Training tracker, shipped and running

Red Jitsu

A mobile-first app for strength training, jiu-jitsu, and cardio that runs from my iPhone home screen. Proof that I don't just prototype: I ship, operate, and maintain.

Open the demo

The problem

Most training apps are built for one discipline. If you lift, roll, and run, your training is split across three apps and none of them shows the whole load.

Red Jitsu puts strength, jiu-jitsu, and cardio in one place, with programs, progress, and belt tracking, fast enough to log between sets.

What it does

Built for the phone: An installable PWA with offline logging and sync, designed around one-handed use at the gym.
Programs and progress: Structured programs, automatic PR detection, weekly consistency goals, streaks, and per-exercise trends.
Jiu-jitsu native: Session logging by type and intensity, mat-time goals, and a belt-and-stripe journey.
Wearable sync: Fitbit and Google Health connections pull heart rate and calories into the training log.

Screens

Jiu-jitsu session logging with belt rank

AI features

AI coach insights analyzing 90 days of training — AI coach insights: a 90-day analysis of the athlete's own data. Captured before live AI was paused on the public deployment for cost and abuse control.

How it’s built

App: Next.js 14 · React 18 · TypeScript
Data: Supabase Postgres with row-level security
Platform: PWA: service worker, offline sync, web push
Integrations: Fitbit / Google Health OAuth
Ops: Vercel, scheduled jobs, pg_cron
Quality: Vitest test suite

Supabase provides Postgres and auth. Every table is protected by row-level security, so users can only ever read or write their own rows, enforced by the database rather than the app.

The public demo runs against the same production app. Anonymous visitors read one seeded demo athlete through dedicated read-only policies, and a scheduled database job rebuilds the demo data every week so it always looks current.

Security & AI decisions

Security at the data layer: Row-level security on every table, and demo access through narrowly scoped read-only policies. The reseed function is SECURITY DEFINER with execute revoked from every client role.
Hardened OAuth: Wearable connections use PKCE, derive the callback from the request host, and log why a callback failed, which matters when a domain changes under a live integration.
Prompt-injection guardrails: The AI coach treated all training data and user notes as untrusted input, wrapped in tagged blocks the model was instructed never to follow, with a signature cache so it only regenerated when the data changed.
Fail-closed AI switch: AI now sits behind a flag that is off unless explicitly enabled. A missing setting can never quietly turn spend back on.

What’s next

Complete Google's OAuth verification for the Health integration, which removes the weekly reconnect.
A redesign, including what replaces the AI coach space.

Source available on request.