What Heavier keeps

Plain words, written from the code on 6 October 2026. Heavier is in testing and invite only.

Your account

The name you typed, and an email only if you gave one.
When the account was made, and which invitation it came by.
Sign-in: one-time codes and device sessions are kept as hashes only, never the codes themselves. A device stays signed in for 90 days after its last use. Heavier stores the name your browser gives itself, to list your devices.

Your training

Your gyms: the name, city and country, and a location or Google Maps link if you add one.
Your exercises, sessions and sets: weight, reps, seconds, notes, and the moment each set was ticked on the phone or the watch.
Routines, plans, week targets and trips you write down.

No other account can read any of it. Every row carries your account, and the database refuses a row that points at someone else's. The person who runs Heavier sees a list of accounts on its admin page: name, email, and how many sessions and devices, not the training itself.

What leaves Heavier

Each of these only when you use it.

Class board. The part of the photo above the line you draw, or a workout you paste, is sent to Anthropic's API (Claude) to be read. Heavier keeps the reading, never the photo or the text. The part below the line, with other members' names, never leaves the phone.
Live share. Anyone with the link sees that session set by set, without notes. It closes an hour after you finish, or at once when you stop it.
Calendar link. A secret link to your plans and sessions, never your notes. A new link kills the old one.
Intervals.icu and Pelgrim, if you link them: your key or token is sealed with encryption and never sent back to any device. Heavier reads heart rate from Intervals.icu, and stays, flights and whereabouts from Pelgrim.
Your AI (the Heavier connector), if you make a token: read-only, and only for the token you made.
The Report button sends what you type to findings.dev. An account an admin made also tells findings.dev who is reporting, by its email, each time a page loads; an account made with an invite code reports without a name.
Maps on the desk load tiles from CARTO and place search from OpenStreetMap; your browser asks them directly.

No ads, no tracking pixels. Heavier sends no mail. The public pages (this one, the front page and the watch page) count visits with Umami on YINDOR's own server: no cookie, nothing that follows you to another site. The app, the desk and a live share carry no analytics at all.

Where it lives

On one server at Hetzner in Helsinki, Finland. A nightly encrypted backup goes to a Hetzner storage box in Falkenstein, Germany.

Take it with you, or delete it

On the desk, Settings: Export gives your whole record as one file, and as a CSV in Strong's format. Delete my account removes every row of yours, after you confirm twice. Copies in the nightly backups age out as older backups are pruned.

Who runs it

Heavier is a Shark Cartel app, built and run by YINDOR, Torenallee 20, 5617 BC Eindhoven, the Netherlands. KvK 42120380. Questions: the Report button in the app, or the person who invited you.