Privacy Policy

This explains what 3SETS knows about you, why, and what you can make us do about it. It covers the 3SETS iPhone app, the 3SETS website and the launch waitlist.

Who holds your data

The data controller is Prius Data Technologies Ltd, company number 16589578, of:

71–75 Shelton Street, Covent Garden, London, WC2H 9JQ

Contact: support@3sets.co.uk

What we collect, and why

Your account — your email address and your name. If you sign in with Apple, Apple gives us your name and either your email address or a private relay address that Apple forwards, and nothing else. Needed to have an account at all. Lawful basis: performance of a contract.

Your profile — your date of birth, and your gender, height, weight, goal and weekly training target if you enter them. Your date of birth confirms you are 13 or over and gives your age. With the rest, it works out your calorie and protein targets and measures your week. Lawful basis: performance of a contract.

Your training — sessions, exercises, sets, reps, weights, distances, times, the gym you name, and any notes you write. Lawful basis: performance of a contract. It is never sold, and nobody else sees it unless you share it on Social.

Workout photos and videos — only the ones you choose to attach to a session. Stored privately against your account. Lawful basis: performance of a contract.

Health and body data — what you eat and drink, body measurements (such as weight, body fat and waist), recovery check-ins (sleep, soreness, fatigue and readiness), and, if you connect it, information from Apple Health, described in its own section below. This is health data, a special category under UK GDPR. Lawful basis: your explicit consent, which you give by choosing to record it or by allowing Apple Health access. You withdraw it by deleting the entries, turning off access in the Health app, or deleting your account.

Food photographs — if you photograph a nutrition label or a meal, or choose one from your library, the picture is sent through our server to Anthropic's Claude AI model to read the label or name the foods. You check the result before anything is saved. Nothing that identifies you is sent with the photograph, and we do not keep it. The app asks your permission before the first photograph is sent. Lawful basis: your explicit consent, given in the app before the first photograph and each time you choose to take or pick one.

Food searches and barcodes — the words you search for and the barcodes you scan are sent to USDA FoodData Central and Open Food Facts to find the food. Neither is told who you are.

Reminders you set — the days, times and notes you choose, and, if you record one, your own voice as the reminder sound, stored privately against your account. Lawful basis: your consent, withdrawn by turning the reminder off or deleting the recording.

Gym Buddy chat — when you chat with your buddy, what you type, your first name and a short summary of today are sent through our server to Anthropic's Claude AI model to write the reply. The summary is: days trained this week, when you last trained and what your next session trains, calories, protein and water against your targets, today's steps, and your recovery score. We do not store the conversation; we only count how many chats you have had each day. Lawful basis: your explicit consent, given each time you choose to chat.

Notifications — if you allow notifications, we store your phone's push token so we can tell you about messages, friend requests and reminders. Turning notifications off stops them.

Camera, microphone and motion — the camera is used for barcodes and for photographs and videos you choose to take. The microphone is used only when you film a set or record a reminder. Motion data stays on your phone.

The website — the "Ask 3SETS" chat on the website sends the questions you type to Anthropic's Claude AI model to write the answer. We do not store the chat and you do not need an account. If you send feedback from the website, we keep your message, the page you sent it from and, only if you give it, your email address, and we email a copy to ourselves so someone reads it. Lawful basis: our legitimate interest in answering questions and improving 3SETS. The stored message is deleted automatically after 48 hours, and we delete the email copy once we have read it.

The launch waitlist — if you leave your email on the website, we keep that address, whether you asked about iPhone or Android, and when. We use it only to tell you about the launch. Lawful basis: your consent, withdrawn by asking us to remove you or using the unsubscribe link in any email we send.

Location and the map

Location is optional. The app only uses it if you allow it in iOS, and only while the app is open.

What it is used for:

• Weather — your location is sent to Apple WeatherKit to show the local weather.
• Finding gyms — your location is sent to Apple Maps to find gyms near you, and to OpenStreetMap's Overpass and Nominatim services when Apple has nothing.
• The Social map — described below.

If you are 18 or over (you have given a date of birth that says so), you are on the map by default:

• Friends see roughly where you are, rounded to about 1 km.
• Pro: friends see you to about 100 m instead. This is on by default for Pro members aged 18 and over, and is only ever shown to friends.
• Other 3SETS members aged 18 and over see you rounded to about 1 km, and only while your place is less than 24 hours old. Members under 18 never see you unless you are friends.
• Who sees me on the map lets you choose Everyone, Followers or Friends. Show me on the map turns it off. Both are in Social → Settings → Location.

If you are 13 to 17, sharing your place starts off. You can turn it on yourself with Show friends where I am. If you do, only your friends see it, and you never see anyone on the map who is not your friend.

Nobody under 13 has an account, and an account without a date of birth cannot share a place.

How long it is kept — your place is updated each time you open the app. Your last known place stays on your friends' map, marked with how long ago it was, until you turn sharing off or delete your account. Turning sharing off deletes it straight away. Gym check-ins end after at most 3 hours.

Refusing location costs you only the weather, nearby gyms and the map.

Lawful basis — for adults, our legitimate interest in helping people who train find and meet each other. We limit it by rounding the place, showing it to people who are not your friends only while it is under 24 hours old, never showing it to under-18s who are not your friends, and letting you turn it off at any time. For 13 to 17, your consent, given by turning sharing on; this follows the UK Children's Code, which says location sharing should be off by default for children.

Apple Health

Connecting Apple Health is optional. You choose in the Health app exactly which of these 3SETS may read. The app works without it.

What 3SETS reads, and what it is used for:

• Steps, walking and running distance, and flights climbed — the Steps screen and your daily goals.
• Active energy and exercise minutes — your activity for the day.
• Walks and runs recorded by your iPhone or Apple Watch — when each started and ended, how long it lasted, the distance and the active energy. No routes or locations.
• Sleep — time asleep, for Recovery.
• Heart rate (the day's average and highest), resting heart rate and heart rate variability — the Heart screen, and Recovery's estimate of how rested you are.
• State of Mind (iPhone with iOS 18 or later) — how you have said you feel, for Wellbeing and your daily check-in.

Insights shows these together. Nothing else is read: no clinical records, no medications, and no routes or locations.

What 3SETS writes — nothing. 3SETS only reads from Apple Health.

Where it goes — what 3SETS reads is copied to our database, against your account: one row of daily figures for each day, and one row for each walk or run. That happens only while the app is open. The first time you connect, 3SETS reads up to three years back. After that, it reads the most recent fortnight each time it looks.

Who else sees it — nobody, except in these cases you choose:

• When you chat with your Gym Buddy, today's step count and recovery score go with your message to Anthropic, as described above.
• If you join a steps or active-minutes challenge on Social, your total for that challenge is shown to the others in it. Turn off Activity in Social → Settings → What you share to keep it out of challenges.

It is never used for advertising or marketing, never used to profile you, and never sold. The only other suppliers that handle it are the ones that host our database and servers (Supabase and Vercel, below), on our instructions.

How long we keep it — while your account exists. Turning off access in the Health app stops 3SETS reading anything new, but does not remove what was already copied. Deleting your account removes it, and you can also ask us to remove it at any time.

Social

Your Social profile — every account has one. It holds your name, handle, photo or drawn character, bio, interests, and your buddy. Your coins total and awards can appear on leaderboards and your profile.

What we hold — what you post (posts, comments, stories, reels, highlights and their photos and videos), your messages, your friends, follows, crews, mutes and blocks, gyms you check in to, challenges you join, live sessions you train in together, fundraisers you post, coins and awards, and reports you make.

Who sees it — that is up to you. Your profile can be private, and every post has its own audience. Stories end after 24 hours and gym check-ins after at most 3 hours. Anything about your training, food or body that you share on Social is shared because you chose to post it.

Fundraisers link to a page on a charity platform such as JustGiving or GoFundMe. Any donation is between the donor and that platform; we never see payment details.

Lawful basis: performance of a contract. For health information you post, your explicit consent, given by posting it and withdrawn by deleting it.

Automatic moderation

To keep Social safe, everything posted on Social is checked by Anthropic's Claude AI model before others see it. That covers posts, comments, stories, reels, highlights, messages, profile text and photos, crew and challenge names, and their pictures. Reported content is checked again.

Content that breaks the rules is not shown, or is removed. Each refusal or removal counts against the author. Three in 30 days suspends Social for 7 days. Another suspension within 90 days of the last is 30 days.

Messages between friends are only checked for sexual content, child safety, self-harm and threats.

If a post or message suggests that the person who wrote it is struggling, the app shows them where to find support, and we keep a note that we did so it is not shown more than once a day.

You can ask for a person to review any decision by emailing us.

Lawful basis: our legitimate interest, and our legal duty under the Online Safety Act, in keeping people safe.

What we do not do

• We do not sell your data. Not to anyone, for any price.
• We do not use advertising, advertising cookies or advertising networks.
• We do not run analytics or tracking on the website or in the app. See the Cookie Policy.
• We do not profile you. The one automated decision is the moderation of what you post on Social, described above, and you can ask for a person to review it.
• We do not send marketing email unless you ask for it.

Who processes it for us

We use suppliers to run the service. Each acts on our instructions only.

• Supabase — the database, file storage, your account and sign-in. Hosted in the UK (London).
• Vercel — hosts the website and the servers the app talks to.
• Anthropic — reads food photographs you choose to send, writes your Gym Buddy's replies, answers the website's "Ask 3SETS" chat, and checks what is posted on Social, as described above.
• USDA FoodData Central and Open Food Facts — receive food searches and barcodes, with nothing that identifies you.
• Apple WeatherKit and Apple Maps — receive a location for weather and gym search, with nothing that identifies you.
• OpenStreetMap (Overpass and Nominatim) — receive a location for gym search when Apple Maps finds nothing, with nothing that identifies you.
• Expo — passes notifications to Apple to deliver to your phone.
• Resend — sends account emails, and forwards website feedback to us.
• Apple — Apple Health data is read on your phone, with your permission. Apple handles Sign in with Apple, delivers notifications, and distributes the app through the App Store under its own privacy policy.

Some suppliers may process data outside the UK, including in the United States. Where they do, transfers are covered by the UK's approved safeguards.

How long we keep it

• Account, training, health and body data, Apple Health data, photos, videos and recordings: while your account exists. Deleted when you delete your account in the app, including the stored photos, videos and voice recordings.
• Reminders: until you turn them off or delete your account.
• Social: what you post stays until you delete it or your account. Stories end after 24 hours and gym check-ins after at most 3 hours. Your place on the map is deleted when you turn sharing off or delete your account.
• Website feedback: 48 hours in our database; the email copy until we have read it.
• Waitlist addresses: until we have told you about the launch you asked about, or you ask us to remove you, whichever is sooner.

Deleting your account

Delete your account in the app: Profile → Delete account. It removes your account and everything in it straight away.

If you signed in with Apple, deleting your account also asks Apple to remove 3SETS from your Apple ID's sign-ins. You can check or do it yourself on your iPhone: go to Settings → your name → Sign in with Apple (on some versions, Password & Security → Apps Using Apple ID), choose 3SETS and stop using Apple ID.

Your rights

Under the UK GDPR you may:

• Ask what we hold about you, and get a copy.
• Correct anything wrong. Most of it you can edit yourself in the app.
• Delete your account and your data, in the app.
• Take your data elsewhere, in a machine-readable form.
• Object to processing, or ask us to restrict it.
• Withdraw consent at any time, where consent is what we relied on.

Email support@3sets.co.uk. We reply within one month.

If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but it is your right either way.

Security

Your password is stored hashed and we cannot see it. Access to your data is enforced by the database itself, row by row, so one account cannot read another's. Photos, videos and recordings are stored privately. Traffic is encrypted in transit.

No system is perfect. If a breach ever puts your rights at risk, we will tell you and the ICO within the time the law requires.

Children

3SETS is for people aged 13 and over. Everyone gives a date of birth when they sign up, and we do not make an account for anyone under 13. If we learn that an account belongs to someone under 13, we delete it and its data. If you are a parent and think your child has an account, tell us and we will remove it.

For 13 to 17, Social starts private: the profile is left out of search and suggestions, only friends can message, and new posts are for friends. They can change these themselves in Social → Settings. Sharing a place on the map starts off, is only ever shown to friends, and they never see anyone on the map who is not their friend.

Until an account has a date of birth, Social keeps its protections fixed on: the profile is private and hidden, only friends can message, posts are for friends only, and it cannot check in to a gym, share a place or start a fundraiser.

Changes

If we change this policy materially we will say so rather than quietly reposting it.

Last updated: 12 October 2026.