PRIVACY POLICY
This Privacy Policy explains how 300WOD™ collects, uses, stores and protects personal information across the 300WOD member platform — including authentication, memberships, workout history, body profile, performance data, Muscle Readiness, Adaptive Week, 30-Minute Intelligence™, load calibration, referrals, First 300, testimonial submissions, AI Coach (OpenAI processing), Stripe payment processing and all other member features.
Last updated: September 2026
1. WHO WE ARE
300WOD™ is a fitness and training platform built around the principle of 6 exercises × 50 reps = 300 — one Standard, every level. The platform provides personalised workout generation, load calibration, performance tracking, Adaptive Week scheduling, Muscle Readiness monitoring, community features and the Founder's Diet™ nutrition philosophy.
2. DATA CONTROLLER
Current Controller
The data controller for personal information processed through 300WOD™ is:
300WOD™
Denmark
CVR No.: 46758447
3. CONTACT
Privacy & General Enquiries
contact@300wod.com4. INFORMATION WE COLLECT
Account & Authentication
- Email address — Account creation, authentication, service communications
- Display name — Personalisation, community display
- Password (hashed) — Authentication
- Auth session tokens — Session management
Profile & Body Information
- First name, last name — Personalisation
- Gender — Workout personalisation
- Date of birth — Age-appropriate recommendations
- Height (cm) — Body profile / personalisation
- Bodyweight (kg) — Load calibration, volume calculation
- Country — Localisation, geographic analytics
- Training level — Adaptive workout generation
- Available equipment — Exercise selection
- Preferred training days — Adaptive Week scheduling
Workout & Performance Data
- Workout results (time, reps, volume) — History, progress tracking, 30-Minute Intelligence
- Exercise loads (kg) — Load calibration, Exercise Load History
- Athlete Standard / tier — Standard classification, leaderboard
- Achievements / PRs — Completion card, motivation
- Load calibration recommendations — Personalised load progression
- Saved workouts — Workout library
Adaptive Intelligence
- Adaptive Week plan — Weekly workout scheduling
- Muscle Readiness data — Recovery-aware scheduling
Membership & Entitlement
- Membership status / source — Access control, feature gating
- Founder / First 300 status — Entitlement, badge display
- Complimentary access records — Access control
- Stripe customer ID — Link Stripe subscription to 300WOD account
- Stripe subscription ID / status — Subscription state, access control
- AI Coach entitlement — AI Coach access control
Testimonials & Community
- Story / testimonial text — Community, public website stories
- Display name (testimonial) — Attribution on published story
- Workout metrics (shared) — Community story context
- Photo (if submitted) — Community story
Referral & Acquisition
- Referral code — Referral attribution, rewards
- Acquisition source / campaign — Marketing attribution
Communications
- Email communications — Account, membership, service notices
- Marketing preferences — Optional marketing communications
5. ACCOUNT AND MEMBERSHIP DATA
When you create a 300WOD™ account, we process your email address, chosen display name and password (stored as a secure hash managed by Supabase). Your account is used to authenticate you, provide access to your membership tier, and personalise your training experience.
Membership status, entitlement tier (including Founder, First 300, Paid Member and Complimentary Access), and access history are stored to control which features you can access and to fulfil our service obligations to you.
6. WORKOUT AND PERFORMANCE DATA
When you complete a 300WOD™ workout, the following data is persisted:
- Completion time and date
- Total reps completed
- Total training volume (kg)
- Per-exercise loads, reps and sets
- Athlete Standard / tier at completion
- Achievement type (e.g. Personal Best, First 300 Completed)
This data is used to power your Workout History, Progress tracking, 30-Minute Intelligence™ load calibration, achievement detection and the Completion Card. It is never shared publicly without your explicit choice.
7. BODY AND PROFILE INFORMATION
Your profile may include bodyweight, height, gender, date of birth, training level, available equipment and preferred training days. This information is used exclusively to personalise your workout generation, load recommendations and Adaptive Week scheduling.
Body and profile information is private. It is not shared publicly, not displayed on leaderboards, and not transmitted to third parties except as necessary for database storage (Supabase).
8. PERSONALISATION AND WORKOUT INTELLIGENCE
300WOD™ uses your workout history, performance data and profile information to generate personalised outputs including:
- 30-Minute Intelligence™ — load calibration recommendations based on your actual workout history
- Adaptive Week — weekly workout scheduling based on your training patterns
- Muscle Readiness — recovery-aware scheduling
- Exercise Load History — per-exercise progression tracking
These outputs are generated deterministically from your own data. They are private to your account and are not shared publicly. No external AI or third-party profiling service is used to generate these recommendations.
The AI Coach feature (a separate paid add-on) does transmit a subset of your training data to OpenAI to generate coaching outputs — see Section 14 for details.
9. TESTIMONIALS AND COMMUNITY SUBMISSIONS
When you choose to submit a story or testimonial, you provide explicit permission for 300WOD™ to publish the following on 300wod.com and official 300WOD™ channels:
- Your display name (as you specify it)
- Your story / comment text
- Workout result data you choose to include (Standard, time, volume)
- Photo, if you choose to include one
Publication is never automatic. Every submission goes through admin moderation before appearing publicly. You can request removal of a published testimonial at any time by contacting contact@300wod.com.
The legal basis for processing testimonial data is your consent, given at the point of submission.
10. REFERRAL AND FIRST 300 PROGRAMME
If you join The First 300 or use a referral link, 300WOD™ records your referral code, acquisition source and campaign attribution. This information is used to attribute referrals, manage the First 300 programme and understand how athletes discover 300WOD™.
Referral data is private and is not shared publicly. Acquisition attribution (source, campaign) is used for internal analytics only.
11. COMMUNICATIONS
Transactional / Service Communications
300WOD™ sends transactional and service communications via Resend. These include account confirmation, password reset, membership notifications and other service-essential messages. These are sent on the basis of contract performance and cannot be opted out of while you hold an active account.
Marketing Communications
Optional marketing communications (updates, announcements, promotional content) are sent only where you have provided consent or where legitimate interest applies. You can manage your marketing preferences in MY 300WOD → PRIVACY & DATA or by contacting contact@300wod.com.
12. COOKIES AND SIMILAR TECHNOLOGIES
300WOD™ currently uses only technically necessary browser technologies — authentication session storage (Supabase), referral attribution (sessionStorage) and hosting infrastructure cookies. No analytics, advertising or marketing tracking technologies are currently active.
See the full Cookie Policy for details.
13. PURPOSES AND LEGAL BASES
Contract Performance
Processing necessary to provide the 300WOD™ service you have signed up for — account management, workout generation, performance tracking, load calibration, membership access.
Legitimate Interest
Service security, fraud prevention, acquisition attribution, internal analytics, improving the platform. We balance these interests against your rights.
Consent
Testimonial publication, optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal Obligation
Compliance with applicable Danish and EU law, including data protection, accounting and consumer protection obligations.
14. AI COACH — OPENAI DATA PROCESSING
What AI Coach Does
300WOD AI Coach is a premium add-on feature that generates personalised training guidance by sending a subset of your 300WOD training data to an external AI API provided by OpenAI. AI Coach is only available to eligible annual members who have purchased the add-on.
AI Coach outputs are AI-generated and informational in nature. They are not medical advice. See the Fitness, Health & Nutrition Disclaimer and the AI Coach terms in the Terms of Service.
AI Provider: OpenAI
The AI Coach feature uses the OpenAI API (model: gpt-4o-mini) to generate coaching outputs. OpenAI is an external third-party service provider.
OpenAI's privacy practices and data handling are governed by OpenAI's own privacy policy and API usage terms. 300WOD™ does not control OpenAI's internal data handling beyond what is governed by the applicable API agreement.
Data Transmitted to OpenAI
Based on the actual AI Coach server implementation, the following categories of data are assembled server-side and transmitted to OpenAI when you use AI Coach:
- Recent workout results: completion times, total volume, per-exercise loads and reps (up to 10 recent sessions)
- Athlete Standard / tier at completion
- Muscle Readiness data (self-reported recovery indicators)
- Load calibration recommendations from 30-Minute Intelligence™
- Training load / residual load calculations
- Profile data relevant to training context: training level, bodyweight (if set)
The following data is NOT transmitted to OpenAI:
- Your name or email address
- Payment information or subscription details
- Account credentials or authentication tokens
- Testimonials or community submissions
- Any data unrelated to your training context
Purpose and Data Minimisation
Training data is transmitted to OpenAI solely for the purpose of generating your personalised AI coaching analysis. Only the data necessary to produce a meaningful coaching output is included. Identifying information (name, email, payment data) is excluded from all OpenAI requests.
Storage and Retention
AI Coach analyses are cached server-side in 300WOD™'s database for up to 6 hours to avoid unnecessary repeated API calls when your training context has not changed. The cache stores the generated coaching output and a hash of the training context — not the raw prompt.
Whether OpenAI retains API request data, and for how long, is governed by OpenAI's applicable API terms and privacy policy. 300WOD™ does not make representations about OpenAI's internal retention practices beyond what is stated in OpenAI's published terms.
International Data Transfer
OpenAI is a US-based service. Transmitting training data to OpenAI involves an international transfer of personal data from the EU/EEA to the United States. 300WOD™ relies on the applicable transfer mechanism under OpenAI's API terms for this transfer.
Legal Basis
The legal basis for transmitting your training data to OpenAI is contract performance — specifically, providing the AI Coach feature you have purchased as a paid add-on. AI Coach data processing only occurs when you have an active paid AI Coach entitlement and actively use the feature.
15. STRIPE — PAYMENT PROCESSING
Role of Stripe
300WOD™ uses Stripe to process subscription payments, manage recurring billing, and provide subscription management functionality (Customer Portal). Stripe is an external payment service provider.
Stripe's privacy practices and data handling are governed by Stripe's own privacy policy and terms of service. 300WOD™ does not store full payment card details — these are handled directly by Stripe's hosted checkout and payment infrastructure.
Data Transmitted to or Processed by Stripe
When you purchase or manage a subscription, the following categories of information are transmitted to or processed by Stripe:
- Payment card details (handled directly by Stripe — not stored by 300WOD™)
- Billing email address
- Subscription plan and pricing information
- A Stripe customer identifier linked to your 300WOD™ account
- Subscription status, billing dates and renewal information
- Transaction and invoice records
Stripe Customer Portal
300WOD™ provides access to Stripe's Customer Portal, which allows eligible members to manage their subscription, update payment methods and cancel renewals. When you use the Customer Portal, you interact directly with Stripe's hosted interface.
Stripe's Data Processing Role
Stripe's legal role in relation to payment data can depend on the specific processing activity and applicable Stripe terms. For payment processing activities, Stripe may act as an independent controller for certain purposes (such as fraud prevention and financial compliance) in addition to processing data on behalf of 300WOD™ for subscription management. 300WOD™ does not make a definitive legal characterisation of Stripe's role beyond what is supported by the applicable Stripe agreement.
International Data Transfer
Stripe is a US-based service. Payment processing involves international transfers of personal data. Stripe maintains its own transfer mechanisms and compliance framework for international data transfers.
16. OTHER SERVICE PROVIDERS
Supabase
Role: Database, authentication and backend infrastructure
Data transmitted: All member data including account, profile, workout history, memberships, testimonials
Location: Primary storage: West EU (Ireland). Supabase infrastructure may involve subprocessors or operational transfers outside the EU/EEA — EU primary hosting does not guarantee that no international transfers can ever occur.
DPA status: Supabase provides a DPA — review and execution recommended
Resend
Role: Transactional and service email delivery
Data transmitted: Email address, name (where provided), email content
Location: US-based infrastructure. Personal data is transferred to the US for email delivery.
DPA status: Resend provides a DPA — review and execution recommended
Rocket (builtwithrocket.new)
Role: Website hosting and deployment
Data transmitted: Web traffic, platform-level infrastructure data
Location: Underlying infrastructure provider and data center region — verify with Rocket platform.
DPA status: Obtain DPA or data processing terms from Rocket platform
No advertising networks, analytics platforms (such as Google Analytics), social media tracking pixels or marketing automation services are currently integrated.
17. INTERNATIONAL TRANSFERS
The primary 300WOD™ database and backend infrastructure (Supabase) is hosted in West EU (Ireland). However, Supabase's infrastructure may involve subprocessors or operational transfers outside the EU/EEA — EU primary hosting does not mean that no international transfers can ever occur.
Email delivery (Resend) is processed by a US-based service. Personal data (email address, name) is transferred to the US for this purpose.
Where personal data is transferred outside the European Economic Area, 300WOD™ relies on appropriate transfer mechanisms as required by GDPR, including Standard Contractual Clauses where applicable. Specific transfer mechanism documentation is subject to DPA execution with each processor — see Section 14.
18. RETENTION
300WOD™ retains personal data according to the following framework:
19. SECURITY
300WOD™ implements technical and organisational measures to protect personal data, including:
- Row-Level Security (RLS) on all member data tables — members can only access their own data
- Supabase-managed authentication with secure session handling
- Passwords stored as secure hashes — never in plaintext
- HTTPS for all data transmission
- Service role keys restricted to server-side API routes only
No security system is infallible. If you become aware of a security concern, please contact contact@300wod.com.
20. YOUR RIGHTS
Under applicable data protection law (including GDPR where it applies), you have the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Correction
Request correction of inaccurate or incomplete data.
Deletion
Request deletion of your personal data, subject to legal retention obligations.
Restriction
Request that we restrict processing of your data in certain circumstances.
Objection
Object to processing based on legitimate interests.
Data Portability
Request your data in a structured, machine-readable format where technically applicable.
Withdrawal of Consent
Withdraw consent at any time where consent is the legal basis (e.g. testimonial publication, marketing communications). Withdrawal does not affect the lawfulness of prior processing.
To exercise any of these rights, use the self-service tools in MY 300WOD → PRIVACY & DATA or contact:
contact@300wod.com21. COMPLAINTS
If you have a concern about how 300WOD™ processes your personal data, please contact us first at contact@300wod.com.
You also have the right to lodge a complaint with the Danish data protection supervisory authority, Datatilsynet (datatilsynet.dk), or the supervisory authority in your country of residence within the EU/EEA.
22. AGE REQUIREMENTS
300WOD™ is intended for adults. The service is not directed at children under 16. If you believe a child under 16 has provided personal data without appropriate parental consent, please contact contact@300wod.com.
23. CHANGES TO THIS POLICY
This Privacy Policy may be updated as the 300WOD™ platform develops. Material changes will be communicated via the platform or by email. The date at the top of this page indicates when it was last updated. Continued use of the service after an update constitutes acknowledgement of the revised policy.