Your training data belongs to you — why that's not a given
150 million accounts compromised. Military bases visible on a heatmap. Cycle data shared with Facebook. These aren’t hypothetical scenarios — they actually happened in recent years, with fitness apps used by millions of people every day.
When you’re looking for an app to track your strength training, you probably compare features: logging, timer, analytics, plans. What most people don’t compare: what actually happens to my data?
What fitness apps know about you
The average fitness app collects 12 out of 35 possible data categories — that’s what a Surfshark analysis of 16 popular fitness apps found in early 2026. The most data-hungry apps capture up to 24 categories. 80% of the apps examined share user data with third parties.
That sounds abstract. In concrete terms it means: your body weight, your training volume, when you train, how often, for how long. Combined with location data, email address, and device ID. Some apps add nutrition data, sleep patterns, or progress photos on top of that.
Three cases that make it tangible
MyFitnessPal (2018): Under Armour’s nutrition and fitness app was hacked. 150 million accounts affected — usernames, email addresses, hashed passwords. Had the incident happened 12 weeks later, GDPR would have applied and enabled fines of up to 4% of annual revenue.
Strava Heatmap (2018): Strava’s global heatmap made jogging routes on military bases in Syria, Afghanistan, and Iraq visible. Australian security researcher Nathan Ruser discovered that patrol routes and base perimeters were clearly identifiable. The US Department of Defense subsequently restricted the use of fitness trackers.
Flo Health (2021): The FTC found that the cycle-tracking app Flo Health had shared sensitive health data — cycle data, pregnancy intentions, symptoms — with Facebook, Google, and other third parties. Despite contrary promises in the privacy policy.
These aren’t isolated cases. Privacy International examined the weight-loss app Noom and found that health data from the onboarding questionnaire (height, weight, pre-existing conditions like diabetes or depression) was being forwarded in real time to five third-party providers.
Training data is health data
One point that’s often overlooked: the European Court of Justice clarified in October 2024 that the term “health data” under GDPR is to be interpreted broadly. Data from which conclusions about health status can be drawn falls under Art. 9 GDPR — the strictest protection category.
Body weight, heart rate, training volume, recovery times — all of this can qualify as specially protected health data. Processing it requires explicit consent that goes beyond the usual “I agree to the terms of service.”
In practice, many fitness apps don’t treat this data accordingly. Because it’s rarely had consequences so far.
Why mandatory accounts are a problem
Most fitness apps require you to register before you can even log a single set. The Interaction Design Foundation classifies “Forced Registration” as a dark pattern: access to basic features is restricted even though registration isn’t necessary for the functionality.
Why do apps do this? Not because your workout needs a server. But because an account with an email address and usage profile is monetizable — through advertising, data partnerships, or upselling campaigns.
Ask yourself: does an app that stores sets, reps, and weights really need your email address, date of birth, and location?
What happens when the provider shuts down?
Cloud-based apps have an expiry date. Not theoretically — practically.
Jawbone was a billion-dollar fitness tracker manufacturer. When the company was shut down, users lost access to their entire training history. The devices were still being sold on Amazon when the app was already dead.
Google Fit is being discontinued in 2026 in favor of Google Health. A migration tool was announced for “later this year.” Anyone who misses the notification risks data loss.
The pattern is always the same: your data sits on servers you don’t control. When the service is discontinued, the data is gone. Years of training history, PRs, progress data — all of it.
Offline-first is more than a feature
Computer scientists Martin Kleppmann, Adam Wiggins, Peter van Hardenberg, and Mark McGranaghan described a principle at the ACM Onward! Conference in 2019 that they call “Local-First Software”: software where data primarily lives on your device — not in the cloud.
Their core argument: cloud apps turn users into renters of their own data. Local-first flips that around. You own your data because it’s on your device. The cloud becomes optional, not a prerequisite.
For a workout app, offline-first means concretely:
- No internet needed. No loading, no spinner, no “connection failed” in the gym basement.
- No account needed. You install the app and train. Done.
- No provider risk. If the developer stops tomorrow, your data is still on your device.
- No tracking possible. What isn’t on a server can’t be analyzed, sold, or hacked.
Progress photos: the most sensitive data point
Body tracking with progress photos is offered in many apps. Rarely is it discussed what that means for privacy: you’re storing images of yourself in minimal clothing in an app. Where do they end up?
With cloud-based apps: on the provider’s servers. In a data breach — like the MyFitnessPal one — these images could end up in the wrong hands. The Privacy Rights Clearinghouse found that many fitness app developers have no privacy policy, send data to undisclosed third parties, and only a few encrypt all connections.
This isn’t a feature comparison. It’s a fundamental architecture problem: photos sitting on someone else’s servers are a risk you can’t control.
How hitPR solves this
I develop hitPR. I built this app because I couldn’t find one that combines offline-first, privacy, and complete strength training tracking without locking the basic features behind a paywall.
Here’s what that means in practice — verifiable in our privacy policy:
Offline-first. The app works completely without internet. No account needed. All training data — exercises, sets, weights, PRs — is stored exclusively on your device.
No tracking. No user tracking, no advertising SDKs, no third-party analytics. No Firebase Analytics, no Mixpanel, no Segment. I don’t know what you’re training — and I don’t want to know.
Progress photos stay on your device. Always. They’re AES-256-encrypted, locked behind biometrics, and excluded from cloud backups. Screenshots are blocked. No upload, no sync, no risk.
Cloud backup is optional. If you enable it, you get AES-256-GCM encryption with an individual key per user. Stored on Cloudflare R2 via Supabase in the EU (Frankfurt). But the app works just as well without it.
All core features free. Logging, timer, 8 progression systems, muscle heatmap, PR detection, plate calculator, 20+ programs, body tracking with photo vault, 1,300+ exercises. Pro extends analysis time ranges and adds cloud backup and the Watch Companion. None of that is necessary to train fully.
Data export anytime. Full export and import. Your data belongs to you — even if you delete hitPR tomorrow.
What you should look for
No matter which app you use — ask these questions before you enter your data:
- Where does my data live? On my device or on someone else’s servers?
- Do I need an account? If so — why? What happens with my email address?
- Can I export my data? Completely, at any time, without restriction?
- What happens in a data breach? Is my training data encrypted? My photos?
- What happens if the app is discontinued? Will I still have access to my data?
The answers usually aren’t on the features page. They’re in the privacy policy. It’s worth reading it.
Further reading:
