Privacy
Last updated 11 August 2026
PLIFF is a training log. To do its job it has to hold what you lift, and — if your gym uses it — some of that is visible to the staff there. This page says exactly what is kept, who can see it, and how to take it back. It is written to be read, not to be survived.
PLIFF is run by PLIFF, operated by Yonnick August, Barbados. There is one person behind it, and that person is responsible for everything described here.
What is stored
Because you gave it to us
- Your email address, and a name if you enter one. The name is optional and can be anything you like.
- Your password, as a bcrypt hash. The password itself is never written down anywhere. Nobody — including us — can read it back, which is also why a forgotten password can only be reset, never recovered.
Because you used the app
- Your training. Sessions, exercises, sets, weights, reps, notes, plans, and personal records.
- Your bodyweight, if you log it. See below — this one has its own rule.
- Food entries and targets, if you use the nutrition side.
- Social activity: friend links, shared plans, and challenges you join.
- Notifications sent to you, and — if you switch push on — a subscription token from your browser so the message can reach your device.
Because the app has to work
- A session cookie, so you stay signed in. It is the only cookie PLIFF sets, it is strictly necessary, and it is not used to track you anywhere.
- Rate-limit counters against your IP address, so sign-up and sign-in cannot be run as a loop. These are deleted automatically after a day.
- Payment records, if you buy: what was bought, the reference, and whether it was confirmed. Card numbers never reach PLIFF — when card payment is used, the card is handled entirely by Stripe.
Who can see it
If you train on your own, the answer is: you. Nobody else has a way to see your training in the app.
If you are a member of a gym on PLIFF, some of it is visible to that gym's staff — that is the point of a gym using it — but not all of it, and the limits are enforced in the code rather than by policy:
| What | Your gym's staff | Other members |
|---|---|---|
| Attendance and training volume | Yes | No |
| Sessions and lifts | Yes | No |
| Bodyweight | Never | No |
| Food and nutrition | Only while you allow it | No |
| Your email address | Yes | No |
Bodyweight is never shown to gym staff. Not to a coach, not to the owner, not on any screen or export. It is the one number people are most likely to be private about, and the app is built so that there is no setting that could accidentally reveal it.
Nutrition is shared with staff only while you allow it, and you can turn that off at any time in your settings. A coach you are assigned to sees the clients assigned to them; the owner sees the whole roster.
Members never see each other's training. Friends and challenges are opt-in and show only what those features are for.
Where it lives
PLIFF is built in Barbados, but the servers are not here. Your data is stored and processed in the United States by the companies below. If that matters to you, it is better that you know it now than discover it later.
| Who | What they do | Where |
|---|---|---|
| Neon | Hosts the database — every record described above lives here. | United States (AWS, us-east-1) |
| Vercel | Runs the app and serves the pages. | United States, with edge servers worldwide |
| Resend | Delivers email: confirmations, password resets, gym invitations. | United States |
| Stripe | Takes card payments, when card payment is switched on. PLIFF never sees or stores your card number. | United States and Ireland |
That is the complete list. PLIFF does not sell your data, does not share it with advertisers, and has no advertising on it.
Analytics
PLIFF does not run advertising trackers and sets no advertising cookies. If page analytics are switched on, they are anonymous and aggregate — counts of pages viewed, nothing tied to your account and nothing that follows you to other sites.
How long it is kept
- Your account and training: until you delete it. A training log whose history quietly expires is not a training log.
- Unfinished sign-ups are deleted after 7 days. Password reset links expire in 45 minutes; confirmation and invitation links in 7 and 30 days.
- Rate-limit counters are deleted after a day.
- Payment records are kept after deletion where we have to keep them for accounts and tax.
Getting it back, and getting rid of it
Both of these are buttons in the app, not requests you have to send anybody:
- Export. Your account page will give you everything PLIFF holds about you, as JSON or CSV, immediately.
- Delete. Also on your account page. It removes your account and everything attached to it — sessions, sets, plans, bodyweight, food, friendships. It is immediate and it cannot be undone. The one case where it is refused is if you are the last owner of a gym that still has members, because that would strand them; hand the gym over or disband it first.
If your gym removes you from their roster, your account and your training stay yours.
Security
- Passwords are stored as bcrypt hashes, never as text.
- Everything travels over HTTPS, and the app tells browsers to refuse plain HTTP.
- Changing your password signs out every other device, so a reset actually removes whoever prompted it.
- Confirming your email is what creates your account, so nobody can sign you up for PLIFF using your address.
- Sign-in, sign-up, resets and invitations are all rate limited.
No system is perfect and it would be dishonest to claim otherwise. If something ever goes wrong with your data, you will be told what happened rather than left to find out.
Children
PLIFF is not intended for under-16s. If a gym adds a junior member, the gym is responsible for having a parent or guardian's permission first.
Changes
If this page changes in a way that affects what is collected or who can see it, account holders will be emailed. The date at the top is the last substantive change.
Getting in touch
Questions about any of this, or a request to see, correct or delete something, go to the contact address on the site. You will get a reply within two working days, and a request to delete or export will be actioned within seven — though both are instant if you do them yourself in the app.
Your first 30 days are free and no card is required, so you can see exactly what PLIFF holds before you decide to keep using it. The terms cover the rest.