Privacy Policy

Last updated: 9 October 2026

Overlood is a workout tracking app operated by Ruben Eppink, based in the Netherlands ("Overlood", "we", "us"). This policy explains what personal data we collect through the Overlood mobile app and this website (overlood.com), and what we do with it.

We are the data controller for the data described here. You can reach us at support@overlood.com.

The short version

• We collect what the app needs to work: your account and your training data.
• We run no advertising, no ad trackers, and no third-party analytics. This website sets no cookies.
• We never sell your data.
• Your data is stored in the European Union (Microsoft Azure, West/North Europe).
• Your training data is yours alone — nobody else on Overlood can see it unless you share a routine or program by link, or connect your own AI assistant.

Data we collect

Account and profile

• Email address and display name — needed to create and identify your account. Sign-in is handled by Auth0, our authentication provider.
• Optional profile details — date of birth, height, and biological sex. All optional; the app works without them. We store your date of birth rather than your age so it stays accurate.
• Photos — optional. The camera and photo-library permissions on your phone are used for setting a profile photo, attaching a photo to a custom exercise you created, and saving a workout share card to your camera roll — nothing else; the microphone is never used. Your profile photo and any custom-exercise photos are stored in your private file storage, where only you can see them. Saving a share card writes that image to your device only; the card is never uploaded or shared with us.
• Preferences — units, language, rest timer, and similar app settings.
• Notifications — optional. If you allow them, your phone shows a notification when a rest timer runs out, and a card with your current set while a workout is running. They are created on your device and never leave it: no push service, no server, nothing collected. Say no and the app works the same, and it won’t ask again; you can change it any time in your phone’s settings. On Android the app also declares two permissions that grant access to no data and that your phone never asks you to approve: SCHEDULE_EXACT_ALARM, so a rest cue arrives at the second it is due, and POST_PROMOTED_NOTIFICATIONS, so the workout card can show in the status bar and on the lock screen.

Training data

• Workouts — exercises, sets, weights, reps, effort ratings (RPE/RIR), timestamps, duration, and any notes you write. Timestamps are stored in your device's local time, and each set you tick off records the moment you ticked it, so rest times and how long an exercise took can be worked out later.
• Routines and programs you create or follow.
• Pinned notes — a note you pin to an exercise, which shows every time you train that exercise. It stays private to you and is erased with your account.
• Favorites — the exercises you mark as favorites, so you find them fast. They stay private to you and are erased with your account.
• Body metrics — bodyweight, body measurements, and body-fat entries, if you log them.
• Imported history — if you import workout history from another app (such as Hevy or Strong), we store the parsed workout data. The uploaded file itself is discarded once the import finishes. The import also records your device's timezone to date your workouts correctly.
• Export files sent to support — if an import fails and you email us your export file, we use it only to fix that import and delete the email once it’s fixed. Any test file we build from it uses made-up data, never yours.

Collected automatically

• Request logs — our servers record the method, path, response status, and duration of each API call, plus the app version and platform the mobile app reports so we know which versions are still in use. Each record also carries your account ID and a trace ID that the mobile app attaches to any crash report it sends, so one problem can be followed from your device to our server, together with the database calls that request made (timing only, never the data in them). When a request fails unexpectedly, the error and its stack trace are recorded with those same IDs. These records are kept for 30 days.
• Device and app details — when you first sign in from the mobile app, we store the platform (iOS or Android), the app version, your device language, and your device's timezone on your account, so we know which platforms and languages to support. The timezone is refreshed if your device reports a different one.
• Last active day — we record the day you last used the app (once per day, never the individual requests), so we can see how many people keep training with Overlood.
• IP address — used transiently for rate limiting (protecting the service from abuse).
• Crash reports (mobile app only) — if the app crashes, a crash report is sent to Sentry so we can fix the bug. This is active only in release builds, and we have configured it not to include personally identifying information.

Data we do not collect

• No advertising identifiers, ad networks, or marketing trackers.
• No third-party analytics (no Google Analytics, no Amplitude, or similar).
• No location data, no contacts, no health-platform data (Apple Health / Google Fit).
• No payment data — Overlood is currently free.

How we use your data

• To provide the service — storing and syncing your training data and powering your progress charts and personal records. Legal basis: performance of our contract with you.
• To keep the service secure and working — rate limiting, request logs, and crash reports. Legal basis: our legitimate interest in running a secure, reliable service.
• Anonymous benchmarks (opt-in only) — the app has a setting, off by default, to contribute your demographics anonymously to future strength benchmarks. Nothing is used for this unless you switch it on. Legal basis: consent, which you can withdraw at any time in the app.

We do not sell your data or use it for advertising.

Sharing

Your training data is private to your account. Other Overlood users cannot see your workouts, body metrics, or profile. If we ever add social or coaching features that share data between users, they will be described here before they launch.

Share links. When you share a routine or program, we save a snapshot of it: its name and description, its exercises, sets and rest times, and your exercise notes. Anyone with the link can open that snapshot in a browser or in the app, without an account. The link is long and unguessable, but whoever receives it can pass it on. The snapshot does not name you, does not change when you edit the original, and expires one year after you create it.

Connecting an AI assistant

You can connect your own AI assistant, such as Claude or ChatGPT, to your Overlood account. Nothing leaves Overlood this way unless you connect one. You add Overlood’s address in the assistant and sign in with your Overlood account; that sign-in screen lists what the assistant may read and change.

• What it can read — your workouts, exercise history, records, routines, programs and targets, your first name, your account’s role (such as athlete or coach), and your units.
• What it can change — it can create and update routines and programs, and set targets.
• Where your data goes — whatever the assistant reads ends up with the company that provides it, and is handled under that company’s terms and privacy policy, not ours.
• Disconnecting — signing out of the Overlood app does not disconnect your assistant. You disconnect it inside the assistant, in its own settings.
• What we keep — nothing about your conversation with the assistant. For each request it makes, we log only which tool it used and whether that worked, next to the request logs described above.

Service providers

We use a small number of processors to run Overlood. They process data on our behalf and are bound by data-processing agreements:

Where a provider processes data outside the European Economic Area, transfers rely on recognised safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

Cookies

This website (overlood.com) sets no cookies and runs no trackers — that is why there is no cookie banner. The mobile app does not use cookies; it stores its sign-in tokens in your device's secure storage.

Retention and deletion

• Your account and training data — including the device details and last active day stored on your account — are kept for as long as your account exists, and are erased with it.
• After an account is erased we keep one anonymous statistics record — the date the account was created, the date it was deleted, whether it was a coach or an athlete account, and how many workouts it logged. It contains nothing that identifies you and cannot be linked back to you.
• Server request logs are deleted after 30 days.
• Abandoned photo uploads are cleaned up after 24 hours.
• Share-link snapshots expire one year after they are created and can no longer be opened after that.
• You can delete individual records — workouts, body metrics, routines, programs, your profile photo, custom-exercise photos — directly in the app at any time.
• To delete your entire account and all associated data, use the Delete account option in the app's profile settings, or — without the app — the account deletion page on this site. Erasure is immediate and irreversible. You can also email support@overlood.com from your account's email address.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data erased;
• restrict or object to processing;
• receive your data in a portable format — the app exports your completed workouts as a CSV file, and everything else we hold about you, including workouts you deleted in the app, is yours on request by email (below);
• withdraw consent (for the opt-in benchmark setting) at any time;
• lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

To exercise any of these rights, email support@overlood.com. We respond within one month.

Age

Overlood is not intended for children under 16. We do not knowingly collect data from anyone under 16; if you believe we have, contact us and we will delete it.

Security

All traffic is encrypted in transit (HTTPS). Data is stored on Microsoft Azure with access limited to what the service needs. Sign-in credentials are handled by Auth0 — we never see or store your password. On mobile, tokens live in your device's secure storage.

Changes to this policy

When we change this policy, we update the date at the top. For material changes — new data collected, a new provider, or new sharing — we will notify you in the app or by email before the change takes effect.

Contact

Ruben Eppink (Overlood), the Netherlands — support@overlood.com