Privacy
Last updated 21 August 2026
The short version: almost everything STATIONS knows about you never leaves your phone, there are no analytics and no advertising trackers, and the camera is never recorded or uploaded. The long version is below, and it is written to match what the code actually does.
The camera
Video is never recorded, never uploaded, and never sent to your training partner. If you turn on rep counting, frames are read on your device, converted into a single number — how high your hips are, say — and thrown away. Nothing is stored and nothing is transmitted.
It is off unless you turn it on, and then it only wakes for stations it can count. It opens a few seconds before one of the thirty movements it can count, closes when that interval ends, and stays off through every rest, hold, carry and machine station. A session with nothing countable in it never opens the camera at all.
The one thing that does leave: the pose model is downloaded the first time you use it, from jsdelivr and Google's model host. Downloading a file tells that server your IP address, the same as loading any image on the internet. No video, and no data about you, goes with it.
What stays on your device and never reaches us
Stored in your browser, readable only by this site on this device:
- Your workout history — dates, formats, durations, exercises, how hard it felt.
- Your profile — the name you chose, your avatar, your weight if you gave it, your training days, the areas you said were sore, your ceiling height and equipment, your experience level.
- Your coach, your music choice and whether rep counting is on.
- A random device id, described below.
We cannot see any of it. Clearing your browser's site data deletes all of it permanently, and we cannot get it back for you because we never had it.
The device id
A random string generated in your browser the first time you use the app. It is not derived from anything about you or your phone, and it identifies nothing outside STATIONS. It exists so the relay can tell whether this browser has used its free call and whether it has a subscription.
What you choose to send us
When you ask about the paid version, you give us your email address, and optionally your name and phone number. We store those, along with your device id, the time, and the IP address the request came from, which we keep so we can spot abuse.
We use them to tell you when the paid version is ready and to answer you when you write to us.
Text messages only if you tick the box. Leaving it unticked means we will not text you, even if you gave us a number. If you tick it and change your mind, reply STOP or email us. Message rates from your carrier may apply.
We do not sell your details, and we do not share them with anyone for their own marketing.
Accounts
An account is a random identifier, a hash of your recovery code, and nothing else. There is no password and, for now, no email address attached to it. We cannot recover your code — we never had it, only a hash — and the identifier is not derived from anything about you or your phone.
Your browser keeps a signed token so it stays signed in. Asking for a new recovery code invalidates every token for that account, which is what to do if you lose a device.
If you ask us to email you a sign-in link, we store your address as the account's address and send the link through Resend, our mail provider, who handles the delivery. We keep a short-lived record of the request so a link cannot be used twice and so nobody can use the form to flood someone's inbox.
If you sign in with Google, Google tells us two things: your email address, and a permanent identifier for your Google account. That is the whole of it — we ask for no other access, and we cannot see your Gmail, your contacts or your calendar. It works the other way too: Google will know you have an account here, because you signed in through them. Using a recovery code instead avoids that entirely, which is why both exist.
The coach
The written personas run entirely on your device. If you turn on a fresh script, we send the shape of your session to our own server, which asks a language model to write lines for it: the names of your stations, how many sessions you have logged, your streak, how long the session is, and how hard the last one felt. No name, no email, no video, and nothing that identifies you.
Video calls
Our relay passes the two browsers the details they need to find each other. Once connected, video and audio go directly between you and your partner wherever the network allows. Where it does not, the encrypted stream is relayed through a server so the call still works. We do not record calls, and we cannot see inside a relayed one.
Payments
Stripe handles payment. We never see your card number. Stripe receives your email address and holds the payment details under its own privacy policy. We store only which device has an active subscription and the identifiers Stripe gives us for it.
Music
Music is off by default. When you turn it on, a SoundCloud or Mixcloud player is embedded from their servers, which lets them see your IP address and set their own cookies. That is their doing, not ours, and their privacy policies apply. We do not receive anything about what you listen to.
Server logs
The site is hosted on GitHub Pages and the relay runs on Cloudflare. Both keep ordinary server logs, which include IP addresses and browser details, for security and reliability. We do not build profiles from them.
What we do not do
- No analytics — no Google Analytics, no Meta pixel, no heatmaps, no session recording.
- No advertising, and no data sold or given to advertisers.
- No cookies of our own. What the app remembers, it remembers in your browser's local storage.
How long we keep things
Waitlist and subscriber details are kept while your interest or subscription is live, and for a reasonable period after, so we can handle billing questions and honour opt-outs. Ask and we will delete them sooner.
Your choices
Email hello@stations.fit to see what we hold about you, to correct it, or to have it deleted. Everything held on your device you can delete yourself by clearing the site's data in your browser. Depending on where you live you may have further rights over your personal data, and we will honour them.
Age
STATIONS is not intended for under-16s and we do not knowingly collect anything from them. If you believe a child has sent us details, write to us and we will delete them.
Changes
We will update this page when the product changes and move the date at the top.