This is a workout tracker, not a data business. There are two ways to use it, and you pick which one just by choosing whether to create an account.
Your workouts are stored in your browser, on your device. They are never sent anywhere. You give us no email address and no name, so there is nothing for us to hold, lose, or be asked to hand over.
The trade-off: if you clear your browser data, switch browsers, or lose the device, your history goes with it. Use Back up at the bottom of the app to save a file, and keep it somewhere safe. Emailing it to yourself works.
We store your email address and your workouts. Nothing else. That is what lets your history survive a cleared cache or a new phone, and stay in step across your devices.
Your password is hashed with bcrypt before it is stored, so nobody — us included — can read it. That is also why a forgotten password can only be reset by email, never looked up.
Being straight with you: your workouts are not end-to-end encrypted. Access rules on the server mean no other user can read them, but whoever operates the database could. If that matters more to you than surviving a lost phone, use it without an account — nothing is missing from that version.
Back up saves every workout and exercise to a file on your device. Restore loads one back in, replacing what is currently there. Both work whether or not you have an account — having one does not lock your data in, and you can take a copy at any time.
Deleting an account deletes the workouts stored with it, permanently and immediately. Take a backup first if you want to keep them.