Privacy Policy

TOPSET PRIVACY POLICY

Effective Date: October 18, 2026

1. Introduction and Who We Are

TopSet ("TopSet," "we," "us," or "our") explains in this Privacy Policy how we collect, use, share, and protect information about you when you use our platform at topset.cloud, app.topset.cloud, and the TopSet iOS app (together, the "Platform"). A plain-language summary is available at topset.cloud/data-use, and our Consumer Health Data Privacy Policy is at topset.cloud/health-data. If the summary and this Policy ever differ, this Policy controls.

Controller: TopSet Inc., 1133 South Blvd, Oak Park, IL 60302-2998, United States. Email: info@topset.cloud. We are the controller of the personal data described in this Policy. Coaches who keep information about their athletes in their own records, such as the coach's Google Sheets, the copies of sheets and workbooks the coach imports into TopSet, and the coach's notes, decide what to keep there and are responsible for that information as independent controllers. Section 11 explains what this means when an athlete deletes their account.

This version replaces our policy dated September 6, 2026. It adds how video analysis works, challenges, reporting and moderation, the legal bases we rely on in the European Economic Area and the United Kingdom, and our consumer health data policy, it corrects how long we keep some information, and it describes in more detail our Google Sheets access, which covers only the spreadsheets you choose in Google's file picker, and with whom we share Google user data (Sections 7 and 7a).

2. Information We Collect

We collect the following types of information:

Account Information: your name, email address, and password when you create an account, or the name and email address Apple or Google provides if you sign in with those services. At signup we ask for your year of birth to check that you meet our minimum age; we use it only for that check and do not store it.

Profile Information: your role (coach or athlete), display name, username, avatar photo, gym bag, unit and display preferences, and any OpenPowerlifting profile you choose to link.

Training Data: programs, training blocks, weeks, days, sets, weights, reps, RPE, bodyweight, notes (including notes about pain, injury, or recovery), personal records, and training history, whether entered by you, entered by your coach, or imported from a spreadsheet.

Spreadsheets: Google Sheets, Excel, and CSV files you upload or connect for import, including any text those files contain.

Video and Images: lift videos you record or upload; thumbnails we generate from them; still frames and screenshots taken from a video when you use video analysis or weight recognition; chat attachments; and avatar photos. When you analyze a video, we upload a smaller copy and a few still frames for the analysis and delete them when it finishes.

Video Analysis Results: where video analysis is available, rep counts, bar path and velocity traces, lift type, stance, estimated effort and weight, quality measures, and the weight read from the plates, computed from your videos. To produce them, our systems estimate the position of body joints (such as wrists, hips, knees, ankles, and the head) in each frame. These joint positions are used only while the analysis runs and are not stored, and we do not use them, or any other feature of your videos, to recognize or identify anyone. We do not use facial recognition.

Gym Notes: notes you save in the app about your gym's equipment, such as plate colors, which are sent with weight-recognition requests to help read the plates.

Audio: voice memos you send in chat.

Messages: chat messages between you and your coach, athletes, or friends, including reactions and read receipts.

Social Information: friend requests and friendships, friend links and QR codes you generate, your profile visibility settings, and your placement on the rating leaderboard among your friends.

Challenge Information: challenges you create or join, their rules and visibility, your claims and the evidence attached to them, confirmations, disputes and their reasons, posts, follows, and any bodyweight you record for a challenge.

Safety Information: users you block, reports you file or that are filed about you or your content, and the moderation decisions we make on them.

Consent Records: which version of our Terms, Privacy Policy, and health-data consent you accepted, when, from which app, a one-way hash of your IP address, and your device's user agent; and whether you gave or withdrew permission for features that send data to OpenAI.

Competition Results: if you link an OpenPowerlifting profile, the meet results publicly listed for you on openpowerlifting.org, which we use to calculate your TopSet rating and meet bests.

Payment Information: your subscription tier, billing status, and Stripe customer identifier, or, for purchases in the iOS app, the subscription status Apple reports to us. Card details are entered directly with Stripe or Apple and are never stored on our servers.

Device and Usage Information: IP address, browser or device type, app version, a push notification identifier for each device you sign in on, and request and error logs collected automatically to operate and secure the Platform.

3. How We Use Your Information

We use your information to: (a) operate the Platform, including delivering programs between coaches and athletes; (b) import spreadsheets into structured training data; (c) generate draft training suggestions for coaches to review; (d) draft a coach's note from a message an athlete sent when the coach stars it; (e) provide chat, push notifications, and email notifications; (f) analyze lift videos you choose to analyze, or that your plan analyzes automatically where that is enabled, and show you and your coach the results; (g) show your friends the rankings, personal records, and gym bag you have chosen to share, and show challenge progress, posts, and evidence to the people and audiences described in Section 5; (h) process subscriptions and payments; (i) provide customer support; (j) secure the Platform, prevent abuse, and fix problems; (k) review reports, moderate content, enforce our Terms, and keep the Platform safe; (l) improve the Platform and develop new training-related features, without training machine-learning models on your content; and (m) comply with legal obligations and establish or defend legal claims.

We do not sell your personal information. We do not use third-party advertising, tracking pixels, or analytics software in the web app, this website, or the iOS app. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. Automated outputs such as video-analysis measurements, estimated maxes and strength forecasts, and draft training suggestions are aids that you or your coach review.

3a. Legal Bases (European Economic Area and United Kingdom)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and the UK GDPR:

Providing your account and the features you use, including coach and athlete linking, training logs, programs, messages, videos, friends, challenges, notifications, spreadsheet import, planner drafts, and customer support (purposes a, b, c, d, e, g, i): performance of our contract with you (Article 6(1)(b)).

Training and fitness data that may reveal information about your health, such as bodyweight, RPE, notes about pain or recovery, and video-analysis measurements: your explicit consent (Article 9(2)(a)), which we ask for at signup as a separate checkbox, and from existing users before they continue. You can withdraw it at any time by deleting your account or emailing info@topset.cloud. Because TopSet cannot log or analyze training without this data, withdrawing consent means we delete your account and its data. Withdrawal does not affect processing that happened before it.

Sending video frames, screenshots, and gym notes to OpenAI for video analysis and weight recognition, and sending an athlete's spreadsheet to OpenAI for import from the iOS app: your consent (Article 6(1)(a)), and for data that may reveal health information your explicit consent (Article 9(2)(a)), both given through the separate health-data consent you give at signup, which links to our Consumer Health Data Privacy Policy naming OpenAI as one of our service providers. The same applies to sending a message you sent to OpenAI when your coach stars it (Star Notes). You can switch off video analysis, spreadsheet import, or star notes at any time under Settings > Privacy & consents; that feature then stops sending your data to OpenAI, and star notes are drafted without OpenAI.

Video analysis on our own servers (purpose f): performance of our contract with you, and, for measurements that may reveal health information, your explicit consent described above.

Subscriptions and payments (purpose h): performance of our contract; keeping payment and tax records: compliance with legal obligations (Article 6(1)(c)).

Security, abuse prevention, debugging, and request logs (purpose j): our legitimate interests (Article 6(1)(f)) in keeping the Platform and its users safe. We balanced these interests against yours: we collect only what is needed to operate and secure the service, store IP addresses in consent records only as a one-way hash, limit and log staff access, and do not use this information for advertising or profiling.

Reports, moderation, and enforcing our Terms (purpose k): compliance with legal obligations, including the EU Digital Services Act and copyright law, and our legitimate interests in protecting users and people shown in content, balanced by giving users notice, reasons, and an appeal for decisions that affect them.

Improving the Platform (purpose l): our legitimate interests in fixing problems and making the Platform better, balanced by using only information we already hold to run the service, never training models on your content, and never using it for advertising.

Consent records and legal claims (purpose m): compliance with legal obligations and our legitimate interests in being able to show what you agreed to and to establish or defend legal claims.

Push notifications and marketing email: your consent, which you give in iOS when the app asks to send notifications, and separately if we ever ask to send you marketing email. We do not send marketing email today.

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object, as described in Section 12.

4. Artificial Intelligence and Automated Processing

We use OpenAI models to power the following features. Each one processes only the information described, and only when you or your coach uses that feature:

Spreadsheet Import: reads the contents of a spreadsheet you import, including exercise names, numbers, and any notes in the cells, to detect the program's structure.

Planner Assistance: where enabled, drafts the missing parts of a training block from the athlete's training history (exercises, loads, reps, RPE, and block, week, and day names) when a coach asks. Every result is a draft that the coach must review and apply.

Star Notes: when a coach stars a message an athlete sent them, we send that message's text to OpenAI to pick out the sentences that matter for the coach's note; if the starred message is a voice memo, we first send its audio to OpenAI to transcribe it. This happens only for the starred message, only while the athlete has not switched star notes off under Settings > Privacy & consents, and never for any other message. When star notes are off, the note is drafted without OpenAI. Transcripts are stored encrypted with the message.

Video Analysis: video analysis is a TopSet Premium feature, free accounts may be offered a limited number of analyses, and it is turned on only in some versions of the app. Where it is available and you have given the permission described below, when you analyze a set (or automatically, if your plan includes automatic analysis where enabled), we send still frames from the video to OpenAI: currently up to nine frames to locate the loaded barbell, and up to six to confirm which lift it is and, if our own measurement cannot settle it, to read the plates on the bar.

Weight Recognition: where available and you have given the permission described below, when you analyze a set or ask TopSet to read the weight on the bar, we send up to six still screenshots from your video, together with any gym notes you have saved (such as your gym's plate colors) and the load prescribed for that set, to OpenAI. The screenshots are processed in an isolated session that is deleted, with the uploaded images, when the request finishes and in any case within one hour.

Permission before sending your data to OpenAI. You give permission for these features through the separate health-data consent you give at signup, which links to our Consumer Health Data Privacy Policy naming OpenAI as one of our service providers, before any of your data is sent to OpenAI. Each feature can be switched off at any time under Settings > Privacy & consents, and it then stops sending your data to OpenAI. Spreadsheet import and planner drafts used by coaches on the web app are covered by this Policy and run when the coach uses them.

Frames and screenshots can show you, your surroundings, and anyone else in view. We do not send whole video files to OpenAI. The pose and barbell tracking that produces rep counts, bar path, and velocity runs on TopSet's own servers, not at OpenAI.

These features never process your email address or password or your payment details, and they never process chat messages other than a message a coach stars as described under Star Notes. Under OpenAI's API terms, OpenAI does not use information sent through its API to train its models unless we opt in, and we have not. For spreadsheet import, planner drafts, video analysis, and weight recognition we also instruct OpenAI not to store the responses. OpenAI may keep API inputs and outputs for up to 30 days to detect abuse, after which they are deleted, unless the law requires longer.

We do not train machine-learning models on your content. If that ever changes it will be opt-in, as described in Section 6f of our Terms of Service.

4a. Body Measurements and Biometric Information

Video analysis estimates the positions of body joints to measure a lift. We do not create, collect, or store biometric identifiers or biometric information, such as face geometry, voiceprints, fingerprints, or templates that can identify a person, and we do not use video, images, or audio to identify anyone. Joint positions are processed in memory and discarded when each analysis finishes; we store only the resulting lift measurements and bar path. On your iPhone, the app may detect where a person or face is in a picture, only to place text on an exported video or to style a portrait card made from your own avatar; those outlines stay on your device and are not kept. Voice memos are transcribed to text, not used to recognize a speaker. If we ever introduce a feature that uses biometric identifiers, we will describe it, ask for your written consent first, and publish a retention and destruction schedule before it is used.

5. Who Can See Your Information

Your Coach: a coach linked to your athlete account can see your name, email address, training data, videos (including originals), video analysis, personal records, progress, and your conversation with them, and can write training for you. You can remove a coach at any time in the app's Settings, after which they no longer have access. A coach can hide your video from their own view but cannot delete it.

Your Athletes: if you are a coach, each linked athlete can see your display name and the programs, comments, and messages you send them.

Friends: accepted friends can see your rankings, training PRs, and gym bag unless you turn those off under Settings > Profile Privacy. Friends see a video only if you share it with them, as described below.

People in Your Conversations: anyone in a direct or group conversation with you can see the messages, voice memos, photos, and videos you send there. When you send one of your lift videos to a conversation, everyone in that conversation at that moment can watch it; people who join later cannot. You can see who has access and remove anyone under "Shared with" on the video, and deleting the video removes everyone's access. Only you can share your videos; people you share with cannot pass them on in TopSet.

Links You Create: if you create a link to one of your videos, anyone who has the link can watch that video, including people who are not signed in to TopSet, until you turn the link off or delete the video. The page a link opens is not listed in search engines.

Challenges: nobody other than the competitors can see a challenge until its terms are agreed. After that, a private challenge is visible only to its competitors; a friends or public challenge is also visible to friends of any competitor and to people who follow it; and a public challenge with discovery turned on can be seen by any signed-in TopSet user. The audience can see competitors' names, avatars, targets, progress, posts, and the videos attached to posts and claims, including the video of each claimed set, so they can see the lift for themselves. New challenges require a video of each claimed set unless the organizer turns that off before the terms are agreed. People you have blocked, and people who have blocked you, cannot see challenges you compete in.

The Public: your profile link (topset.cloud/u/your-username) shows only your display name, username, avatar, and the month you joined. Your rating and meet bests are shown publicly only if you turn on "Public profile" or share a friend link you generated yourself. Friend links expire. Your programs, workouts, gym bag, email address, and detailed rating scores are never public, and your videos are never shown to people who are not signed in to TopSet, except a video you create a link for.

Share Cards and Exports: rating, session, and meet recap cards and exported videos are created on your device and shared only when you choose to share them.

TopSet Staff: authorized personnel access production data only to run, secure, debug, and moderate the Platform and to answer your requests, and that access is logged.

Anyone who can see your content can copy or record it. See Section 6b of our Terms of Service.

6. Service Providers and Other Recipients

TopSet uses the following service providers to operate the Platform. They process your information only on our instructions and only as needed to provide the service, under data processing terms with us:

Supabase (database, authentication, realtime): supabase.com/privacy Amazon Web Services (servers, video and file storage, video delivery through Amazon CloudFront, video-analysis computing, email delivery): aws.amazon.com/privacy OpenAI (spreadsheet import, planner drafts, star notes, video analysis frames, weight recognition): openai.com/policies/privacy-policy Stripe (web subscriptions and billing): stripe.com/privacy Apple (Sign in with Apple, iOS push notifications, App Store purchases): apple.com/legal/privacy Google (Sign in with Google, and Google Sheets access you grant): policies.google.com/privacy Netlify (hosting for topset.cloud and app.topset.cloud; receives standard web request logs): netlify.com/privacy OpenPowerlifting (public competition results you link): openpowerlifting.org

We may also disclose information if required by law, to protect the rights or safety of TopSet, its users, or others, to law enforcement where we suspect a criminal offense involving a threat to someone's life or safety, or in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to your information.

7. Google Services

Sign in with Google: when you sign in with Google, we receive your name, email address, and profile picture, and use them only to create and identify your account.

Google Sheets: connecting Google Sheets is separate and optional. When you connect it, you grant TopSet permission through Google to see, edit, create, and delete only the specific Google Drive files you choose to use with TopSet. Linking a spreadsheet does not give TopSet the email address of your Google account. If you connected Google Sheets in the iOS app before we stopped asking for it, we keep the email address we received then only to show which account is linked. To link a spreadsheet, you paste its link into TopSet, and Google then shows its permission screen and its own file picker, which opens on that file, on Google's own pages; you confirm that spreadsheet there. TopSet can open only the spreadsheets you have chosen in this way. We cannot see, list, or open any other spreadsheet or file in your Google account, and we do not create or delete files in it.

What we read and why: for each spreadsheet you link, we read its tab names, cell values, formulas, and formatting so that we can import the program into TopSet, show it in the TopSet workbook, keep it up to date when the sheet changes, and, where you turn it on, write your logged results back into the sheet. We write only to the spreadsheets you linked, and only when you use a feature that updates them, such as writing back logged results or pushing changes made in the TopSet workbook.

How we store it: Google access and refresh tokens are encrypted at rest and are used only by our servers; they never leave them. Google's file picker runs on Google's own pages, so we never place a Google token in a page we serve. The program we import, and for coaches a working copy of the linked spreadsheet in the TopSet workbook, are kept as described in Section 10. A temporary export of a sheet made while loading it may be cached for up to two minutes.

Limited Use: TopSet's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data only to provide and improve the Google Sheets features you use. We do not sell it, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models, and no person at TopSet reads it unless you ask us to, it is needed for security or to investigate abuse, or the law requires it.

Disconnecting: you can revoke TopSet's access at any time at myaccount.google.com/permissions; we then delete our stored tokens the next time they fail to work. In the iOS app you can also disconnect Google Sheets under Settings, which deletes our stored tokens right away. Deleting your TopSet account also deletes the stored tokens. Google may remember which spreadsheets you chose, so if you connect the same Google account again later, TopSet may be able to open those spreadsheets without asking you to choose them again.

7a. Sharing, Transfer, and Disclosure of Google User Data

Google user data means the information we receive through Google APIs when you connect Google Sheets: the contents of the spreadsheets you choose, and, for iOS connections made before we stopped asking for it, the email address of the Google account you connected. We share, transfer, or disclose Google user data only to the following recipients, and only for the purposes stated:

OpenAI: when you import a spreadsheet, its contents may be sent to OpenAI to detect the program's structure, as described in Section 4. This happens only when a spreadsheet is imported. OpenAI processes the contents only to provide that feature, and not to train its models.

People you choose to share your training with: the program imported from your spreadsheet and the results you log become part of your training in TopSet, which the people you choose to share your training with in TopSet, such as your coach or your athletes, can see as described in Section 5.

Infrastructure providers: Supabase (database and authentication), Amazon Web Services (servers and file storage), and Netlify (hosting for app.topset.cloud, which passes the web app's requests to our servers) host, store, or transmit data on our behalf, as listed in Section 6. They process it only on our instructions and only as needed to run the Platform.

Legal requirements and business transfers: we may disclose Google user data if required by law, to protect the rights or safety of TopSet, its users, or others, or in connection with a merger, acquisition, or sale of assets, as described at the end of Section 6.

We do not sell, rent, or transfer Google user data to anyone else, including data brokers, advertisers, and advertising platforms.

8. Push Notifications and Email

With your permission, the iOS app registers your device so that we can send notifications about messages, friend requests, coach updates, completed imports, and rest timers. You can turn notifications off in iOS Settings, and signing out removes the registration. We send transactional email, such as sign-in links, password resets, billing receipts, account notices, and moderation decisions, through Amazon Web Services or Supabase. We do not send marketing email without your separate consent.

9. Data Storage, Security, and International Transfers

TopSet is based in the United States. Your data is stored and processed on infrastructure hosted by Amazon Web Services and Supabase in the United States, and our other service providers may process it in the United States or other countries where they operate.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we collect your data directly to provide the service you signed up for from the United States. When we transfer your personal data to service providers outside your region, we protect it with the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of the relevant safeguards by emailing info@topset.cloud.

We use industry-standard security practices, including encrypted connections (HTTPS/TLS), encryption at rest, access controls, and regular security reviews. Chat messages are stored encrypted under a key unique to each conversation. Videos and files are stored privately and served only through signed links that expire within one hour. Once a video is deleted we stop issuing links to it; a link issued before then keeps working until it expires. Messages are not end-to-end encrypted: TopSet holds the keys so that we can deliver messages, draft a note when a coach stars a message, and send notifications, and authorized personnel may access content where reasonably necessary to operate, secure, debug, or moderate the Platform. Access to production data is limited to authorized personnel and is logged. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and the authorities as required by law.

10. Data Retention

We keep your information for as long as your account is active or as needed to provide the service, and then delete it, as follows:

Account, profile, training data, programs, personal records, and gym bag: until you delete them or your account.

Videos: until you delete them. A deleted video stays in Recently Deleted, where you can restore it, until you delete it permanently or delete your account; we do not currently delete it automatically after a set period. When you delete a video permanently, we delete the video file and its thumbnail from storage. If a video is evidence on a claim in a challenge that has not ended, or ended less than 30 days ago, deleting it removes it from your library right away, but the challenge's audience can still watch it until 30 days after the challenge ends, when it is deleted permanently. Deleting your account deletes it immediately.

Video analysis results and weight-recognition results: kept with your training history until you delete your account. Weight-recognition results store the weight read and where in the frame it was found, not the images.

Uploads made only for analysis (a smaller copy of the video and still frames): deleted when the analysis finishes, whether it succeeds or fails. Screenshots sent to OpenAI for weight recognition: deleted from OpenAI when the request finishes, and in any case within one hour.

Messages, voice memos, and chat attachments: kept with the conversation until they are deleted or the account that holds the conversation is deleted. After you delete your account, messages you sent stay with their recipients without your name. Attachments that were uploaded but never sent are deleted within 24 hours.

Spreadsheets: the original file you imported is kept with your account until you delete it or your account. Working files made while parsing it are deleted within 7 days. For a linked Google Sheet, the imported program and, for coaches, the working copy in the TopSet workbook are kept until you delete them or your account; a temporary export made while loading the sheet is cached for up to two minutes.

Challenges: your challenges, claims, confirmations, disputes, and posts are kept while the challenge exists. When you delete your account, your videos are deleted and the other competitors keep the challenge record, showing the name you had at the time.

Reports, blocks, and moderation decisions: for as long as the accounts involved exist and afterwards only as long as needed to handle appeals, enforce our repeat-infringer policy, meet legal obligations, or defend legal claims.

Consent records: kept after account deletion for as long as we may need to show what was agreed, because they are our evidence of your consent.

Server and security logs: kept on our application servers until the server is next redeployed, and kept by our hosting and database providers under their standard log retention, for up to 30 days.

Free-trial signup signals: when a coach free trial is requested, we keep one-way hashes of your network identifiers (IP address and network range) and email address, your email domain, and which kind of trial was offered, for up to 90 days, even after account deletion, to prevent free-trial abuse (fraud prevention).

Payment records and anonymized sign-in audit logs: as long as needed for accounting, tax, fraud prevention, and security, even after account deletion.

Backups: deleted data may remain in encrypted backups kept by our database and storage providers until those backups expire, within 30 days.

11. Deleting Your Account

You can delete your account in the iOS app under Settings > Delete Account, in the web app's Settings, or by emailing info@topset.cloud from the email address on your account. Deletion is permanent. It removes your account, training history, videos, video analysis, personal records, profile and username, friendships, notification registrations, and any connected Google authorization, and frees your email address for reuse. You must cancel any active paid subscription before deleting, and you may be asked to sign in again to confirm.

Your stored files are deleted too: your videos and their thumbnails (including copies stored for your coach and videos you attached to challenges as evidence or to posts), uploads made for analysis, spreadsheets you uploaded, workbooks you own, chat attachments you sent, and your avatar. We delete your account records first and then delete the files in a background job that retries automatically if a deletion fails. This normally finishes within minutes, and in any case within 30 days. Links to your files stop working within one hour. Copies in backups expire as described in Section 10.

Messages you have already sent to a coach or friend remain in that person's conversation with your name removed, much as a sent email remains in the recipient's inbox.

Information your coach holds about you is not deleted with your account. That includes your coach's own Google Sheets, which live in the coach's Google account outside TopSet, the copies of sheets and workbooks your coach imported into TopSet, and your coach's notes. Your coach is responsible for that information. If you want it deleted, ask your coach, or email info@topset.cloud and we will forward your request to your coach and help them act on it.

If you coach athletes, deleting your account removes your identifying information and deletes your library videos, your imported sheets and workbooks, and attachments you uploaded. It never deletes your athletes' own videos, and training you have written for athletes stays with those athletes.

12. Your Rights and Choices

Depending on where you live, you have some or all of the following rights:

(a) Access: to know whether we process your personal data and to get a copy of it and information about how we use it. (b) Rectification: to have inaccurate data corrected and incomplete data completed. (c) Erasure: to have your data deleted. (d) Restriction: to have us limit how we use your data while a question about it is resolved. (e) Portability: to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another provider where technically feasible. (f) Objection: to object to processing based on our legitimate interests, including profiling. We will stop unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend legal claims. (g) Withdrawing consent: to withdraw any consent you gave, at any time, without affecting processing that happened before. (h) Complaint: to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think your rights were infringed. In the United Kingdom, that is the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email info@topset.cloud from the email address on your account, or see topset.cloud/support. You can also delete your account, manage profile visibility, notifications, Google access, and permission for features that use OpenAI directly in the Platform. We will verify your identity and respond within one month. If a request is complex or we receive many requests, we may extend that by up to two further months and will tell you why within the first month. We do not charge for requests unless they are manifestly unfounded or excessive.

If you are a California resident, you have the right to know what personal information we collect, use, and disclose, to delete it, to correct it, and not to be discriminated against for exercising your privacy rights. We do not sell personal information or share it for cross-context behavioral advertising, and we use sensitive personal information only to provide the services you request. Residents of other US states with privacy laws have similar rights and can exercise them the same way. If we deny a request, you can appeal by replying to our decision.

12a. Consumer Health Data

Some training information, such as bodyweight, RPE and effort, notes about pain or recovery, and measurements of how your body moves in a lift, may be "consumer health data" under laws in Washington, Nevada, Connecticut, and other states. The separate health-data consent you give at signup is the consent those laws require. Our Consumer Health Data Privacy Policy at topset.cloud/health-data explains what we collect, why, who we share it with, and how to exercise your rights.

13. Children's Privacy

You must be at least 16 years old to use TopSet if you live in the European Union, Iceland, Liechtenstein, or Norway, and at least 13 years old anywhere else, including the United Kingdom. We ask for your year of birth at signup, without storing it, and do not create accounts for people below the minimum age. TopSet is not directed to children below these ages, and we do not knowingly collect their personal information. Users between the minimum age and 17 may use TopSet only with the permission of a parent or guardian, or through a coach, school, club, or team that has obtained that permission. If we become aware that a child below the minimum age has provided us with personal information, we will delete it. Contact us at info@topset.cloud if you believe this has happened.

People under 18 may appear in videos only with a parent's or guardian's permission, as our Terms require. If you are a parent or guardian and believe a video shows your child without permission, report it in the app or email info@topset.cloud and we will review it promptly. If you are under 18 and live in California, you can remove content you posted by deleting it in the app or asking us to remove it; removal does not guarantee that copies made by others are gone.

14. Cookies and Similar Technologies

Our websites and web app do not set advertising or analytics cookies and do not use tracking pixels or third-party analytics. They use your browser's local storage only for what is strictly necessary to provide the service you ask for: keeping you signed in, and remembering choices you make in the app, such as dismissed tips, open panels, and unsent drafts. Because we use no non-essential cookies or storage, we do not show a cookie banner. When you pay on a Stripe checkout page or sign in with Google or Apple, those companies may set their own cookies on their own sites under their own policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice, and may ask you to confirm that you have read them before you continue using the Platform. The effective date at the top of this policy reflects the most recent update. Prior versions are available on request.

16. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at info@topset.cloud or TopSet Inc., 1133 South Blvd, Oak Park, IL 60302-2998, United States.

For questions about the accessibility of the Platform, see topset.cloud/accessibility.