This Privacy Policy describes what data The Lifting App collects, how we use it, who we
share it with, and the choices you have. By using the app you agree to this policy. If you
don't agree, don't use the app.
1. Data we collect
1.1 Account data
Email address (when you sign up with email)
Apple Sign In identifier (when you sign up with Apple)
Google Sign In identifier and email (when you sign up with Google)
Encrypted password hash (Supabase Auth, when you set a password)
Display name (optional, you set this)
Username (you choose this for the social feed)
1.2 Profile data
Biological sex (used for strength-percentile calculations)
Date of birth (used for strength-percentile calculations)
Height in centimeters
Units preference (kg or lb)
Training intent (Aggressive / Balanced / Conservative — chosen by you)
User context (free-text notes about yourself, your injuries, training goals — you write
this and can edit or delete at any time)
1.3 Training data
Workout sessions (start time, end time, optional title)
Sets logged (exercise, weight, reps, RPE, partials, duration for isometric holds, distance
for distance lifts, timestamp)
Bodyweight entries (weight, date)
Training splits (days, exercises, target sets / reps / rest)
Custom exercises you create (name, muscle groups, equipment type)
1.4 Social data
Follows (which accounts follow you, which accounts you follow)
Coach proposals on your training split (applied or dismissed)
1.6 Apple Health (optional)
If you grant permission during onboarding, we read your biological sex, date of birth,
latest body mass, and latest height. We write one record back: when you finish a session we
save it to Apple Health as a Traditional Strength Training workout, with its start time, end
time and total volume, so other fitness apps can see your lifting load. Nothing else is
written, and you can revoke write access at any time in the Health app. The values are used
once to prefill your profile during onboarding; you confirm each value before your account
is created.
1.7 Push notification tokens
If you grant notification permission, we store an Expo push token tied to your device so we
can send you push notifications.
1.8 Analytics + diagnostics
Anonymous event analytics (PostHog): which screens you view, which
features you use, conversion funnels. Used to improve the app. No raw training data leaves
your account through this pipeline.
Crash + error reports (Sentry): stack traces and device context when the
app crashes or errors. Used to fix bugs.
Server-side audit logs (Supabase): records of AI coach invocations (model
used, token counts, latency, cost estimate). Used to bill and rate-limit AI usage.
1.9 Audio (only when you use voice dictation)
When you dictate a workout split, your voice recording is sent to OpenAI Whisper for
transcription. The transcript is then sent to Anthropic Claude for parsing into structured
data. The audio file is deleted from our servers immediately after transcription. The
transcript is not retained beyond the immediate parse step.
2. How we use your data
We use it to:
Provide the app's core features (logging, history, charts, coach, social feed).
Tailor coach recommendations and the next-set suggester to your profile (your training
intent, your user-context notes, your sex and age for cohort comparisons).
Run analytics and crash reports to improve the app.
Communicate with you about your account when necessary.
We do not:
Sell your data to third parties.
Show advertising in the app.
Use your training data to train AI models. The coach is grounded in your data per-request
but no training data leaves Anthropic's inference pipeline.
3. Third parties we share data with
Third party
What we share
Purpose
Supabase (US region)
All of the above except audio
Database + auth hosting
Anthropic
Coach prompts (which include relevant training data)
Coach AI inference
OpenAI
Audio dictation files (deleted after transcription)
Voice-to-text
PostHog
Anonymous events + your user id
Product analytics
Sentry
Crash reports + your user id
Error tracking
Apple
Your Apple identifier
Sign in with Apple
Google
Your Google identifier
Sign in with Google
Expo Push
Your push token + payload contents
Push delivery
Apple Health
Read-only access to fields you authorized
Onboarding prefill
Each of these third parties has its own privacy policy.
4. Where data is stored
Primary database: Supabase, US region (AWS us-east-1).
Backups: Supabase point-in-time recovery, US region.
If you are in the EU / UK, your data leaves your home region when you use the app. By using
TLA you consent to this transfer.
5. Your rights
You have the right to:
Access the data we hold about you. Email us (see Section 9) and we'll
send you an export within 30 days.
Correct inaccurate data. Most fields can be edited in-app (Settings,
Profile). For anything you can't edit, email us.
Delete your account and all associated data. Go to
Settings → Danger zone → Delete account. The deletion is immediate and
permanent — we keep no backups beyond Supabase's standard 7-day point-in-time recovery
window, after which the data is unrecoverable.
Withdraw consent for Apple Health by revoking permission in iOS Settings
→ Privacy → Health → The Lifting App.
Withdraw consent for push notifications via iOS Settings → Notifications
→ The Lifting App.
EU / UK users have additional GDPR rights including the right to data portability, the right
to object to processing, and the right to lodge a complaint with your local supervisory
authority. California users have CCPA rights including the right to know what categories of
personal information we have collected, sold, or disclosed. Email us to exercise any of
these rights.
6. Data retention
Active accounts: data is retained while your account is active.
Deleted accounts: data is removed from the live database immediately.
Point-in-time backups age out within 7 days.
Coach audit logs: retained for 90 days for billing and rate-limit
reconciliation, then aggregated to anonymous counts.
7. Children's privacy
The Lifting App is not directed at children under 13 (or 16 in the EU). We do not knowingly
collect data from anyone under those ages. If you believe a child has signed up, email us
and we'll delete the account.
8. Security
All API traffic is HTTPS.
Passwords are hashed via Supabase Auth (bcrypt).
Database row-level security (RLS) enforces per-user data isolation; no user can read
another user's training data, conversations, bodyweight entries, or follows except through
the public social feed (which you control via per-session visibility settings).
Apple Health data does not leave your device until you explicitly confirm the prefilled
values during onboarding.
We don't store payment information directly — App Store / Google Play handle billing.
No system is perfectly secure. If you suspect your account has been compromised, email us
and change your password.
9. Contact
For privacy questions, data requests, or to report a concern:
For account deletion: use
Settings → Danger zone → Delete account inside the app. Email is fine too
if you've lost access.
10. The website and launch waitlist
This section covers theliftingapp.com itself, as distinct from the app.
No cookies, no trackers. The website sets no cookies, uses no analytics,
and loads no third-party scripts, fonts, or embeds. All assets are served from our own
domain.
Hosting. The site is hosted on Vercel, which processes standard web
server request data (such as your IP address) to deliver the pages, per
Vercel's privacy policy.
Launch waitlist. If you join the waitlist we store your email address,
which form you used, and a truncated browser user-agent string (used only to filter
automated spam signups). This is stored in Supabase (US region) and used for exactly one
purpose: sending you a single email when the app launches. No newsletter, no marketing
drips, and the list is never shared or sold. To be removed at any time, email
support@theliftingapp.com.
11. Changes to this policy
If we change this policy, we'll update the effective date at the top and (for material
changes) notify you in-app or by email before the new policy takes effect. Continued use of
the app after a change means you accept the new terms.