Privacy Policy
In short: we keep only what the app needs to plan your workouts and track your progress. We don't sell your data, show adverts or use tracking or analytics tools. Your friends and club-mates see your username, avatar, streak, stars and workout activity, and nothing else. You choose what they see, or turn Social off, in Profile & Settings → Privacy. You can download or delete everything at any time in Profile & Settings → Your data.
Who we are
20 Minute Athlete is run by Ashley Rolleston, the data controller for the information described here. Contact: support@twentyma.com.
What we collect and why
| Information | Why | Who can see it |
|---|---|---|
| Email address and login (or your Google account's name and email if you sign in with Google) | To create your account and let you log in | Only you |
| Username and pixel avatar (the parts you picked, not a photo) | To identify you to friends and clubs | Your accepted friends, people you send a request to, and members of your clubs |
| Optional sex, body weight and height | To suggest starting loads and to decide when a lift has passed your bodyweight | Only you |
| Training settings (your sports, experience level, equipment, schedule and workout times, the hours you mark as sport or busy, units, competition dates) | To build workouts that suit you | Only you |
| Workout history: exercises, weights, reps, dates, stars, and how each workout felt | To progress your training and show your history | Only you. Friends and club-mates see your streak, star total and short activity notes (for example "finished a workout") |
| Optional Swim England membership number (only if you link it), and your best times read from swimmingresults.org | To spot new personal bests from your meets. Our server reads your public results page at most once a day; your name and club from that page are shown to you once so you can check it's you, and are not saved | Only you. Friends and club-mates (if you share activity with them) see a short note such as "swam a PB in 100m Freestyle (LC)", never your time. Unlink it any time in Settings, which deletes the number and saved times |
| Optional Strava connection (only if you connect it): your Strava athlete number, the keys Strava gives us to add activities, and which days you sent | To send a workout or mobility session to your Strava when you tap Send. We only ask Strava for permission to add activities, so we can't read anything from your Strava | Only you. What you send (exercises, sets, reps, weights, the time and a short description) goes to Strava and gets your Strava privacy setting. Disconnect any time in Settings, which deletes the keys; activities already sent stay on Strava until you delete them there |
| Jump test results (jump heights, a confidence score, the height used, the camera frame rate, and knee-alignment measurements from the video) | To track your jump over time | Only you |
| Ankle test results (the knee-to-wall distance you type in for each foot) | To track your ankle range over time | Only you |
Body weight, height and how a workout felt can be health information. We use them only to run your training in the app, and only because you chose to give them. You can leave the optional ones blank.
"Only you" means other people using the app. The person who runs the app can also see account data, as described below.
Share pictures and .fit files are made on your device. They only go where you send them (for example through your phone's share menu, or to an app you import the file into), never to us.
The jump test and your camera
The jump test uses your phone's back camera. The app asks for camera access only when a jump test starts. The video is recorded and analysed on your device only. It is never uploaded. The clips are kept on this device until they've been measured, so closing the app doesn't lose your jumps. After that, your best jump from your latest test of each kind (vertical and broad) is kept so you can watch it again from Progress; a newer test replaces it, and the rest are thrown away. Clearing the app's site data on your device removes it.
Only numbers are saved with your workout history: your jump heights, a confidence score, the height you entered, the camera's frame rate, and knee-alignment measurements taken from the video. The knee-alignment numbers are measured and saved but not shown in the app yet.
What the person running the app can see
Ashley Rolleston runs the app and can open its database to keep the service working, secure and suitable, and to help you when you ask (for example after a problem with your account). That means the data above can be seen by them, but it is only looked at for those purposes, or to answer a legal request. They can remove an offensive username or club name, and delete an account (for example if you ask us to, or for serious misuse). There is no analytics or tracking tool on top of that.
Our legal basis (UK GDPR)
We process your information to provide the service you asked for (contract), and your optional health details with your explicit consent, which you can withdraw at any time by removing them or deleting your account. We keep backups and moderate usernames and club names because we have a legitimate interest in keeping the service working, secure and suitable for everyone.
Where it's stored and who processes it
- Cloudflare hosts the app and runs its server code.
- Supabase provides login and stores your account data in its database (hosted with Amazon Web Services).
- Google, only if you choose Google sign-in.
- Strava, only if you connect it and send a workout to it. Strava's own privacy policy covers what it does with it.
- The app loads fonts from Google Fonts and code libraries from the jsDelivr and unpkg networks; these services see your device's IP address when they send those files.
Some of these providers process data outside the UK, including in the United States, under safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.
Your device also stores today's workout and a few preferences so the app works quickly and offline. Nothing is used to track you across other sites.
Trying the app without an account. If you start as a guest, everything you enter (your training settings and workouts) is kept only on your device, in your browser's storage. It is not sent to us. We only count, under a random number your device makes up, whether you finished setting up, how many workouts you did and whether you went on to sign in, so we can see how many people try the app and keep going. If you then create an account, it is moved into your account. If you don't, it stays on your device until you delete it in Profile & Settings → Your data or clear your browser's data.
How long we keep it
For as long as you have an account. When you delete your account, your data is removed from our database straight away. Clubs you own pass to their longest-standing member.
Backups. Our database provider (Supabase) may keep its own short-term backups so your training isn't lost if something goes wrong. They hold a copy of the account data described above (not your password) and expire on the provider's schedule. If you delete your account, copies in those backups disappear as they expire.
Your rights
You can access, download, correct or delete your data. Download and delete are built in: Profile & Settings → Your data. For anything else, or to object or ask a question, email support@twentyma.com. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office (ico.org.uk).
Health note
20 Minute Athlete gives general strength training guidance. It isn't medical advice. If you have an injury, a medical condition or are pregnant, check with a doctor or physiotherapist before you start, and stop any exercise that causes pain.
Changes
If this policy changes in a way that matters, we'll say so in the app.