Privacy Policy

Michael Jensen, Hummeltoftevej, 2830 Virum, Denmark, operates Prime Capacity as a personal project and is the data controller. Contact: privacy@primecapacity.app

A private pilot, by invitation only, free to use. There is no public signup.

Your account: your email address, a hashed password, and session information, all handled by Supabase Auth. Your password is stored as a bcrypt hash and is never visible to the app or to me.

Your profile: year of birth, sex, height, training experience, primary goal, activity level and weekly training target.

Your starting estimates: approximate one-rep maximums for the squat, bench press and deadlift, and an estimated VO₂ max.

Your training: workouts, exercises, sets, weights, reps, session notes, workout templates, bodyweight entries, readiness entries you record, and goals you set.

What the app works out from that: a daily readiness score with the muscle-group values behind it, strength-age snapshots, and the version of the calculation used.

Historical records: two older tables of readiness feedback and self-scored readiness, kept read-only as a record of how earlier versions of the app behaved.

You can download your profile and all of your training data at any time from your profile page, as a single file, together with the email address on your account. It does not include your password — which is stored only as a hash and cannot be read by anyone — or your sign-in session records, which are short-lived and held by Supabase Auth.

Your training data, profile and account are processed to provide the app you signed up for — the legal basis is performance of a contract (GDPR Article 6(1)(b)).

Your year of birth, sex, height, bodyweight and the fitness estimates that go with them say something about your body. These are processed on the basis of your explicit consent, given when you completed onboarding. You can withdraw consent at any time by emailing privacy@primecapacity.app; withdrawing it means your account is closed and the data deleted, because the app cannot compute anything meaningful without those figures.

Supabase — database and authentication, hosted in the EU (Frankfurt).

Vercel — application hosting, serverless functions configured to the EU (Frankfurt).

Resend — sends account emails such as password resets. A data processing agreement is in place.

Nothing is sold, and nothing is shared for advertising.

Only the cookies that keep you signed in. No analytics, no tracking, no third-party scripts.

For as long as your account exists. If the pilot ends, participants will be told, and accounts and their data deleted within 30 days of that notice.

See and download your data — from your profile page, at any time.

Correct it — edit your profile and training records in the app.

Have it deleted — email privacy@primecapacity.app. Your account and everything in it will be deleted within 30 days.

Take it elsewhere — the export is machine-readable JSON.

Object, or ask that processing be restricted — email the same address.

Complain — to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk.

Your data is isolated at the database level so that only your own account can read it. Everything is hosted in the EU. Prime Capacity is a personal project run by one person; it is built carefully, but it carries no formal security certification.

This page is dated. If anything material changes, pilot users will be emailed.