Privacy policy

Last updated: 22 October 2026

Sergeant Fitness is operated by Alderstrom Limited ("we", "us"), a company registered in the United Kingdom. This policy explains what the Sergeant Fitness app and the website at sergeant.fitness keep about you, why, and how to have it deleted. If you have a question, email support@alderstrom.com.

The short version

We don't ask for your email address, phone number or surname.
What you record (workouts, weigh-ins, steps and your mission) is kept on your phone and on our server, so it can sync to the website and your other devices.
No adverts, no tracking, no analytics, and we never sell or share your data.
You can delete your account and everything in it from the app at any time.

What we keep

Your account

The username you choose and your first name, which Sarge uses to talk to you.
Your password, stored only as a salted hash. We can't read it.
Your time zone, so reminders and the weekly plan fall on the right days.
When the account was created.

What you record

Workouts: the date, the programme week and stage, which exercises you finished or skipped, how long you were active, how hard it felt, and any notes you add.
Weigh-ins: your weight on each date, any note, and your target weight if you set one.
Steps: your daily step count and step goal.
Your mission: the aims you pick (for example losing weight or quitting smoking), your reason and what's at stake in your own words, your target and quit dates, and your daily habit check-ins.
Settings: weight units, rest days, weigh-in day, usual workout time, sounds and pep-talk choices.

Weight, activity and habits such as smoking count as health information. We use it only to run your plan, show your progress and have Sarge comment on it. It isn't used for advertising, profiling or anything else, and nobody else sees it.

Steps from your phone

On Android you can let the app read your daily step count from Health Connect. It reads step totals only, never writes to Health Connect, and only after you allow it. You can withdraw the permission at any time in Health Connect. On iPhone you type steps in yourself; the app doesn't read Apple Health.

Signing in

The app keeps its sign-in tokens in your phone's secure storage (the iPhone Keychain or the Android Keystore).
The website uses one cookie to keep you signed in (for up to 60 days) and one to protect its forms. Both are essential, and there are no other cookies.
Web access keys, which let you sign in on the website, are stored only as a hash and stop working after 10 minutes or one use.

Security logs

Like any website, our server logs each request's internet (IP) address, time and the page asked for. We use these logs only to keep the service secure, limit password guessing and fix faults, and we keep them no longer than we need to for that.

What stays on your phone

The app keeps a copy of your data on the phone so it works offline. Reminders are scheduled on the phone itself; we don't send push notifications. Sarge's voice clips are part of the app, so playing them sends nothing to us.

Who else is involved

We don't sell, rent or share your data. Only these services handle it, on our behalf:

Our hosting provider, which runs the server and database where your account is kept.
Google reCAPTCHA, on the website's sign-in form only, to stop automated attacks. Google receives information about your browser and device when that form is used, under Google's privacy policy.

We may also disclose information if the law requires it.

Why we're allowed to use it

Under UK data protection law (the UK GDPR):

your account and what you record are needed to provide the service you signed up for;
for health information, we rely on your explicit consent, which you give by entering it and can withdraw by deleting it or your account;
security logs and reCAPTCHA are in our legitimate interest in keeping the service safe.

How long we keep it

We keep your data for as long as you have an account. When you delete a single entry, it's marked as deleted straight away so the deletion reaches your other devices, and it's removed completely when the account is deleted.

Deleting your account

In the app, open Settings, then Delete my account, and enter your password. This removes your account and everything recorded in it from our server straight away, clears the copy on that phone, and signs out the website. It can't be undone. If you can no longer use the app, email support@alderstrom.com with your username. We don't hold your email address, so we'll ask you to show the account is yours before we delete it.

Your rights

You can ask for a copy of your data, have it corrected or deleted, or object to how we use it. Most of it you can see, change and delete in the app yourself; for anything else, email support@alderstrom.com. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Sergeant Fitness is made for adults aged 18 or over. We don't knowingly keep data about children; if you think a child has made an account, email us and we'll delete it.

Changes to this policy

If we change what we keep or how we use it, we'll update this page and the date at the top.