BIP

Privacy policy

Last updated 18 September 2026. The data controller is AlgoMate AB (company reg. no. 559539-0963), which provides the service under the BodyInProgress brand ("BIP", "we"). Questions: support@bodyinprogress.se.

What we store, and why

• Account: email address, display name and login details (through Supabase). Needed for your account to exist. Legal basis: contract.
• Training profile: age, training experience, goal, equipment and any injuries or preferences you enter. If you choose macro targets, also sex, height, weight and activity level. Used to create your programmes and work out your targets. Legal basis: contract, and for health-related data your explicit provision of it.
• Training data: the sessions, sets, weights, times, records, XP and challenges you log. That is the service itself. Legal basis: contract.
• Body measurements: if you choose to measure and weigh yourself, we store the measurements you log (such as weight and waist) with their dates, along with which measurements and which schedule you have chosen. The feature is optional and can be switched off in settings; you can delete what you have logged yourself, day by day. Legal basis: your explicit provision of the data.
• Before you create an account: if you create a free programme without an account, we store the programme and what you fill in during the session, tied to a random id in your browser. That way nothing is lost when you do create the account, even if you open the login link in a different browser. If no account is created, the data is deleted automatically within 30 days. Legal basis: legitimate interest.
• Payment: handled by Stripe, with AlgoMate AB as the payee. Your payment details never reach us; we store only a customer id, your plan and receipt records. Legal basis: contract and the Swedish Accounting Act.
• Partner code: if you enter a partner's code when you buy Premium, your subscription is linked to that partner in our accounts, so that the partner can receive their share of what you pay. The partner never sees who you are, only the number of customers and the amounts. Legal basis: contract.
• How you use the app: we log page views in our own database, together with which campaign or which website you arrived from (never the full address). If you are logged in, the page views are linked to your account. We do this to understand where the app is awkward, which parts are used, and when we send too many or too few emails, in other words to make the product better, never to target advertising. If you are logged out, unique visitors are counted on our server instead, as an unrecognisable code worked out from your IP address and browser version together with a secret and today's date. Your IP address is never stored, the code changes every day and cannot be followed over time, and nothing is stored in your browser for this. On the home page we also note how far down you read, as the name of the last section you saw, and how long the page was open. That is the same anonymous note as above, and it helps us see where the text loses people. No third-party pixels. No ad networks, no sale of data. Legal basis: legitimate interest.
• What we have sent you: a log of the notifications and emails we have sent to your address, with the time, the type and the subject line, so we can see what you actually received and avoid sending the same thing twice. The content of the email is not stored in the log. Legal basis: legitimate interest.
• Operations and abuse protection: generation logs and technical errors. Legal basis: legitimate interest.
• Feedback and support: what you write to us, with your email address so we can reply. Legal basis: legitimate interest.
• Inviting a friend: if you enter a friend's email address, we send an email with your referral link. If that address already has an account with us, no email is sent, and you are not told which of the two happened: whether someone is a member here is their business, not yours. The address is not stored in our database, it only passes through our email provider. Legal basis: legitimate interest.

If you contact us on social media

If you write to us on Instagram, Facebook or Threads, we store the message or comment together with your username and the profile information that is public, so that we can read and answer you. The basis is legitimate interest.

Those conversations are kept indefinitely, unlike our other communication logs, so that we have the context if you get in touch again. If you want us to delete what you wrote, email support@bodyinprogress.se.

Who processes the data on our behalf

• Supabase (database and login). The database is located in Sweden.
• Vercel (hosting of the web app, plus anonymous traffic and performance statistics, without cookies).
• Stripe (payments).
• Resend (sending email, sender konto@bodyinprogress.se).
• OpenAI and Anthropic (one step in the generation): the programme is built by our own engine, which picks exercises from our catalogue and works out sets, rest and progression. In the step that writes the session, your training profile is sent to one of them. Under their API terms, the data is not used to train their models.
• Cloudflare Turnstile (bot protection on the free generator).
• Google, Apple and Microsoft (only if you choose to log in with one of them). We then receive your email address from the provider, nothing else. If you choose Apple's Hide My Email, we only receive the forwarding address.

Transfers outside the EU/EEA

Several of the providers above are US companies, so data may be processed in the United States. The transfers rest on the European Commission's standard contractual clauses, and for those providers that are certified under the EU-US Data Privacy Framework on that decision. If you would like a copy of the safeguards, email support@bodyinprogress.se.

Cookies and browser storage

Your login session and your theme choice are stored in the browser and are needed for the app to work. If you start creating a programme without an account, a random id is stored as well, so that the programme and what you filled in are still there when you register. It is created only then, not when you are simply reading. If you arrive through a campaign link, we store which link it was, so we know which channel works. We store no id in order to count visitors, that is done on the server instead. No third-party tracking cookies.

How long

For as long as your account exists. Traffic statistics and the log of what we have sent are cleared automatically after 180 days, and programmes you created without then registering an account are cleared within 30 days. If you delete your account, your data disappears permanently from the database; accounting records for payments are kept for as long as the law requires.

Your rights

You can see and correct your data in the app at any time, and delete the whole account under Settings (everything is removed permanently and an active subscription is ended). You also have the right to request a copy of your data, data portability, or to object to processing: email support@bodyinprogress.se. If you are unhappy, you can complain to the Swedish Authority for Privacy Protection (imy.se).

This policy is available in Swedish and English. If the versions differ, the Swedish version applies.