AxialPrivacy policy
The short version. Axial uses what you enter to build your training plan and keep it on every device you sign in on. Some of it is health information, and we treat it that way. We don’t sell it, we don’t share it for advertising, and we don’t run advertising or analytics trackers. During the beta, the person who runs Axial can see what signed-in athletes enter, including the optional injury and pregnancy answers (section 6). You can export or delete your data in the app at any time.
1. Who we are and what this covers
Axial (“Axial”, “we”, “us” and “our”) makes the Axial training app, any Axial mobile app, and the website at getaxial.training. Together we call these the “Service”. We decide why and how the information in this policy is used, which makes us the “controller” or “business” under privacy laws. You can reach us at hello@getaxial.training.
This policy covers the Service. It doesn’t cover other sites you reach through links, such as YouTube (section 11). Two related notices are part of this policy: the Consumer health data privacy policy and the Health and safety notice.
Axial isn’t a healthcare provider, health plan or healthcare clearinghouse. It isn’t a “covered entity” or a “business associate” under HIPAA, so HIPAA doesn’t govern the information in Axial. We protect it under this policy and under the privacy and consumer protection laws that do apply to us.
2. Information we collect
| Category | What it includes |
|---|---|
| Account details | Your email address and password (we never see the password in readable form), your first name or nickname, and the sign-in codes and reset links we email you. |
| Training profile | Goals, event names and dates, training level and training age, available days, session length, equipment, units, exercise preferences and dislikes, focus areas, and estimated numbers you enter, such as one-rep maxes, 5K time, threshold pace, cycling power or swim speed. If you use coach mode, your coach’s first name. |
| Health and body information (sensitive) | Injuries or areas to work around; pain you report; whether you are pregnant or gave birth in the last 12 months, the week of pregnancy or weeks since birth, type of delivery, pregnancy complications you tick, whether your provider has cleared you to exercise, and warning signs you report; bodyweight; energy, soreness and stress ratings; optional HRV, resting heart rate and sleep numbers; and the readiness score Axial works out from these. |
| Training records | Planned and completed workouts, sets, weights, reps, effort and ratings, notes, personal records, time away, and what we read from activity files you import: time, distance, heart rate, power, cadence and elevation. |
| What you send us | Feedback notes, ratings, end-of-beta survey answers, and emails you send to us. |
| Technical data | IP address, browser and device type, operating system, the requests you make, timestamps, error information, and sign-in and security logs. Our hosting and database providers collect this automatically. |
| On your device | Your plan, logs, settings and sign-in session, kept in your browser’s or phone’s storage so Axial works offline, and the schedule of any reminders you set. |
Where it comes from. From you, from files you choose to import, and automatically from your browser or device as described above. We don’t buy information about you and we don’t collect it from data brokers or other companies. Axial doesn’t connect to accounts at WHOOP, Oura, Garmin, Apple Health or similar services yet. If it does, we will update this policy first and ask for your permission before connecting anything.
What we don’t collect. Your location (the app doesn’t ask for it), contacts, photos, camera or microphone, advertising identifiers, payment card or bank details (Axial is free during the beta), or government ID numbers. Imported .gpx and .tcx files can contain map coordinates. The app reads them on your device to work out distance and elevation and doesn’t keep the coordinates.
What you must provide. An email address and a password or sign-in code, and a first name or nickname, to use the Service. Everything else you enter is your choice, though your plan will be less tailored without it. Please don’t enter information about other people.
3. How we use information, and why
| Purpose | Legal basis (EEA, UK and Switzerland) |
|---|---|
| Create your account, sign you in, and keep your plan and records on every device you use. | Contract: it is necessary to provide the Service you asked for. For health information, your explicit consent. |
| Build your plan and adjust it from your check-ins, pain reports and logs. | Contract. For health information, your explicit consent. |
| Support you, fix bugs, read feedback and improve Axial during the beta. | Our legitimate interest in running and improving the Service. For health information, your explicit consent. |
| Keep the Service secure, prevent abuse and fix security problems. | Our legitimate interest in security, and legal obligation. |
| Answer your requests, meet legal obligations, enforce our terms and defend legal claims. | Legal obligation, and our legitimate interest in protecting our rights. |
We don’t use your information for advertising, we don’t sell it, and we don’t build profiles of you to sell or to make decisions that have legal or similarly significant effects on you.
We use sensitive information, including health information and pregnancy information, only to give you the Service you asked for, to keep it secure, and as the law requires. We don’t use it to infer other things about you.
We won’t use your information for a materially different purpose without telling you first. For health information, we will ask for your consent first.
4. Health information and your consent
Much of what you enter in Axial is about your health or fitness. Entering it is your choice. When you enter health information, you consent to us collecting and using it as described in this policy and in the Consumer health data privacy policy, only to provide the Service. That includes the setup question about pregnancy and birth, injury and pain answers, bodyweight, and HRV, heart rate and sleep numbers.
You can change your mind at any time. You can skip or change optional answers, edit or remove entries in the app, delete your account, or email us to withdraw consent. Withdrawing doesn’t affect what we did before you withdrew. Without the information, Axial can’t tailor your plan to it, so talk to your clinician instead. We won’t treat you differently for withdrawing consent.
5. Who we share information with
We don’t sell your personal information and we don’t share it for cross-context behavioral advertising. In the last 12 months we haven’t done either. We disclose information only in these ways.
Service providers
| Provider | What it does for us | Information it handles |
|---|---|---|
| Supabase | Our database and sign-in. Sends the sign-in codes and reset links by email. Our database is hosted in the United States. | Everything stored in your account, and sign-in and security logs. |
| Vercel | Hosts and delivers the web app and this website. | Technical data such as IP address and the requests you make. |
| Cloudflare | Domain registration and domain name services. | Domain records and DNS requests. |
| Google Workspace | Email for hello@getaxial.training. | Emails you send us, with your email address. |
We use providers only under written terms that require them to protect your information, use it only to provide their service to us, and follow our instructions. They aren’t allowed to sell it or use it for their own advertising. Disclosing information to them is not a sale and not “sharing” under privacy laws. If we add or change a provider that handles your health information, we will update this list.
At your direction
When you use Share on a workout, export your data, or send a report to your coach, you choose where it goes. A routine share link holds the routine inside the link itself. We don’t store it, and anyone who has the link can read it, so share it only with people you trust.
Legal requests and safety
We disclose information when the law requires it or to protect someone’s safety or rights. We require valid legal process before we disclose account information. We review each request, push back on requests that are overbroad or improper, and tell you about the request first unless the law forbids it. We won’t voluntarily give health information, including reproductive health information, to anyone.
Business changes
If Axial is involved in a merger, acquisition, financing or sale of assets, your information may transfer to the new owner. We will tell you before it does, the new owner must honor this policy for information already collected, and you will be able to delete your account first.
Aggregated information
We may use aggregated or de-identified information that can’t reasonably identify you, such as the number of people using a feature. We will keep it in that form and won’t try to re-identify it.
6. Who at Axial can see your information
During the beta, the person who runs Axial (the “beta administrator”) has an owner view of the Service. For each signed-in athlete it shows the email address, name, goals, level, plan details, training and check-in history, notes, ratings, feedback and survey answers. It also shows health flags: the injuries or limits you listed, your pregnancy or postpartum status and week, and recent pain reports.
We use this access to support you, fix bugs and read feedback, and for nothing else. It requires signing in to an administrator account, and our database rules allow it only for that account. An account is required to use Axial during the beta, and the owner view can’t be switched off for one person. If you aren’t comfortable with that, leave the optional health questions blank, or delete your account or email us. We will tell you before we change who can see what.
7. Cookies, device storage and tracking
Axial stores your plan, logs, settings and sign-in session in your browser’s local storage or your phone’s app storage. This storage is strictly necessary for the app to work, so we don’t ask for consent for it. We don’t use advertising or analytics cookies, tracking pixels, advertising SDKs or fingerprinting, and there are no third-party trackers on the website or in the app.
Because we don’t track you across sites or apps, there is nothing for a Do Not Track signal to switch off. We treat a Global Privacy Control signal as an opt-out request anyway. Clearing your browser’s storage signs you out and removes the copy on that device. The copy in your account stays until you delete the account.
8. Reminders and notifications
Reminders are local notifications that the app schedules on your device. We don’t send push notifications and we don’t collect a push token. You can turn reminders off in the app or in your device settings.
9. Automated processing and AI
Axial adjusts your training with written coaching rules that use what you tell it: your goals, check-ins, pain reports and logs. It isn’t an AI model. These adjustments are suggestions about exercise. They have no legal or similarly significant effect on you, and you can change any session. We don’t use your personal information to train AI models, and Axial’s features don’t send it to AI services.
10. How long we keep information
- Account, profile, health and training data. For as long as your account exists. When you delete your account in the app, your account and the plan, logs, check-ins and feedback stored with it are removed from our live database at once. Backups held by our database provider, if any, are overwritten on its normal schedule, typically within 30 days. We keep no separate copy.
- Data on your device. Until you clear your browser’s storage, remove the app or use Start over.
- Emails you send us. As long as we need to answer you and a reasonable time afterward, then we delete them unless the law requires us to keep them.
- Technical and security logs. Our providers keep these for short periods under their own schedules.
- Records we must keep. Anything the law requires us to keep, or that we need to keep to defend a legal claim, for as long as that applies.
- Inactive accounts. We don’t delete inactive accounts automatically. If we start to, we will email you first.
11. Links to other sites
The How links in the app open exercise videos on YouTube, in your browser or in the YouTube app. The link contains the name of the exercise and nothing about you. Once you open it, YouTube’s own terms and privacy policy apply, not ours.
12. Your rights and choices
In the app
- Access and export. Profile, then Your data: export your workouts as CSV or everything Axial stores as a JSON backup.
- Correct. Edit your setup, check-ins and logs in the app.
- Delete. Profile, then Your data, then Delete account.
- Withdraw consent. Remove the entries or delete your account, or email us.
If you can’t use the app to do these, email us and we will do it for you.
California residents
Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose; to get a copy of it; to correct it; to delete it; to opt out of the sale or sharing of your personal information (we do neither); and to limit the use of sensitive personal information (we use it only for the purposes the law allows, listed in section 3, so there is nothing to limit). You won’t be treated differently for using these rights. California’s Shine the Light law also lets you ask about disclosures to third parties for their direct marketing. We make none.
In the last 12 months we collected the categories below, from you and from your browser or device, for the purposes in section 3. We disclosed them only to the service providers in section 5, and we didn’t sell or share any of them.
| Category | Collected | Examples |
|---|---|---|
| Identifiers and customer records | Yes | Name, email address, IP address. |
| Protected classifications | Yes | Pregnancy and childbirth status, if you enter it. |
| Sensitive personal information | Yes | Account log-in (email and password); health information: injuries, pain, pregnancy status, bodyweight, HRV, heart rate, sleep. |
| Internet and network activity | Yes | Requests, timestamps, browser type, security logs. |
| Inferences | Yes | Readiness scores and training adjustments worked out from what you enter. |
| Geolocation, biometric, audio or visual, professional, education, commercial | No | We don’t collect these. Your IP address may indicate a general area, and we don’t use it for that. |
Residents of other US states
If you live in Colorado, Connecticut, Virginia, Texas, Oregon or another state with a comprehensive privacy law, you may have the right to confirm whether we process your personal data and to access it, correct it, delete it and get a copy; to opt out of targeted advertising, sales and profiling (we do none of these); and to appeal our decision on a request. We process sensitive data, including health data, only with your consent, and you can withdraw it as described in section 4. Washington, Nevada and Connecticut residents also have rights over consumer health data, described in the Consumer health data privacy policy.
EEA, UK and Switzerland
You have the right to access, correct and delete your personal data, to restrict or object to its processing, to receive it in a portable format, to withdraw consent at any time, and to complain to your data protection authority. Axial is run from the United States (section 14).
How to make a request
Use the app, or email hello@getaxial.training with “Privacy request” in the subject line and say what you want. We will check that the request comes from the email address on the account, either by replying to that address or by asking you to sign in. We don’t need a government ID. If someone makes a request for you, we need your written permission and we will confirm it with you.
We aim to confirm your request within 10 business days and to respond within 45 days. If we need more time, we may take up to 45 more days and will tell you why. Under EU and UK law the response period is one month, extendable by two. Requests are free. If a request is clearly unfounded, excessive or repetitive, we may charge a reasonable fee or decline, as the law allows, and we will explain.
Appeals. If we decline or only partly act on your request, reply to our answer with “Appeal” in the subject line. We will answer in writing within 45 days, with our reasons. If we still decline, you can contact your state attorney general, or your data protection authority outside the United States.
If you need this policy in another format, email us.
13. Children
Axial is for people 18 and older. Don’t create an account or use the Service if you are under 18. We don’t knowingly collect information from anyone under 18, and we never knowingly collect it from a child under 13. If we learn that we have, we will delete it. If you are a parent or guardian and think your child has given us information, email us and we will delete it.
14. Where information is processed
Axial is run from the United States, and your information is stored and processed here. If you use Axial from another country, you are sending your information to the United States, where privacy laws may differ from those where you live. For transfers from the EEA, UK or Switzerland, we rely on safeguards such as standard contractual clauses in our providers’ terms, and on your consent for health information.
15. Security and breach notice
- Our providers encrypt information in transit and at rest.
- Sign-in is handled by Supabase Auth, and your password is stored only in a form we can’t read.
- Database rules mean each athlete’s records can be read only by that athlete and by the beta administrator described in section 6.
- We limit administrative access to our systems and protect those accounts with strong authentication, such as two-step verification.
No system is completely secure, and we can’t guarantee that information will never be accessed without permission. If a breach of security affects your information, we will tell you, and regulators where required, without unreasonable delay and no later than the law allows. That includes state breach notification laws and the Federal Trade Commission’s Health Breach Notification Rule, which allows up to 60 days from discovery. The notice will say what happened, what information was involved and what you can do about it. Please use a password you don’t use anywhere else, and tell us at once if you think your account has been used by someone else.
16. Changes to this policy
We may update this policy. We will change the date above and, for material changes, tell you in the app or by email before they take effect. We won’t collect new categories of health information, or use health information for a new purpose, without asking for your consent first.
17. Contact us
Questions, requests or complaints about privacy: hello@getaxial.training.