What ExerciseBank stores, why, where, and for how long. ExerciseBank is a product of TotalCoaching, Montréal, Québec, Canada.
When you sign up we store your email address, your company name if you give one, and your password as a salted scrypt hash; we cannot read it. API keys are stored as SHA-256 hashes and shown to you once. Logging in sets one cookie, eb_session, which lasts 30 days, is not readable by scripts, and is used only to recognise your session. Changing your password ends your other sessions.
Messages sent through the help form are stored with the email address you give and forwarded to our inbox so that we can answer.
When a link to this site carries campaign tags (utm_…, or our own src), as our ads do, your browser keeps those tags, the page you landed on and the date in its local storage (eb_src, not a cookie) for 30 days. Without tags it keeps only the name of the website that sent you, such as google.com. If you sign up, the signup form sends this to us once, we store it with your account, and your browser deletes its copy; if you don't, it never leaves your browser. We use it to count which ads and pages bring the people who sign up and pay. This record is ours: we do not send it to Google, Meta or any other ad network, and we ignore the click identifiers they add to links.
Every page except our own admin page loads Google's tag (gtag.js, account AW-1056419766). It sends Google the address of the page, the site that sent you and technical details of your browser, which Google handles under its own privacy policy. Outside the EEA, the UK and Switzerland it may set Google advertising cookies (such as _gcl_au) so Google can tell us whether an ad click led to a visit or a signup. When you sign up it tells Google that a signup happened, never your email or anything you typed. In those regions it stores no cookies and does not use your visit for ad personalisation. You can block it with any content blocker without losing anything on this site.
For each API key we count requests per day and per month, signed media links issued, the distinct exercises opened per day, and anomaly notes when traffic looks like bulk copying. This is how plans are measured and how the library is protected; you see the same numbers in your dashboard.
If you connect ExerciseBank to Claude, you sign in on our site and allow the connection. We store a record of it: your account, the app that asked (for example Claude), the address it returns to, when it was made and last used, and hashes of its tokens, never the tokens themselves. Each time Claude uses the connector, it sends us only what the tool needs: search filters such as muscles, equipment or joints to avoid, and exercise ids. We use them to answer and count the call on your account, like an API request; we do not store the search terms or filters. We never receive your conversation, your Claude memory, your files or anything else from Claude. The videos the connector shows are signed links for you alone, counted as described above. You can end the connection at any time by removing the connector in Claude or by clicking Disconnect next to the "Claude" key in your dashboard.
To issue media links the API asks for an end-user id in the X-End-User header. It is an opaque string of your choosing; we recommend a hash of your own user id and ask you not to send names, emails or anything else that identifies a person. For each calendar month we keep the list of distinct ids your account sent, whether each was marked a coach, and the last day it was seen. That list is what "monthly end users" and coach seats are counted from. We do not receive your users' names, emails, devices or IP addresses: your server calls us, not their phones. When a phone or browser plays a clip, the content delivery network that serves it sees that device's IP address for the length of the request, as any web server does.
Under privacy laws such as the GDPR and Québec's Law 25, you are responsible for your users' data and we act on your instructions for the little of it that reaches us. If you need a data processing agreement, ask through the help page.
Reports sent through POST /v1/feedback are stored with your account, the end-user id if you included one, the reporter details you chose to add (role, locale, app version, your ticket reference) and a copy of the exercise as it was when you reported it. We use them to correct the library and to answer you.
Card payments are handled by Stripe. Card numbers never reach our servers. We store your Stripe customer and subscription ids, your plan and your subscription status. Depending on the purchase, Stripe may act as the seller of record and handle tax and invoicing; its own privacy policy applies to the payment.
| Provider | What for | Where |
|---|---|---|
| Supabase | The database: accounts, key hashes, usage counts, feedback | Canada (Montréal region) |
| Vercel | Runs the site and the API; keeps short-lived request logs, which include the caller's IP address | Canada (Montréal region) for the API; pages are cached worldwide |
| Stripe | Payments, invoices, tax | United States and the regions Stripe operates in |
| Twilio SendGrid | Account and support email | United States |
We tell paid accounts by email before adding a provider that handles their data.
You can see most of what we hold in your dashboard and through the API. To get a copy of everything, to correct it, or to have it deleted, write through the help page from the account's email address; we answer within 30 days. You may also complain to your data protection authority; in Québec that is the Commission d'accès à l'information.
When this page changes in a way that matters, paid accounts are told by email and the date below changes.
Last updated 2026-10-14. Questions: help.