Security and your data

Where your data lives

Both apps store their data in a PostgreSQL database run by Supabase, hosted in Sydney, Australia (the ap-southeast-2 region).

Every connection between the apps and the database uses HTTPS, so data is encrypted in transit.

Row level security

Row level security is switched on for every table in the app database. The database itself checks who is asking before it returns or changes a row, based on their account, their role and which coach or gym they're linked to. So even if the app had a bug, the database won't release rows the signed-in person isn't allowed to see.

We last checked every table on 22 October 2026.

Access by role

What you can see depends on your role. Clients see their own programme, logs and messages. Coaches see their own clients. Gym admins see their gym's trainers, members and billing. Trainers inside a gym can't change the gym's billing.

Totality staff access is limited to a small number of admin accounts, used to run the service and help with support requests.

Payments through Stripe

Subscriptions and in-app payments are processed by Stripe. Card details are typed into Stripe's own secure forms and never touch Totality's servers. We keep only Stripe's reference for the card plus its brand and last four digits, so you can tell your cards apart.

Coaches and gyms are paid out through their own connected Stripe accounts.

Logins and passwords

Sign in is handled by Supabase Auth. Passwords are stored as one-way hashes, never as plain text, and new passwords must be at least 8 characters. Password resets are sent by email to the address on the account.

Health data

Apple Health and Health Connect data is only read after you allow it on your phone, and only the types you approve. You can disconnect in the app's wearables screen or in your phone's health settings at any time.

Deleting your account

You can delete your account yourself in Settings, Delete Account in either app. This permanently deletes your account and data. If you can't get into the app, see Delete your account.

To ask for a copy of your data, email us from the address on your account.

Tell us about a problem

If you think you've found a security issue, or you're worried about your account, email admintotality@gmail.com with "Security" in the subject. We read every message ourselves and will reply as soon as we can.