Privacy policy

Last updated 19 October 2026

Badly Drawn Workouts is run by Andrew Chambers, who can be contacted at andy@badlydrawnworkouts.co.uk. This page explains what the site collects and why. In short: it collects very little, and nothing that identifies you.

Page views and performance

The site uses Cloudflare Web Analytics to count page views and measure how fast pages load. It doesn't set cookies or track you from one site to another. To deliver the site, Cloudflare necessarily receives your IP address and basic request details. You can read how Cloudflare handles these in its privacy policy.

Finishing an exercise

When you finish an exercise, the site sends a small message containing the type of event, the workout's ID and the exercise's ID. If you've accepted cookies (see below), it also includes your random visitor ID. The message never includes your IP address. We use these messages to see which workouts are used and whether people come back to them.

Accounts

You can sign in with your email address. There's no password. We email you a sign-in link, which works once and expires after 15 minutes. We keep:

• Your email address, which identifies your account and is where sign-in links are sent.
• Your sign-in sessions, stored as a hash rather than the value in your browser. A session lasts up to 90 days, or until you sign out.
• Your completed workouts: which routine and exercise you finished, and when. These show in your history on the account page.

We use your email address to send sign-in links, and to run the account you've asked for. That's the only reason we hold it. Sign-in emails are sent through Resend, an email service that acts on our behalf. Resend transfers and stores them in the United States. Your account data is stored on Cloudflare's database service in Western Europe. Cloudflare's own privacy policy explains that it may access data from other countries to run its service.

When you finish a workout while signed in, your account history gets only the routine and exercise. It doesn't get your anonymous visitor ID, so we don't link the two.

Signing in sets a session cookie. It's needed to keep you signed in, and it's only set when you sign in. It isn't used to track you.

We keep your account and its history until you delete them. You can delete your account at any time from the account page. Deletion takes effect straight away: it removes your email address, your sessions and your history. Copies in our database backups are kept for up to 7 days, and then deleted.

Feedback

On the page you see when you finish a workout, you can write what would make you come back. We send the text with the workout's ID through Telegram, a messaging service that stores messages on its own servers, which may be outside the UK. We don't send your visitor ID, name or IP address with it, and we ask you not to include personal details in what you write.

Licence codes

If you enter a licence code from a purchase, it's saved in your browser's local storage on that device. It isn't sent anywhere except, once paid packs are available, with requests for that pack's content so that the code can be checked. You can remove a saved code at any time on the Enter your code page, or by clearing the site's data in your browser.

Purchases

When paid packs go on sale, they'll be bought through Lemon Squeezy, which takes your payment and the details needed to send you your licence code, such as your email address. We don't see your payment details. Lemon Squeezy's own privacy policy is at lemonsqueezy.com/privacy.

What we don't do

We don't sell your data, we don't use advertising trackers, and we don't build profiles of visitors. The site doesn't show ads at the moment.

Cookies and consent

The first time you visit a page with the workouts, we ask whether you accept us storing a random ID on your device. If you accept, we create the ID in your browser's local storage under bdw-visitor. It's a random string with no link to your name, email address or IP address. We add it to the workout messages described above, so we can count how many people come back to the workouts. We don't use it for anything else, and we don't share it.

We also count how many visitors accept and how many reject. A rejection sends no ID.

If you open a workout from a reminder you've added to your calendar, the link includes from=calendar. When that page opens, we count the visit with the workout's ID, and your random visitor ID if you've accepted.

Your choice is saved in your browser's local storage under bdw-consent, so the question isn't asked again. You can change your choice at any time with the Cookie choices link in the home page footer. Rejecting, or changing your choice, deletes the random ID from your browser. Rejecting doesn't affect the workouts.

Your choices

You can block the Cloudflare analytics script in your browser without affecting the workouts. You can also ask us what we hold about you, or ask us to delete anything we hold, by emailing andy@badlydrawnworkouts.co.uk. If you have an account, you can see your history and delete your account on the account page.

You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes, the date at the top will change with it.