you train, when a Bout you're in is about to start, about to end, or over, and remind you to log during a workout. Alongside the token we store your device's time zone and up to two training-hour ranges, so a push lands when you actually train and not at 3am. The ranges are worked out on your phone from the times of your recent sets; the set times themselves never leave the phone for this — only the two ranges do.
The board-opens alert is board news: it is sent under Settings → Tell me when my rank falls, and if your posts move onto a newly opened local board you are told without having asked. If you asked from outside the United States, Tell me when a board opens here also has to be on. Each switch lives in Settings → Notifications. The token, time zone and ranges are deleted when every switch is off, when you sign out, and when you delete your account; revoking the permission in iOS ends all of them.
Operations
A few account events send a short internal alert to the people who run Proofpad: signing up, changing your username (the alert says the old and new name), creating a Bout, and deleting your account (the alert names the account, as our record that the deletion happened). These alerts are private, carry only your username (and, on deletion, the note you chose to leave), and exist only so we can see our own service working. When you change your username, we also keep a record of the change — the old name, the new name, and when — which is erased with your account.
Where it lives
Account and training data is stored on infrastructure hosted by Supabase. Apple and Google each handle only their own sign-in; Resend delivers the sign-in code email and sees only the address it is sent to; Apple delivers notifications; Meta delivers the one Instagram message described above. We do not move your data anywhere else.
How long we keep it
Notification queues are working memory: board and Bout alerts are cleared within seven days, delivered or not. The record that a board-opened alert went to you is kept, so it is never sent twice. Everything else — your training log, posted workouts and the location fix stored with them, region requests, your Instagram link, your Bouts — is kept until you delete your account.
Delete your data
In the app: Settings → Account → Delete account. This is immediate and complete — your profile, username, training log, board entries and the location fixes stored with them, region requests, Instagram link, and push token are erased from our servers, and the log on your phone is erased with them. If you leave a note on the way out, it reaches the people who run Proofpad inside the deletion alert and is kept nowhere else.
If you no longer have the app, email support@proofpad.co with your Proofpad username and we will delete the account and everything in it.
Changes
If this page changes in a way that affects you, the date at the top changes with it.
Contact
Questions about this policy, your data, or anything else: support@proofpad.co.