PLATES

Privacy Policy

Last updated 12 September 2026 · Applies to the Plates web app and this website, and to the desktop app once you switch its optional sync on — see section 11.

1. Who holds your data

Plates is operated by Davlatsho Shirinbekov of 156 Hamlet Gardens, London W6 0TR, United Kingdom, a sole trader in England and Wales. There is no company number, because there is no company: Plates is one person, and that person is the data controller under the UK GDPR and the EU GDPR for everything described here — they decide what is collected and why.

For anything in this policy, write to privacy@plates.cloud. There is no Data Protection Officer. One is required for large-scale special-category processing, and this is a one-person service — but the health data in section 6 is exactly the kind that would make it required at scale, so it is a question that gets asked again as Plates grows rather than one that has been settled forever.

2. What is held

What you give us to have an account

• Your email address. It identifies the account and is where a password-reset link goes. It is the only contact detail Plates asks for.
• Your password, stored only as a PBKDF2-SHA256 hash with a per-password salt. The password itself is never written down, never logged, and cannot be read back — not by us either. If you lose it, the only route back in is a reset link.
• A username, if you choose one. It is the one thing in Plates that has to be globally unique.
• What a subscription adds. An account is a paid one, so Stripe — not us — collects your card details and billing address and takes the payment. Card numbers never reach our servers; the payment page is Stripe's own. What comes back to us and is stored against your account is: a Stripe customer and subscription reference, whether the subscription is active, which plan it is on, how many add-on blocks it carries, and the country on your billing address — which is kept because Plates is only sold in some countries and we have to be able to show which one applied. We also keep a record that you ticked the box waiving the 14-day cancellation right, and when, for the same reason any other consent is recorded. Invoices, receipts and the card itself live at Stripe, reachable from Panel → Account.
• Your date of birth. Asked once, at sign-up, and used for exactly three things: whether you are old enough to hold an account at all (18), whether you can give your own consent to health-metric processing (16 — see section 12), and — only if you have given that consent — to work out the age shown on your profile. It is never shown to anyone and is not used to profile you. Working the age out rather than asking for it again means your profile does not keep a second copy that quietly goes out of date; withdrawing the consent stops it being used that way, and clears the age along with everything else that permission covered.

What you put into the app

All of it. Plates is a training log, so the point of the product is that it keeps what you write in it:

• Training records — exercises, sets, weights, reps, sessions, rest times, notes, programs, mesocycles, goals, training phases and personal records.
• Daily log entries — bodyweight, calories, protein, carbohydrates, fats, water, sleep hours, whether you trained fasted, and free-text notes.
• Profile details, all optional — display name, age, gender, height, when you started training, training style and a bio.
• Photos and videos you upload: progress photos, lift videos, wallpapers, a profile picture, and anything attached to a post.
• Posts you write on your own wall, and your app preferences — theme, wallpaper, units, widget layout and the rest.

What the service records by itself

• Your IP address, briefly, when you sign in, sign up or ask for a password reset. It is used as a counter key so that nobody can hammer the sign-in endpoint or work through a list of leaked passwords. The counters are keyed by IP and by email address, and each one is discarded as soon as its window closes — at most an hour. Nothing links a counter back to your account's records.
• Your sessions. When you sign in, a random token is created; the server stores only its SHA-256 hash, alongside your account and an expiry date, so that a copy of the database cannot be replayed as a login.
• Server logs kept by our hosting provider, which include IP addresses and request paths. See section 5. On the plan we are on, Cloudflare keeps them for 7 days and then they are gone. We do not export them anywhere that would keep them for longer, we do not read them routinely, and nothing is built on top of them.

What is deliberately absent

There is no analytics, no advertising, no tracking pixels and no third-party scripts of any kind — on this website or in the app. Nothing about you is sold, rented or shared with anyone for marketing. The fonts are served from our own servers rather than a font network, specifically so that loading a page does not announce you to a third party. The app's Content-Security-Policy forbids it from connecting anywhere except its own origin, which is a rule the browser enforces rather than a promise you have to take on trust.

In this version of Plates, no other user can see anything you write. The social features (Circles) are not switched on, so profiles, posts and walls are visible only to you. If that changes, this policy changes with it, and you will be told before it does.

3. Why, and on what basis

We do not send marketing email. If that ever changes it will be a separate opt-in that you have to actively choose, and unticking it will not affect your account.

4. Cookies

Plates sets exactly one cookie, and it is strictly necessary.

It is HttpOnly (no script on the page can read it, including any script an attacker managed to inject), Secure over HTTPS, and SameSite=Lax so another site cannot make your browser act as you.

There are no analytics, advertising, or preference cookies, and no other local storage is used to identify you. Because the one cookie we set is strictly necessary to deliver a service you asked for, no consent banner is required under the UK's PECR or the EU's ePrivacy Directive — and rather than show you a banner that does nothing, we have written the reason down here instead.

5. Who else touches it

Running a hosted service means other companies hold the data on our behalf. These are all of them. Each is a processor acting on our instructions, under a contract, and none of them may use your data for their own purposes.

That is the complete list. There is no analytics provider, no advertising network, no customer-messaging tool, no AI provider, and no CRM.

6. Health and fitness data

Plates does not ask you for medical information, and it has no fields for conditions, medications, injuries or diagnoses. But it does hold your bodyweight, your sleep, what you eat, your age, your height and your physical performance over time — and free-text notes in which people write whatever they like.

That combination may count as data concerning health, a special category under Article 9 of the UK and EU GDPR, which needs a stronger basis than ordinary personal data. Rather than argue the point, we treat it as though it does:

• We ask before storing any of it. Sign-up carries a separate, unticked box for it, apart from accepting the terms — and the account is created whether or not you tick it. A permission you have to give in order to register is not freely given, and so is not a permission.
• Declining costs you those fields, not the app. Everything else works: exercises, sets, reps, weights, sessions, programs, goals, the analysis. The daily log simply will not save a bodyweight, and the server refuses it rather than quietly accepting and dropping it.
• You can withdraw at any time, in Panel → Account → Health metrics, with no email to anyone. Withdrawing deletes every bodyweight, sleep, food and water entry, and clears your age, gender and height. Stopping means stopping — keeping the history would be continuing to process it. Your training records are untouched.
• We record what you agreed to and when, including which version of the wording, because we have to be able to show that the permission was given. A withdrawal marks that record rather than erasing it.

We have chosen to treat these fields as special-category data and to ask for explicit consent even though it is arguable that a bodyweight is not health data. The cost of being wrong in that direction is one extra checkbox; the cost of being wrong in the other is a special-category breach.

The free-text notes on a session are not covered by that consent, because we cannot know what is in them — they are yours to write, and they are held as ordinary account data under the basis in section 3. Please do not use them to record medical information. If you already have, deleting the note removes it, and deleting your account removes all of it.

What we can say plainly today: this data is never used to profile you, never sold, never shared with insurers, employers or advertisers, and never seen by another user of the app. It exists to be shown back to you.

7. Where it is kept

Your database records are held in the European Union (Frankfurt, Germany) and your uploaded files in Cloudflare R2 under its European Union jurisdiction restriction, which keeps stored objects within the EU. Both therefore sit inside the UK/EEA, so no international transfer mechanism — the UK IDTA or the EU Standard Contractual Clauses — is required for the data at rest.

The website and application code run on Cloudflare's network, which means the server closest to you handles your request wherever you are; your stored data stays in the regions named above.

Two things do leave, and it would be dishonest to leave them out of that sentence. Payment processing (Stripe) and transactional email (Resend) are both run by companies with operations in the United States, and the data they hold — your email address, and for Stripe your billing details and payment history — may be processed there. Each does so under its own data processing agreement with us, carrying the UK International Data Transfer Addendum and the EU Standard Contractual Clauses; those are the transfer mechanisms the paragraph above says are not needed for your training records, and they are needed for these. Nothing you log — no set, session, photo, video or body metric — is sent to either.

8. How long it is kept

• Your account and everything in it: until you delete it. A training log is only worth having because it is years long, so nothing expires on its own.
• Deletion is immediate and irreversible. When you delete your account, every uploaded file is removed from storage, then every row is removed from the database, then the account itself. There is no recycle bin and no grace period, and we cannot restore it afterwards. Export first if you want a copy.
• Sessions: 30 days, and immediately on sign-out. Changing your password destroys every session on the account.
• Password-reset tokens: one hour, single use, and asking for a new link kills the previous one.
• Rate-limit counters: at most one hour.
• Billing records: kept by Stripe, and kept for six years after the tax year they fall in, because HMRC requires records of a sale to be retained that long. This is the one thing deleting your account does not delete, and it is the only thing: an invoice is evidence of a transaction, not a part of your training log. What we hold on our side — the Stripe references, the plan, the blocks — goes when the account goes.
• Consent records: for as long as the account exists, including after a withdrawal — the record that a permission was given, and later taken back, is the evidence we are required to keep. It goes when the account goes.
• Backups: up to 7 days. Our database provider keeps a rolling point-in-time restore history of at most seven days, which is a safety net against our own mistakes rather than a second copy of your account. It has an honest consequence and here it is: for up to a week after you delete your account, the data is still recoverable from that history, and only after it rolls off is the deletion final everywhere. Your uploaded photos and videos are not in it at all — those are deleted from storage outright, with nothing to roll off.

9. Your rights

Under the UK and EU GDPR you have the rights below. Two of them are buttons rather than requests, because a right you have to write an email to exercise is a right with a queue in front of it:

• Access and portability. Panel → Account → Your data → Download my data gives you everything held on your account as a single JSON file: every set, session, program, goal, post and setting, plus a list of your photos and videos and where to fetch each one. It is machine-readable and yours to take anywhere.
• Erasure. Panel → Account → Danger Zone → Delete Account removes the lot, as described in section 8. You do not have to ask us.
• Rectification. Everything in the app is editable in the app. For your email address, use Panel → Account.
• Objection and restriction. Write to us; the only processing not strictly needed to run your account is the security rate-limiting in section 3, and we will explain rather than quietly ignore you.
• Withdrawing consent. Panel → Account → Health metrics turns the body-metric permission off and deletes what it covered. It is one click, the same as giving it, because the law requires withdrawal to be no harder than consent — and because a permission you cannot take back was never much of one.
• Complaining to a regulator. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU, your national supervisory authority. You can go to them directly, but we would rather you gave us the chance to put it right first.

We answer requests within one month, as the GDPR requires. There is no charge.

10. How it is protected

• Passwords are hashed with PBKDF2-SHA256 at 100,000 iterations with a per-password salt, and compared in constant time. The password itself is never stored, and a leaked database does not hand anyone a working login.
• Session tokens are stored only as hashes, so a leaked database does not hand anyone a working login.
• Every single query is scoped to your account, including reads of nested records, so no identifier supplied by a browser can reach into anyone else's data. This is verified by automated tests that try it deliberately.
• Sign-in, sign-up and password-reset are rate limited by both email address and IP address, which is what catches an attack spread thinly across many accounts.
• Changing your password signs out every device, which is the whole point of changing it.
• The app is served over HTTPS only, with HSTS, and under a Content-Security-Policy that forbids third-party scripts and any connection off our own origin.
• Uploads are checked by type and size, stored under names the server generates, and served with the content type they were stored as, so an uploaded file cannot be talked into executing.

No system is perfect. If we ever suffer a breach that is likely to put your rights at risk, we will tell the regulator within 72 hours and tell you without undue delay.

11. The desktop app

The downloadable desktop version of Plates keeps everything in a database file on your own computer. Out of the box it has no account, sends nothing anywhere, and works with no internet connection at all — so for most of what it does there is nothing for this policy to govern.

The one exception is sync, and it is off until you turn it on. The desktop app can be linked to a Plates account so that what you log on your computer appears in the web app, and the other way round. Enabling it takes three deliberate steps in Panel → Sync: entering the address of the server, signing in, and switching it on. Until all three are done, nothing is transmitted and the paragraph above is the whole story.

Once you have turned it on, what travels is your training content — exercises, sets, sessions, programs, your settings and appearance, and the photographs and videos you have attached — and from the moment it arrives here it is covered by the rest of this policy exactly as if you had typed it into the web app. The same rights in section 9 apply to it: you can export it, and you can delete it.

Two things about it are worth stating plainly, because it would be reasonable to assume either the other way round:

• Body measurements are not included unless you separately agree. The permission in section 6 is asked for in the desktop app too, and sync cannot be switched on until it has been answered — bodyweight, sleep, food, your age and your height are the fields it covers. Withdrawing it there switches sync off with it, rather than quietly continuing without those fields.
• Switching sync off stops anything further being sent; it does not delete what is already here. That is what the export and deletion controls in section 9 are for, and they work whether or not sync is still on.

Your sign-in for the desktop app is kept in a file separate from your training database, encrypted by your operating system's keychain where it provides one and held only in memory for that session where it does not. Either way it is never written into the database itself — so a backup you make, or send to someone, cannot sign anybody into your account.

12. Age

You must be at least 18 to hold a Plates account. An account is a paid subscription and nothing else, and a contract with a minor is not enforceable the same way everywhere — so rather than sell to someone who cannot be held to the agreement, we do not. If we learn that an account belongs to someone younger, we will delete it.

The free desktop and phone apps are 16 and over, and they have no account, no server and nothing to send anywhere — so there is nothing on that side for this policy to govern until sync is switched on, which needs an account, which needs 18.

We collect a date of birth at sign-up, and it is used for exactly two decisions: refusing an account to anyone under 18, and deciding whether you can give your own consent to health-metric processing. That second permission is available from age 16 — the highest age any EU member state has set for it, applied uniformly rather than varying by country. With the account floor at 18 every account holder is already past it, so in practice that gate never fires on the web; it is kept because it is the same number the desktop app asks, and because the account floor moving must not quietly move this one with it.

13. Changes

If this policy changes in a way that affects you, we will tell you in the app before it takes effect rather than quietly changing the date at the top. The date at the top is the last time anything changed at all.

14. Contact

privacy@plates.cloud — for anything on this page, including access, deletion and complaints. By post, the address in section 1.