The NextSet (“The NextSet”, “we”, “us”) is a real-time gym partner matching service. This policy explains what personal information we collect, why we collect it, and the choices you have. It's written to comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) and the Information Privacy Principles in the New Zealand Privacy Act 2020.

• Account info: email, password (hashed by Supabase), display name, gender, age. If you sign up under 18 we also store the date you turn 18, so the app can move you to the adult board on the day; we never store your birthdate itself.
• Activity: gym check-ins, session preferences (focus, intensity, role), arrival times, workout logs (exercise, sets, reps, weights), badges and milestones.
• Connections: requests sent and received, accepted matches, trusted-buddy relationships, blocks, reports you submit.
• Messages: text, voice notes, photos and short videos sent in 1-to-1 or buddy group chats.
• Device + technical: push-notification subscription tokens (if you opt in), browser type, IP address (held briefly for abuse-prevention).

We don't collect payment-card numbers or biometric identifiers. The optional Form Snapshot tool runs entirely on your device — pose data is not transmitted.

Future identity verification:at full public release we plan to collect a government-issued photo ID at signup (passport, driver licence) to verify each user's real identity and protect the community. ID images will be checked through a regulated verification provider, the result (verified yes/no + age confirmation) stored against your account, and the original ID image deleted once verification completes. We'll update this policy and notify you in-app before that change goes live.

• To run the core service (match you with nearby lifters, deliver messages, log your workouts).
• To keep you and other users safe (block lists, reports, banning).
• To send you operational notifications (incoming match requests, accepted matches).
• To improve the product (aggregated, de-identified analytics).

We do not sell your personal information. We do not run third-party advertising trackers.

To run the service we use these data processors:

• Supabase (database, auth, storage) — hosted in Singapore (ap-southeast-1).
• Vercel (web hosting, edge functions) — globally distributed.
• Resend (transactional email) — only used for sign-up confirmation, password reset, and admin reports.
• Google Fonts (delivery of typefaces) — only loads font files, no tracking.
• WorkoutX (exercise reference content) — we send exercise IDs only; no personal data.
• Anthropic(AI program generation) — when you use the AI Program Builder, your inputs (training goal, days per week, weeks, equipment, experience, optional constraints text) are sent to Anthropic's Claude API to generate a program. Anthropic processes the request under a zero data-retention agreement and does not use your inputs to train their models.
• Replicate(AI avatar generation) — when you create an avatar, your raw selfie is sent to Replicate's image-transformation API to produce your stylised avatar. Replicate processes the image only to complete your request. The stylised result is stored on our servers; the raw selfie is also retained on our servers per §5B of our Terms of Service for identity verification and admin/safety review.
• Firebase Cloud Messaging / Apple Push Notification Service(native push notifications) — when you receive a chat / match notification on your device, a short payload is sent through Google's or Apple's push infrastructure. Notification body text is scrubbed of message content for privacy.
• Sentry (crash reporting) — application errors and short session replays leading up to a crash are transmitted to Sentry so we can diagnose and fix issues. Password and email input fields are masked in replays.

All third-party processors listed above act as service providers on our behalf under written agreements that limit their use of your data to the purposes described here. They do not use your data for their own advertising, resell it, or share it with other parties.

Other The NextSet users will see your display name, avatar, gender, age, and live session details when you check in at a gym — that's how matching works. We never share your email, password, or workout history with other users.

If you check in at a gym that subscribes to The NextSet, that gym's owner can see, for their gym only:

• the display name you chose in the app;
• how many days you trained there in a given month;
• how many times you checked in, paired up with a partner, and logged a workout there.

This is attendance information about their own gym, and it is what lets a gym run things like a monthly training competition. They cannot see what you lifted, the contents of any workout, who you trained with, your age, your email, or anything you did at any other gym. Gyms without a subscription see only anonymous totals with no names attached.

If you would rather your gym did not see your name against your attendance, contact support@thenextset.app and we will exclude you, or you can stop checking in at that gym in the app.

Personal information is stored on Supabase's ap-southeast-1 (Singapore) infrastructure. Some support tools (e.g. Vercel logs) may transit through the United States. Cross-border transfers are made under standard contractual clauses; we take reasonable steps to ensure overseas recipients comply with the APPs.

• Account data: until you delete your account.
• Session data + workout logs: until you delete your account.
• Selfies / video selfies marked “view-once”: deleted from the recipient's view shortly after they open it.
• Reports: retained for up to 24 months for safety review, then deleted unless tied to an active investigation.
• Server logs: typically 30 days.

You can:

• Access your data — open Settings → “Export my data” for a JSON download.
• Correct profile fields you can edit (display name, avatar). Gender and age are locked once set; email support@thenextset.app if you need them changed.
• Delete your account — Settings → “Delete my account”. This permanently removes your profile, sessions, messages, workout logs, and trusted-buddy links. Some derived safety records (e.g. ban history) may be retained as required by law.
• Withdraw consent for push notifications at any time via your browser/OS settings.

You must be 16 or olderto create an account. Members aged 16-17 are kept on a separate board: adults never see them, and they never see adults, anywhere in the app. We don't knowingly collect personal information from anyone under 16. If you believe someone under 16 has registered, contact support@thenextset.appand we'll remove the account.

We use TLS in transit, hashed passwords, row-level security on the database, and a scoped service role for server-side operations. No system is completely secure — please choose a strong, unique password and don't share screenshots that contain personal information.

If you believe we've mishandled your information, contact us first at support@thenextset.app. If you're not satisfied, you can complain to:

• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• New Zealand: Office of the Privacy Commissioner — privacy.org.nz

We'll update the “Last updated” date at the top whenever this policy changes. For material changes, we'll show an in-app notice the next time you sign in.