Privacy at Fast Sets

Last updated: 07-09-2026

Fast Sets is a small service run by one person. This is written to be understood, not to cover anyone's back. If something isn't clear, write to us and we'll fix it.

Who is responsible for your data

Fast Sets is run by Wenbo Zhou as a personal project, with no company behind it: there's no registered address or tax ID to publish.

Write to [email protected] about anything on this page.

What we store, and why

Your account. Your username, your password (stored hashed — we don't know it and can't recover it), the date you signed up, and your unit preferences (kilos or pounds, kilometres or miles). Without this there is no account.

Your email address, if you give us one. It is optional. We use it for exactly two things: to confirm the address is yours, and to let you reset your password if you forget it. We will never send you anything else — no newsletters, no announcements, no marketing. We don't share it with anyone except the service that delivers the message (below).

Your training. The days you train, the exercises, and for each set: weight, reps, distance, time, effort (RPE), whether it was a warm-up, and any comment you write. This is the service.

The FitNotes backup file you upload. If you upload your .fitnotes file, we keep the whole file, exactly as it arrives. We need it so we can hand it back to you later with your new training inside and have FitNotes still accept it. Be aware: that file may contain things Fast Sets neither uses nor shows you — routines, body measurements, goals, settings — and we keep them, because stripping them would break the file. We only keep the most recent one you uploaded. If you'd rather not give us that file, don't upload it: the app works without it.

Your sessions. When you sign in we record a short label for your device ("iPhone · Safari"), when you signed in, and when you last used it. It's so you can see where you're signed in and sign out remotely if you lose your phone. We do not store your full browser fingerprint, only that label.

If you press "Send diagnostics". That button lives in your profile and does nothing unless you press it. It sends us what your device knows about itself: which version it's running, whether it was online or offline, how much data it has stored locally, your profile ID, your browser's user-agent string, and the last few things the app noted internally — a closed list of technical facts: never your email address or the content of your sets. We use it to fix faults that only happen on one specific phone. It gets written to the server log. Don't press it if you don't want to send it.

Your IP address. We use it, for the length of the request, to stop people guessing passwords or flooding the server. We don't store it: it lives for one minute in the program's memory and is discarded. Cloudflare does log it (below).

What we don't do

• We don't sell or rent your data to anyone.
• There is no advertising, no analytics, no third-party cookies, no tracking pixels. The page loads nothing from any other site, not even fonts.
• We don't use your training data to train AI models.
• We don't combine your data with anyone else's or build a profile of you.
• We make no automated decisions about you.

Where your data lives

On a computer in the home of the person who runs Fast Sets. It is not a data centre: it's a small computer in a private home, connected to the internet through Cloudflare.

Two companies are involved, and only these two:

• Cloudflare (cloudflare.com/privacypolicy): sits in front of the server. Everything in and out passes through their machines. Cloudflare sees the traffic and logs the IP addresses that visit.
• Resend (resend.com/legal/privacy-policy): delivers the two emails (confirming your address and resetting your password). We give them your address, the subject and the message text. We never give them your training data.

Both are US companies, so using Fast Sets means your data leaves the European Economic Area. Both rely on the mechanisms provided for that (standard contractual clauses and/or the EU-US Data Privacy Framework).

How long we keep it

• For as long as you have an account. We don't delete anything on our own and we don't expire accounts for inactivity.
• Sessions expire after 30 days without use. After that you sign in again. Closed sessions are fully deleted the next time anyone signs in, once that time has passed since they closed — the clean-up is tied to a sign-in, not to a clock of its own; if nobody ever signs in again, those rows are never deleted on their own.
• Emailed links expire in 24 hours (confirming your address) or one hour (resetting your password), and work only once.
• Backups. We back up the database daily so nobody loses their history if a disk fails. After you delete your account, your data still exists inside those backups until they age out: at most 30 days. Those backups are never opened or used except to recover from a failure.

What you can do

You can exercise these rights at any time. The ones with a button, yourself, from Profile; for the rest, write to [email protected]. We reply within 30 days, which is what the law requires, and usually much sooner.

• See your data: it's in the app: history, calendar, statistics and your profile.
• Take it with you: Profile → Export: download your whole history as a FitNotes CSV, or the full .fitnotes file, whenever you like, no need to ask.
• Correct it: edit or delete any set or any day from within the app.
• Sign out elsewhere: Profile → Sessions: see where you're signed in and close any of them.
• Remove your email: there is no button yet to blank it yourself; write to us at [email protected] and we'll do it by hand. If you'd rather not depend on that, deleting the whole account (right below) removes it too.
• Delete your whole account: Profile → "Delete my account", immediately, with nobody's reply to wait for: your exercises, your days, every set, the file you uploaded, your sessions and your email all go with it. Nothing is left, except whatever is in the backups until they age out (above). If that button is ever unavailable to you, write to [email protected] and we'll do it by hand.
• Object to or restrict processing: write to us and let's talk.

You can also complain to a data protection authority if you think we've got this wrong. In Spain that's the Agencia Española de Protección de Datos (aepd.es).

Our legal basis

We process your account and training because it is necessary to provide the service you asked for (GDPR Article 6(1)(b), performance of a contract). We process your email on the same basis, so we can give you your access back if you lose your password. We keep backups and rate-limit abuse on the basis of legitimate interests (Article 6(1)(f)): so nobody loses their history and the service stays up.

If you visit without an account

If you open fast-sets.com without signing in, you see the front page and the waitlist form. Nothing else: no account is created and none of our cookies are set. If you enter your e-mail in that form, we store it together with the language you were reading the page in, and we use it for one thing only: writing to you with your invitation when your turn comes. If you change your mind before then, write to [email protected] and we will delete it.

Minors

Fast Sets is not intended for anyone under 16. You can't get in without an invitation, so we know who's in; if we find out an account belongs to someone under that age without their guardian's permission, we delete it.

If this changes

If we change this text we'll change the date at the top. If the change matters, we'll tell you inside the app before it takes effect.