Built private from day one.

1. Introduction and Data Controller

LiftZone Workouts ("the App," "we," "us," or "our") is developed and operated by LiftZone ("the developer"). This Privacy Policy explains how we handle information when you use our iOS application and Apple Watch companion app.

We operate under a privacy-first, data-minimizing architecture. The App has no account system and no login: it works from an anonymous, per-installation identifier and never asks for your name, email address, or Apple ID. The vast majority of your personal data — including workout history, nutrition logs, health metrics, body measurements, readiness check-ins, and your progress photos — is stored only on your device and in your own private Apple iCloud container. We cannot access, view, or retrieve it.

To provide certain optional features, we operate a limited, secure cloud service (described in Section 5) that supports subscription verification, security and anti-abuse protection, and optional cloud-assisted features. Apart from those optional features — which process only the specific item you submit (such as a meal photo, or a summary of your training week) transiently to return a result and then discard it — this service does not store your workout, nutrition, health, or profile records, is never used to advertise to you, and is not used to build a profile about you.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, the developer acts as the data controller for the limited data described in Section 5. For all data stored in your private iCloud container, Apple Inc. acts as the data processor under its own terms and privacy policy. Where we engage the service providers described in Section 5, they act as our processors, and we can identify the specific provider behind each category upon verified request.

2. Data Stored on Your Device and in Your Private iCloud (We Cannot Access)

The following categories of data are stored on your device and synced through Apple CloudKit to your own private Apple iCloud container. This data is encrypted by Apple and synced only across your own authorized devices. We have zero access to it:

• Workout history, exercise performance, sets, reps, weights, and RPE
• Profile information (any name you choose to enter, body metrics, fitness goals, experience level, injury history, equipment)
• Nutrition logs, meal entries, macros, custom foods, and favorite meals
• Estimated one-rep maxes and strength metrics
• Readiness and mood check-ins, and adaptive-session logs
• Sleep, energy, strain, and recovery data
• Activity logs, custom exercises, and workout plans
• Achievements, streaks, and water-intake logs

Progress photos and body-composition images are stored only on your device. They are not synced to iCloud and not transmitted to us or to any third party. (If you set a profile photo, it forms part of your profile and syncs within your own private iCloud container like the rest of your profile data; it is never transmitted to us.)

Because we cannot access this data, we cannot comply with data access requests for it. You control this data entirely through your Apple ID and iCloud account settings, and you can erase it at any time using Reset App Data (see Section 7).

3. On-Device Processing

The App performs the following processing locally on your device. No data from these operations is transmitted to our servers:

• Workout Intelligence: Our algorithm processes your exercise history locally to calculate your Estimated One-Rep Max (E1RM), generate adaptive workout plans, and manage progressive overload.
• On-Device Food Scanner: The App includes an on-device food-recognition mode that analyzes images locally on your device. In this mode, images are never transmitted off your device. An optional cloud-assisted scan is described separately in Section 5.1, and you choose which mode to use.
• On-Device Language Model: On supported devices, the App uses Apple's on-device language models to interpret meal descriptions and generate nutritional estimates. This processing occurs entirely on your device.
• Recovery and Strain Calculation: Sleep quality, energy levels, readiness, and activity data are processed locally to provide recovery insights and adapt your sessions.
• Data Export: You can export your workout history — one day at a time — as a CSV file or a shareable image. These files are generated locally on your device, and you control where and with whom you share them. (The App does not provide a single combined download of all your data; because your data lives on your device and in your own private iCloud, you control it directly and can erase it as described in Section 7.)

4. Apple HealthKit Integration

With your explicit opt-in permission, the App reads and writes specific data types from Apple HealthKit:

Data we read: heart rate, resting heart rate, heart rate variability (HRV), VO₂ max, step count, walking/running distance, active energy burned, Apple exercise time, sleep analysis, State of Mind (mood), and dietary nutrients (water, calories, protein, carbohydrates, fat). To auto-fill your profile during onboarding, the App also reads your height, body weight, biological sex, and date of birth.

Data we write: completed workouts (type, duration, calories burned), State of Mind (mood), sleep analysis, activity quantities (steps, walking/running distance, active energy), and the dietary nutrients (water, calories, protein, carbohydrates, fat) you log through the App.

HealthKit data is used solely for display and local computation within the App. In compliance with Apple's HealthKit guidelines, we do not use it for advertising or marketing, and we never sell it or disclose it to data brokers or information resellers. The one exception to on-device-only use is the optional Weekly Report (Section 5.2): if you use that feature, summary values derived from some of these metrics — for example your weekly average sleep, HRV, and resting heart rate — are included in the training summary that is transmitted, transiently, for narration. No raw HealthKit samples are transmitted. You may revoke HealthKit permissions at any time through the iOS Settings app under Privacy & Security > Health.

5. Information We Share With Service Providers

To deliver certain features, the App transmits a strictly limited set of data to the service providers below. We describe each provider by category. We do not sell your personal information, none of these providers receives the contents of your private iCloud container, and we can provide the identity of the specific provider behind each category upon verified request.

5.1 Cloud-Assisted Meal Photo Recognition (optional, premium feature)

If you choose the cloud-assisted meal scan, the photo of the meal you are scanning is securely transmitted — through our cloud infrastructure provider — to a third-party AI processing provider, which returns an estimate of the food and its nutritional values. Before transmission, the image is resized and its metadata (such as location and EXIF data) is removed. Only the image and minimal technical parameters are sent; no name, identity, health data, or other personal records are included.

The image is used solely to generate your scan result. It is processed transiently and is not retained by us or stored on the processing servers, and it is not used to advertise to you, to identify you, or to train unrelated systems. This feature is optional — an on-device scanning mode (Section 3) is also available and transmits nothing off your device.

5.2 Cloud-Assisted Weekly Report (optional, premium feature)

If you use the optional Weekly Report, the App compiles a summary of your training week on your device and securely transmits it — through our cloud infrastructure provider — to a third-party AI processing provider, which returns a written narrative of your week. The summary contains training figures (such as sessions completed, training volume, sets, average effort/RPE, per-muscle workload, personal records, and top lifts) together with a small set of recovery and nutrition values — including summary values derived from Health metrics, such as your weekly average sleep, heart-rate variability (HRV), resting heart rate, and readiness, and your average protein and calorie adherence. It does not include your name, contact details, progress photos, or raw Health samples.

The summary is used solely to generate your report. It is processed transiently and is not retained by us or stored on the processing servers, and it is not used to advertise to you, to identify you, or to train unrelated systems. This feature is optional and runs only when you open or enable the Weekly Report.

5.3 Subscription Verification (Apple App Store)

Subscriptions are sold and managed entirely by Apple through the App Store; we do not use any third-party subscription-management service. To confirm whether you have an active subscription, your App Store purchase receipt is verified on your device and, for cloud-based premium features, transmitted together with an anonymous identifier to our own cloud infrastructure provider, which validates it directly against Apple's cryptographic signature. No separate subscription provider is involved, and no subscription data is shared with any such third party. All payment processing is handled by Apple — we never see your payment details.

5.4 Security, Device Integrity, and Anti-Abuse (cloud infrastructure provider)

To protect the service from fraud and abuse and to enforce fair-use limits, the App sends an anonymous per-installation identifier and a cryptographic device-integrity attestation to our cloud infrastructure provider when it makes a request on your behalf. The attestation is generated by Apple's Device Check / App Attest service and proves the request comes from a genuine, unmodified copy of the App. It contains no personal content and is validated and then discarded. Our cloud infrastructure provider also retains minimal, non-personal operational data (such as request counters used to enforce rate limits).

5.5 Nutrition Database Lookups (nutrition-database providers)

When you search for foods by name or scan a product barcode, the App sends the search text or barcode number — and, as part of any network request, your device's IP address — to one or more third-party nutrition-database providers (including public government and community food databases) to retrieve nutrition facts. These providers do not receive your name, identity, workout data, or health data.

5.6 Social Leaderboards (Apple Game Center — optional)

If you opt in to leaderboards, the competitive statistics you choose to submit (such as a strength score, estimated maxes, weekly volume, or streak length) and your Game Center alias are shared with Apple Game Center and may be visible to other participants on leaderboards. If you grant access, your Game Center friends list is used only to show which of your friends also appear on a leaderboard, and is not transmitted to us. This feature is optional; we do not submit any scores unless you choose to participate, and your underlying workout, nutrition, and health data is never shared — only the score values you compete with.

5.7 Apple iCloud / CloudKit (Data Synchronization)

Apple CloudKit synchronizes your data across your devices using your private iCloud container. Apple processes this data under its own privacy policy at apple.com/privacy. We do not have access to the contents of your private container.

5.8 Apple Speech Recognition

The voice meal-logging feature uses Apple's Speech framework. Depending on your device and iOS version, voice data may be processed on-device or transmitted to Apple for transcription, under Apple's privacy policy. We do not receive, store, or have access to your voice recordings or transcripts — they are processed within the Apple ecosystem and the result is stored only in your private iCloud container.

5.9 Apple App Store (Payments)

All subscription payments are processed by Apple through the App Store. We do not receive, process, or store your payment card details, billing address, or financial information. Apple's payment terms are available at apple.com/legal/internet-services/itunes.

5.10 Anonymous Usage & Performance Analytics (cloud infrastructure provider)

To understand how the App is performing and where it can be improved, the App sends a small stream of anonymous, aggregate events to our own cloud infrastructure provider — for example, that an onboarding step was reached, that a workout was completed, or app-health measurements such as app launch time or a crash count. These events carry no name, account, email, or health data, and no identifier that could link them back to you or your device — only the event itself and coarse technical context such as the app version, platform, and language. Your approximate country is inferred at the network edge from the connection and is not stored alongside your IP address or any persistent identifier. This information is counted only in aggregate, to show us how the App behaves as a whole. It is never used to advertise to you, to build a profile, or to identify you, and it cannot be traced back to an individual user.

6. Data Retention

• iCloud Data: Retained in your private iCloud container for as long as you maintain your Apple ID and iCloud account. We have no ability to set retention periods for this data.
• On-Device Data: Local data stored only on your device — including progress photos, the local meal-photo cache, and cached exercise videos — is retained until you delete the App, which removes all of it. You can also delete progress photos individually within the App. Separately, the Reset App Data function clears your workout, nutrition, profile, and related records (and resets app preferences) from the device and your private iCloud container; see Section 7.
• Cloud-Assisted Scan Images and Weekly Report Summaries: Not retained. The image sent for the optional cloud scan, and the training summary sent for the optional Weekly Report, are processed transiently to return your result and are then discarded.
• Subscription Data: Your subscription is managed by Apple; we do not store subscription data with any third-party subscription provider. Entitlement results may be briefly cached by our cloud infrastructure provider (see Section 5.4) and contain no personal content.
• Security & Fair-Use Data: The anonymous identifier, device-integrity validations, and request counters used by our cloud infrastructure provider are kept only as long as needed for security and rate-limiting, and contain no personal content.
• Anonymous Analytics: The usage and performance events described in Section 5.10 are kept only as aggregate, non-personal counts by our cloud infrastructure provider. They are not linked to you and are not retained as personal data.
• Nutrition Queries: We do not log or retain your food searches. Nutrition-database providers may retain standard server logs in accordance with their own requirements.

7. Your Rights

All Users:

• Access and Portability: You can view all of your data within the App, and export your workout history — one day at a time — as a CSV file or a shareable image. Because your data is stored on your device and in your own private iCloud container rather than on our servers, you control and can move it directly through Apple; we do not hold a copy to provide.
• Modification: You can edit your profile and your nutrition logs directly in the App.
• Deletion: You can permanently delete your records through Settings > Reset App Data, which removes your workout, nutrition, profile, and related records from your device and from your private iCloud container. To erase everything stored on your device — including progress photos and all local caches — delete the App. These actions are irreversible.
• Revoke Permissions: You can revoke camera, microphone, speech recognition, and HealthKit permissions at any time through iOS Settings.

European Economic Area, United Kingdom, and Switzerland (GDPR):

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent legislation:

• Legal Basis: We process the limited data described in Section 5 on the basis of: performance of a contract (subscription verification); legitimate interest (securing the service, preventing abuse, and using anonymous, aggregate analytics to improve the App); and consent (HealthKit access, camera, microphone, speech recognition, the optional cloud-assisted scan, the optional Weekly Report — including the Health-derived summary values it sends — and leaderboard participation). You may withdraw consent at any time, including by declining or revoking the relevant permission, or by not using the optional feature.
• Right to Object: You may object to processing based on legitimate interest by contacting us at the address below.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.
• International Transfers: Some of the service providers described in Section 5 are based in, or process data in, the United States — including the third-party AI processing provider used for the optional meal scan and the optional Weekly Report. Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. The data transmitted to these providers is limited to the items described in Section 5.

California (CCPA/CPRA):

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• You have the right to know what personal information we collect, request its deletion, and opt out of any future sale (though we do not sell data).
• We will not discriminate against you for exercising these rights.

Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act 1988):

Users in these jurisdictions have rights to access, correct, and delete personal data under their respective national privacy laws. To exercise these rights, contact us using the information in Section 12.

8. Children's Privacy

LiftZone Workouts is not directed at children. We do not knowingly collect personal information from children under the age of 13 (United States, under COPPA) or under the age of 16 (European Economic Area, under GDPR, where applicable). If you believe a child has provided data through the App, please contact us and we will take steps to delete it.

9. Security

Your data stored in iCloud is encrypted by Apple using AES-128 encryption at minimum, both in transit (TLS 1.2+) and at rest. On-device data is protected by iOS hardware encryption and your device passcode. Keychain entries used by the App (such as the anonymous identifier and trial state) are stored with the kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly protection class and are not included in unencrypted backups.

All communication with the limited cloud services described in Section 5 occurs over encrypted connections (TLS). Requests are protected by Apple's device-integrity attestation to prevent abuse, and images sent for the optional cloud scan are transmitted securely and not stored. While we implement reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

10. Health and Fitness Disclaimer

LiftZone Workouts provides fitness programming, nutritional estimates, and recovery insights for informational and educational purposes only. The App is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease or medical condition. Nutritional estimates produced by the food scanner (whether on-device or cloud-assisted) and by nutrition databases are approximations and should not be relied upon for medical dietary requirements. Always consult a qualified healthcare professional before beginning any exercise program or making significant changes to your diet.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where practicable, notify you through the App or via the App Store release notes. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

12. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

LiftZone

Email: support@liftzoneworkouts.com

Website: www.liftzoneworkouts.com

For GDPR-related inquiries, you may also contact us at the email above with the subject line "GDPR Request." We will respond to all legitimate requests within 30 days (or within the timeframe required by applicable law).