PRIVACY POLICY
This Privacy Policy explains how 300WOD™ collects, uses, stores and protects personal information across the 300WOD member platform — including authentication, memberships, workout history, body profile, performance data, Muscle Readiness, Adaptive Week, 30-Minute Intelligence™, load calibration, referrals, First 300, testimonial submissions, AI Coach (OpenAI processing), Stripe payment processing and all other member features.
Last updated: October 2026
1. WHO WE ARE
300WOD™ is a fitness and training platform built around the principle of 6 exercises × 50 reps = 300 — one Standard, every level. The platform provides personalised workout generation, load calibration, performance tracking, Adaptive Week scheduling, Muscle Readiness monitoring, community features and the Founder's Diet™ nutrition philosophy.
2. DATA CONTROLLER
Current Controller
The data controller for personal information processed through 300WOD™ is:
300WOD™
Denmark
CVR No.: 46758447
3. CONTACT
Privacy & General Enquiries
contact@300wod.com4. INFORMATION WE COLLECT
Account & Authentication
- Email address — Account creation, authentication, service communications
- Display name — Personalisation, community display
- Password (hashed) — Authentication
- Auth session tokens — Session management
Profile & Body Information
- First name, last name — Personalisation
- Gender — Workout personalisation
- Date of birth — Age-appropriate recommendations
- Height (cm) — Body profile / personalisation
- Bodyweight (kg) — Load calibration, volume calculation
- Country — Localisation, geographic analytics
- Training level — Adaptive workout generation
- Available equipment — Exercise selection
- Preferred training days — Adaptive Week scheduling
Workout & Performance Data
- Workout results (time, reps, volume) — History, progress tracking, 30-Minute Intelligence
- Exercise loads (kg) — Load calibration, Exercise Load History
- Athlete Standard / tier — Standard classification, leaderboard
- Achievements / PRs — Completion card, motivation
- Load calibration recommendations — Personalised load progression
- Saved workouts — Workout library
Adaptive Intelligence
- Adaptive Week plan — Weekly workout scheduling
- Muscle Readiness data — Recovery-aware scheduling
Membership & Entitlement
- Membership status / source — Access control, feature gating
- Founder / First 300 status — Entitlement, badge display
- Complimentary access records — Access control
- Stripe customer ID — Link Stripe subscription to 300WOD account
- Stripe subscription ID / status — Subscription state, access control
- AI Coach entitlement — AI Coach access control
Testimonials & Community
- Story / testimonial text — Community, public website stories
- Display name (testimonial) — Attribution on published story
- Workout metrics (shared) — Community story context
- Photo (if submitted) — Community story
Referral & Acquisition
- Referral code — Referral attribution, rewards
- Acquisition source / campaign — Marketing attribution
Communications
- Email communications — Account, membership, service notices
- Marketing preferences — Optional marketing communications
5. ACCOUNT AND MEMBERSHIP DATA
When you create a 300WOD™ account, we process your email address, chosen display name and password (stored as a secure hash managed by Supabase). Your account is used to authenticate you, provide access to your membership tier, and personalise your training experience.
Membership status, entitlement tier (including Founder, First 300, Paid Member and Complimentary Access), and access history are stored to control which features you can access and to fulfil our service obligations to you.
6. WORKOUT AND PERFORMANCE DATA
When you complete a 300WOD™ workout, the following data is persisted:
- Completion time and date
- Total reps completed
- Total training volume (kg)
- Per-exercise loads, reps and sets
- Athlete Standard / tier at completion
- Achievement type (e.g. Personal Best, First 300 Completed)
This data is used to power your Workout History, Progress tracking, 30-Minute Intelligence™ load calibration, achievement detection and the Completion Card. It is never shared publicly without your explicit choice.
7. BODY AND PROFILE INFORMATION
Your profile may include bodyweight, height, gender, date of birth, training level, available equipment and preferred training days. This information is used exclusively to personalise your workout generation, load recommendations and Adaptive Week scheduling.
Body and profile information is private. It is not shared publicly, not displayed on leaderboards, and not transmitted to third parties except as necessary for database storage (Supabase).
8. PERSONALISATION AND WORKOUT INTELLIGENCE
300WOD™ uses your workout history, performance data and profile information to generate personalised outputs including:
- 30-Minute Intelligence™ — load calibration recommendations based on your actual workout history
- Adaptive Week — weekly workout scheduling based on your training patterns
- Muscle Readiness — recovery-aware scheduling
- Exercise Load History — per-exercise progression tracking
These outputs are generated deterministically from your own data. They are private to your account and are not shared publicly. No external AI or third-party profiling service is used to generate these recommendations.
The AI Coach feature (a separate paid add-on) does transmit a subset of your training data to OpenAI to generate coaching outputs — see Section 14 for details.
9. TESTIMONIALS AND COMMUNITY SUBMISSIONS
When you choose to submit a story or testimonial, you provide explicit permission for 300WOD™ to publish the following on 300wod.com and official 300WOD™ channels:
- Your display name (as you specify it)
- Your story / comment text
- Workout result data you choose to include (Standard, time, volume)
- Photo, if you choose to include one
Publication is never automatic. Every submission goes through admin moderation before appearing publicly. You can request removal of a published testimonial at any time by contacting contact@300wod.com.
The legal basis for processing testimonial data is your consent, given at the point of submission.
10. REFERRAL AND FIRST 300 PROGRAMME
If you join The First 300 or use a referral link, 300WOD™ records your referral code, acquisition source and campaign attribution. This information is used to attribute referrals, manage the First 300 programme and understand how athletes discover 300WOD™.
Referral data is private and is not shared publicly. Acquisition attribution (source, campaign) is used for internal analytics only.
11. COMMUNICATIONS
Transactional / Service Communications
300WOD™ sends transactional and service communications via Resend. These include account confirmation, password reset, membership notifications and other service-essential messages. These are sent on the basis of contract performance and cannot be opted out of while you hold an active account.
Marketing Communications
Optional marketing communications (updates, announcements, promotional content) are sent only where you have provided consent or where legitimate interest applies. You can manage your marketing preferences in MY 300WOD → PRIVACY & DATA or by contacting contact@300wod.com.
12. COOKIES AND SIMILAR TECHNOLOGIES
300WOD™ uses technically necessary browser technologies — authentication session storage (Supabase), referral attribution (sessionStorage), your stored cookie choice and hosting infrastructure cookies. These do not require consent.
With your consent only, we use Google Analytics 4 (property G-8SGWMN88F3) to measure page views. Purpose: understanding and improving use of the website. Data: a pseudonymous identifier in the _ga cookies, page path and title, timestamp and technical data collected automatically by Google (browser, device, approximate location from IP address). We do not send your name, e-mail, health, training or payment data, and we restrict page addresses sent to Google. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can refuse or withdraw at any time via “Cookie Settings” in the footer. Statistics is off by default; nothing is sent to Google before you accept or after you reject or withdraw. Google acts as our processor and may transfer data outside the EU/EEA. We do not send server-side purchase events to Google Analytics, and no advertising or marketing tracking technologies are active.
This website cookie banner and the Google Analytics 4 setup described above apply to the 300WOD website only. They are not the consent mechanism for the 300WOD mobile app.
See the full Cookie Policy for details.
13. PURPOSES AND LEGAL BASES
Contract Performance
Processing necessary to provide the 300WOD™ service you have signed up for — account management, workout generation, performance tracking, load calibration, membership access.
Legitimate Interest
Service security, fraud prevention, acquisition attribution, internal analytics, improving the platform. We balance these interests against your rights.
Consent
Testimonial publication, optional marketing communications, and optional Firebase Analytics in the Android app (see the Android Optional Firebase Analytics section below). You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal Obligation
Compliance with applicable Danish and EU law, including data protection, accounting and consumer protection obligations.
14. AI COACH — OPENAI DATA PROCESSING
What AI Coach Does
300WOD AI Coach is a premium add-on feature that generates personalised training guidance by sending a subset of your 300WOD training data to an external AI API provided by OpenAI. AI Coach is only available to eligible annual members who have purchased the add-on.
AI Coach outputs are AI-generated and informational in nature. They are not medical advice. See the Fitness, Health & Nutrition Disclaimer and the AI Coach terms in the Terms of Service.
AI Provider: OpenAI
The AI Coach feature uses the OpenAI API (model: gpt-4o-mini) to generate coaching outputs. OpenAI is an external third-party service provider.
OpenAI's privacy practices and data handling are governed by OpenAI's own privacy policy and API usage terms. 300WOD™ does not control OpenAI's internal data handling beyond what is governed by the applicable API agreement.
Data Transmitted to OpenAI
Based on the actual AI Coach server implementation, the following categories of data are assembled server-side and transmitted to OpenAI when you use AI Coach:
- Recent workout results: completion times, total volume, per-exercise loads and reps (up to 10 recent sessions)
- Athlete Standard / tier at completion
- Muscle Readiness data (self-reported recovery indicators)
- Load calibration recommendations from 30-Minute Intelligence™
- Training load / residual load calculations
- Profile data relevant to training context: training level, bodyweight (if set)
The following data is NOT transmitted to OpenAI:
- Your name or email address
- Payment information or subscription details
- Account credentials or authentication tokens
- Testimonials or community submissions
- Any data unrelated to your training context
Purpose and Data Minimisation
Training data is transmitted to OpenAI solely for the purpose of generating your personalised AI coaching analysis. Only the data necessary to produce a meaningful coaching output is included. Identifying information (name, email, payment data) is excluded from all OpenAI requests.
Storage and Retention
AI Coach analyses are cached server-side in 300WOD™'s database for up to 6 hours to avoid unnecessary repeated API calls when your training context has not changed. The cache stores the generated coaching output and a hash of the training context — not the raw prompt.
Whether OpenAI retains API request data, and for how long, is governed by OpenAI's applicable API terms and privacy policy. 300WOD™ does not make representations about OpenAI's internal retention practices beyond what is stated in OpenAI's published terms.
International Data Transfer
OpenAI is a US-based service. Transmitting training data to OpenAI involves an international transfer of personal data from the EU/EEA to the United States. 300WOD™ relies on the applicable transfer mechanism under OpenAI's API terms for this transfer.
Legal Basis
The legal basis for transmitting your training data to OpenAI is contract performance — specifically, providing the AI Coach feature you have purchased as a paid add-on. AI Coach data processing only occurs when you have an active paid AI Coach entitlement and actively use the feature.
15. STRIPE — PAYMENT PROCESSING
Role of Stripe
300WOD™ uses Stripe to process subscription payments, manage recurring billing, and provide subscription management functionality (Customer Portal). Stripe is an external payment service provider.
Stripe's privacy practices and data handling are governed by Stripe's own privacy policy and terms of service. 300WOD™ does not store full payment card details — these are handled directly by Stripe's hosted checkout and payment infrastructure.
Data Transmitted to or Processed by Stripe
When you purchase or manage a subscription, the following categories of information are transmitted to or processed by Stripe:
- Payment card details (handled directly by Stripe — not stored by 300WOD™)
- Billing email address
- Subscription plan and pricing information
- A Stripe customer identifier linked to your 300WOD™ account
- Subscription status, billing dates and renewal information
- Transaction and invoice records
Stripe Customer Portal
300WOD™ provides access to Stripe's Customer Portal, which allows eligible members to manage their subscription, update payment methods and cancel renewals. When you use the Customer Portal, you interact directly with Stripe's hosted interface.
Stripe's Data Processing Role
Stripe's legal role in relation to payment data can depend on the specific processing activity and applicable Stripe terms. For payment processing activities, Stripe may act as an independent controller for certain purposes (such as fraud prevention and financial compliance) in addition to processing data on behalf of 300WOD™ for subscription management. 300WOD™ does not make a definitive legal characterisation of Stripe's role beyond what is supported by the applicable Stripe agreement.
International Data Transfer
Stripe is a US-based service. Payment processing involves international transfers of personal data. Stripe maintains its own transfer mechanisms and compliance framework for international data transfers.
16. OTHER SERVICE PROVIDERS
Supabase
Role: Database, authentication, backend infrastructure and data processor
Data transmitted: All member data including account credentials (email, hashed password, session tokens), profile, workout history, memberships, testimonials and all other data stored in the 300WOD platform database. Supabase acts as a data processor on behalf of 300WOD™ for the storage and retrieval of this data.
Location: Primary storage: West EU (Ireland). Supabase infrastructure may involve subprocessors or operational transfers outside the EU/EEA — EU primary hosting does not guarantee that no international transfers can ever occur.
DPA status: Supabase provides a Data Processing Agreement (DPA) — review and execution recommended for GDPR compliance
Resend
Role: Transactional and service email delivery
Data transmitted: Email address, name (where provided), email content
Location: US-based infrastructure. Personal data is transferred to the US for email delivery.
DPA status: Resend provides a DPA — review and execution recommended
Rocket (builtwithrocket.new)
Role: Website hosting and deployment
Data transmitted: Web traffic, platform-level infrastructure data
Location: Underlying infrastructure provider and data center region — verify with Rocket platform.
DPA status: Obtain DPA or data processing terms from Rocket platform
Google Analytics 4 (Google) is used only if you accept statistics in the cookie banner or Cookie Settings; see section 12 and the Cookie Policy. Google may process analytics data outside the EU/EEA. No advertising networks, social media tracking pixels or marketing automation services are integrated on the website. Mobile-app service providers (Google Play, Firebase Cloud Messaging, optional Firebase Analytics on Android, and Android Health Connect) are described in the Android sections below.
Firebase Analytics (Google) — Android app, optional
Role: Optional usage analytics in the Android app, only after your active opt-in
Details: See ANDROID — OPTIONAL FIREBASE ANALYTICS. Separate from Firebase Cloud Messaging and from the website's Google Analytics 4 cookie banner.
17. INTERNATIONAL TRANSFERS
The primary 300WOD™ database and backend infrastructure (Supabase) is hosted in West EU (Ireland). However, Supabase's infrastructure may involve subprocessors or operational transfers outside the EU/EEA — EU primary hosting does not mean that no international transfers can ever occur.
Email delivery (Resend) is processed by a US-based service. Personal data (email address, name) is transferred to the US for this purpose.
Where personal data is transferred outside the European Economic Area, 300WOD™ relies on appropriate transfer mechanisms as required by GDPR, including Standard Contractual Clauses where applicable. Specific transfer mechanism documentation is subject to DPA execution with each processor — see Section 14.
18. RETENTION
300WOD™ retains personal data according to the following framework:
19. SECURITY
300WOD™ implements technical and organisational measures to protect personal data, including:
- Row-Level Security (RLS) on all member data tables — members can only access their own data
- Supabase-managed authentication with secure session handling
- Passwords stored as secure hashes — never in plaintext
- HTTPS for all data transmission
- Service role keys restricted to server-side API routes only
No security system is infallible. If you become aware of a security concern, please contact contact@300wod.com.
20. YOUR RIGHTS
Under applicable data protection law (including GDPR where it applies), you have the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Correction
Request correction of inaccurate or incomplete data.
Deletion
Request deletion of your personal data, subject to legal retention obligations.
Restriction
Request that we restrict processing of your data in certain circumstances.
Objection
Object to processing based on legitimate interests.
Data Portability
Request your data in a structured, machine-readable format where technically applicable.
Withdrawal of Consent
Withdraw consent at any time where consent is the legal basis (e.g. testimonial publication, marketing communications). Withdrawal does not affect the lawfulness of prior processing.
To exercise any of these rights, use the self-service tools in MY 300WOD → PRIVACY & DATA or contact:
contact@300wod.comFor account deletion and deletion of specific data, see How to delete your 300WOD account or data.
21. COMPLAINTS
If you have a concern about how 300WOD™ processes your personal data, please contact us first at contact@300wod.com.
You also have the right to lodge a complaint with the Danish data protection supervisory authority, Datatilsynet (datatilsynet.dk), or the supervisory authority in your country of residence within the EU/EEA.
22. AGE REQUIREMENTS
300WOD™ is intended for adults. The service is not directed at children under 16. If you believe a child under 16 has provided personal data without appropriate parental consent, please contact contact@300wod.com.
23. CHANGES TO THIS POLICY
This Privacy Policy may be updated as the 300WOD™ platform develops. Material changes will be communicated via the platform or by email. The date at the top of this page indicates when it was last updated. Continued use of the service after an update constitutes acknowledgement of the revised policy.
APPLE WATCH, APPLE HEALTH AND HEALTHKIT
300WOD’s Apple Watch workout feature uses Apple’s HealthKit framework, subject to your permission, to access heart-rate measurements during your workout. Heart-rate information is used to display your pulse during training and provide fitness-related information about your session.
You control access through Apple’s health and privacy permission settings and can review or revoke permissions at any time. Revoking access prevents further access to the affected data; it does not by itself delete information previously saved.
Heart-rate measurements and training estimates are provided for fitness information, not medical diagnosis or treatment. The display of Muscle Readiness should not be interpreted as a measurement of sleep, resting heart rate or heart-rate variability.
For questions about health-data processing, or to request deletion of personal information held by 300WOD, contact contact@300wod.com.
ANDROID — HEALTH CONNECT
What the 300WOD Android app reads
The 300WOD Android app can read two types of data from Android Health Connect, and only if you choose to grant each permission:
- Heart rate (HEART_RATE)
- Active calories burned (ACTIVE_ENERGY_BURNED)
The permissions are optional and granular. You can grant one, both or neither, and the rest of the app works without them.
Purpose
Heart rate and active calories are used to show average and maximum heart rate and active calories for your completed 300WOD workouts in History and Progress.
The measurements must first be made available in Health Connect by your own wearable or health app. 300WOD does not have a direct integration with Fitbit, Garmin, WHOOP or Pixel Watch in this feature; it only reads what is available in Health Connect.
What is stored and where
The app reads measurements from the time period of each completed workout and stores a summary (such as average and maximum heart rate and active calories) privately on your 300WOD account in Supabase.
The app does not read sleep, heart-rate variability (HRV) or resting heart rate from Health Connect. Health Connect measurements do not change your Muscle Readiness.
What we do not do
- We do not write data to Health Connect.
- We do not sell health data.
- We do not share heart rate or calories on public leaderboards.
Heart-rate and calorie figures are provided for fitness information, not medical diagnosis or treatment.
Opting out and revoking permission
You can decline the permissions when asked, and you can review or revoke them at any time in Android's Health Connect settings. Revoking a permission stops the app from reading further data of that type.
Revoking the permission does not by itself delete summaries that have already been saved to your 300WOD account. To have those summaries deleted, request deletion as described in How to delete your 300WOD account or data.
ANDROID — NOTIFICATIONS (FIREBASE CLOUD MESSAGING)
The 300WOD mobile app uses Firebase Cloud Messaging (FCM), a Google service, to deliver app and Challenge notifications. To do this, the FCM SDK uses an installation identifier and a push token, together with technical information necessary to deliver messages. The push token is associated with your 300WOD account so that notifications can be sent to your device.
Notifications are controlled by Android's system notification permission and settings. You can turn them off at any time in your device settings.
Firebase Cloud Messaging is a separate service from Firebase Analytics. Turning Analytics on or off does not turn notification delivery on or off, and does not by itself stop all Firebase-related processing.
ANDROID — OPTIONAL FIREBASE ANALYTICS
Purpose and choice
The 300WOD Android app can use Firebase Analytics, a Google service, to understand and improve how the Android app is used. Firebase Analytics is optional. It is only activated if you actively opt in under Profile > Privacy & Data in the app. You can decline or withdraw this choice at any time without losing ordinary app functionality.
Your choice is recorded on your 300WOD account in Supabase. This applies to the Android app; it does not describe any change to the published iOS app.
What may be collected if you opt in
Analytics data can include pseudonymous app or installation identifiers, session and usage information, technical device information, automatically recorded purchase events, and approximate location derived from your IP address. This is not GPS tracking. Because identifiers are used, this data is pseudonymous, not anonymous.
The Android configuration declines ad personalisation, advertising storage and ad user data, and disables collection of the advertising ID. 300WOD does not add your 300WOD account ID or custom health or workout events to Analytics.
Withdrawing and previous data
If you withdraw, further Analytics collection stops and local Analytics data on your device is reset. This does not mean that data already transferred is automatically deleted at Google. For questions about previously collected data, see How to delete your 300WOD account or data.
Firebase Cloud Messaging is separate (see the notifications section above): declining Analytics does not by itself stop notifications or all Firebase processing.
The website cookie banner and Google Analytics 4 setup (section 12) apply to the 300WOD website only. They do not control your consent for Analytics in the mobile app.
ANDROID — GOOGLE PLAY SUBSCRIPTIONS
Google Play is the provider of in-app subscriptions on Android. Google processes the payment itself. 300WOD does not receive your full payment-card details from Google Play.
300WOD handles the subscription or product identifier, verification data from Google Play and your membership status, so that the purchase can be verified and linked to the 300WOD account you are signed in with.
Google Play subscriptions are separate from Apple App Store subscriptions and from web subscriptions paid through Stripe (see section 15). Each is billed and managed by its own provider. No new prices or terms are introduced by this section.
HOW TO DELETE YOUR 300WOD ACCOUNT OR DATA
300WOD — account and data deletion
This section applies to the 300WOD app (iOS and Android) and the 300WOD website. You can request deletion of your 300WOD account and associated data in either of two ways:
- In the app: open Profile > Privacy & Data and submit an account deletion request.
- Without installing the app: send an e-mail from the e-mail address registered on your account to contact@300wod.com with the subject “Delete my 300WOD account”.
Deleting specific data without deleting your account
You can also ask us to delete specific data without closing your account, for example heart-rate and calorie summaries saved from Health Connect. Write to contact@300wod.com from your registered e-mail address, state which data you want deleted, and use a subject such as “Delete specific 300WOD data”.
Verifying that it is you
We confirm your identity by checking that the request comes from the e-mail address registered on the account, and may ask you to confirm details that only the account holder would know.
We will never ask for your password. Do not send your password, payment-card details or a Google Play purchase token to us.
What is covered, process and timing
An account deletion request covers the personal data connected to your 300WOD account, such as profile and body information, workout history and performance data, saved workouts, Adaptive Week and Muscle Readiness data, heart-rate and calorie summaries, notification tokens and your membership record, subject to the exceptions below. Retention periods for different data categories are set out in section 18.
Deletion requests are reviewed and processed by the 300WOD team; the process is currently handled by us, not fully automated. When you submit a request from the mobile app, the app states that it will be processed within 30 days. We will contact you at your registered e-mail address when the request has been handled or if we need more information.
Published testimonials you have consented to may be anonymised rather than deleted, and you can ask for removal of a published testimonial at any time.
Data we may have to keep
Payment and accounting records are retained separately as required by applicable Danish accounting and tax rules and are not removed by ordinary app-data deletion. Some data may also be kept where necessary to meet other legal obligations, to prevent fraud and abuse, or to establish or defend a legal claim. We only state specific retention periods where they are set out in section 18.
Deleting your account does not cancel a store subscription
Deleting your 300WOD account does not necessarily cancel a subscription bought through Apple or Google Play. Cancel it with the provider that bills you:
- Google Play: manage or cancel in Google Play at https://play.google.com/store/account/subscriptions
- Apple App Store: manage or cancel in Settings > Apple ID > Subscriptions, or at https://apps.apple.com/account/subscriptions
- Web (Stripe): manage in the billing portal available from your 300WOD membership page