Privacy Policy

Who we are

Brolick is run by Spinworth Limited, the data controller for your personal data (company number 17449293, registered office 12 Edridge Court, Ley Farm Close, Watford, England, WD25 9BN). For anything about your data, email support@brolick.co.uk.

What we collect

When you register, we store your email address, a securely hashed version of your password (we never store your password itself), and an optional display name. As you use Brolick, we store the training data you enter: workouts, sets, reps, weights, RIR/RPE, routines, custom exercises, programmes, and any questions you ask Brolick Coach. If you subscribe to Brolick Pro, we keep a record of your subscription (plan, dates and status).

When something goes wrong, we record technical details of the error so we can fix it (see Sentry below). Our servers briefly see your IP address with every request, as any website does.

What we don't collect

We do not collect your location, contacts, photos, or advertising identifiers. We do not use tracking or advertising cookies, only the functional cookies needed to keep you signed in and remember that you've seen the welcome screens. We have no analytics or advertising tools.

How we use it, and why we're allowed to

Your training data is used only to provide Brolick's features back to you: workout tracking, personal records, history, weekly/monthly/yearly training insights, Brolick Coach's recommendations and Adaptive Training. Brolick's insights and recommendations come from Brolick's own training rules applied to your data. Your data is not sent to any AI provider, is not used to train any model, and is never shown to other users.

Under UK data protection law we rely on: contract, to provide the service you signed up for (your account, training data and any subscription); legitimate interests, to keep Brolick secure and working (error monitoring and rate limiting); and legal obligation, for records we must keep about payments.

Who processes it for us

We do not sell your personal data or share it with anyone for marketing. We use these service providers, each only for the job described:

• Vercel hosts the Brolick app and website (servers in London, UK). Every request passes through it.
• Neon runs Brolick's PostgreSQL database (London, UK), where your account and training data are stored.
• Resend delivers account emails, such as a password-reset link you ask for: your email address and that email's content.
• Sentry error monitoring: technical details of an error, your account ID, and browser or device information. It is set up never to receive passwords, tokens or cookies.
• Upstash rate limiting, to stop abuse: short-lived counters keyed by your account ID, your email address (for sign-in attempts) or your IP address (for sign-up and password reset). They expire on their own within a few hours.
• Google Play if you subscribe to Brolick Pro in the Android app, Google takes the payment and manages the subscription. Brolick never sees your card or payment details.
• RevenueCat checks Google Play subscriptions for us: your Brolick account ID and your subscription's purchase records (product, dates, status). No card or payment details.

Some of these providers may process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK's approved contract terms for international transfers.

Other users and your data

Your custom exercises, routines, programmes you author (unless explicitly published), workout history, personal records, and Adaptive Training recommendations are private to your account. Ownership is enforced on every request, so other users cannot view or modify your data through the application.

How long we keep it

We keep your account and training data for as long as your account exists. You can permanently delete your account and all associated data at any time from Account settings. Deletion is immediate and cannot be undone. See Deleting your account for every way to ask, including if you can no longer sign in.

After deletion, copies can remain for a limited time in our database provider's backups and in error reports, until they expire. We never use them to restore a deleted account. Subscription purchase records are kept by Google Play and RevenueCat for as long as payment and tax rules require.

Your rights

You can see your data at any time in the app (History, PRs, Insights), and you can download a copy of everything your account holds from Account settings, as JSON (complete) or CSV (your workout log), on any plan. You also have the right to have your data corrected or deleted, to object to how we use it, and to complain to the UK Information Commissioner's Office (ico.org.uk). To exercise any of these, email support@brolick.co.uk.

Age

Brolick is for adults aged 18 and over. We don't knowingly hold data about anyone younger; if we learn we do, we delete the account.

Security

Data is encrypted in transit. Passwords are hashed with bcrypt and never stored in plain text. All data access is scoped to your account on the server, not just hidden in the interface. On Android, Brolick's sign-in and app data are excluded from device backups and transfers to another phone. See Terms of Service for the limits of what we can guarantee.

Changes

If we change this policy, we'll update the date above, and tell you in the app before any change that affects how your data is used.