Privacy Policy

1.Information we collect

We only collect what's needed to run the app.

Account information

• Email address (for sign-in, via Supabase authentication, and to contact you as described in section 2)
• Display name and optional username

Profile & fitness information you provide

• Age, height, weight, sex
• Fitness goal, current activities, available equipment, injuries/limitations
• Preferred training days and workout duration

Activity & health-related data you generate in the app

• Workouts completed, exercises performed
• Weights and repetitions you log
• Body-weight entries over time
• Heart-rate readings, only while you connect a Bluetooth heart-rate device during a workout. We do not access any other health data on your device.

Social data (optional)

• Friend connections, friend requests, and challenges you create or join

Profile picture (optional)

• If you choose to set a profile picture, we access the single photo you select from your device and store it. We only ever access the image you explicitly pick — we do not browse or collect your photo library.

Technical data

• A push-notification token (if you enable reminders)
• Subscription status (managed by Google Play and RevenueCat)
• Usage data — which features and steps you use, including steps before you create an account (opening the app, viewing the welcome and sign-in screens, starting sign-up), for example completing onboarding, viewing the subscription screen, starting a trial or completing a workout. These events are linked to a random identifier the app creates on first launch (not your device's advertising ID) and, once you sign in, to your account. We use them to understand where the app can improve and, in aggregate, to measure which promotion channels bring people who actually use the app
• Crash & diagnostic data — if the app crashes, a crash report (error details, device model, operating-system version and app state at the time) is collected via Firebase Crashlytics to help us fix bugs. It is tied to an anonymous device identifier, not to your name or email

Tester signups (website only)

• If you enter your email address in the "Become a tester" form on this website, we store only that address, and only to contact you about joining the closed test. It is not used for marketing or shared with anyone, and we delete it on request at support@ironshape.app.

We do not collect precise location, your contacts, your photo library, or browsing history. The only photo we access is the single image you choose to set as a profile picture (above). The Bluetooth permission is used solely to read heart-rate from a device you choose to connect, never for location.

2.How we use your information

• To create and adapt your personalized AI workout plans
• To track your progress (stats, charts, personal records, streaks)
• To power optional social features (friends, leaderboard, challenges)
• To send workout reminders and progress notifications (if you enable them)
• To manage your subscription and free trial
• To email you about your account (support, problems we have fixed) or, now and then, to ask what you think of the app. These are personal emails, not a newsletter: you can ask us to stop at any time by replying or writing to support@ironshape.app
• To understand how the app is used, in aggregate, and to improve it and fix bugs
• To keep the service secure and working

We do not sell your personal data and we do not use it for personalised advertising. The app does not use your device's advertising ID. If we promote the app with ads, we only use aggregated statistics to see which campaigns work.

Legal bases

• Contract (Art. 6(1)(b) GDPR): creating and adapting your plan, tracking your progress, the social features you choose to use, your subscription and free trial.
• Consent (Art. 6(1)(a) and 9(2)(a) GDPR): injuries and limitations and heart-rate readings, which are health data; reminders and notifications. You can withdraw your consent at any time, without affecting processing that has already taken place.
• Legitimate interest (Art. 6(1)(f) GDPR): keeping the service secure, crash reports, usage events in our own database to improve the app, and emails about your account or asking for your opinion. You can object at any time by writing to support@ironshape.app.
• Legal obligation (Art. 6(1)(c) GDPR): keeping the records required by tax and accounting law and answering requests from the authorities.

3.Third-party services (processors)

We share data only with services that help operate the app:

Each provider processes data under its own privacy terms. We send the minimum necessary, and AI requests do not include your name or email.

This website sets no cookies and loads no third-party trackers. Fonts are served from our own domain, and Vercel Web Analytics counts page views without cookies or any identifier that follows you across sites — so no consent banner is needed.

4.Data retention

We keep your data for as long as your account exists. When you delete your account (see below), your data is removed. Usage events recorded before sign-in contain no name or email. Until 19 October 2026 the app also used Google Analytics for Firebase; Google deletes that data after 2 months.

5.Deleting your account and data

You can permanently delete your account and all associated data at any time:

• In the app: Profile → Delete account. This immediately and permanently erases your account and all data.
• By email: if you can't access the app, email support@ironshape.app from your account's email address and we will delete your data within 30 days.

See the account deletion page for full details. Deletion is permanent and cannot be undone.

6.Security

Data is transmitted over encrypted connections (HTTPS/TLS) and stored by Supabase with access controls (row-level security). No method is 100% secure, but we take reasonable measures to protect your information.

7.Children

IronShape is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

8.International data transfers

Your data may be processed on servers located outside your country (e.g. in the EU or the United States) by the providers listed above. These transfers rely on the safeguards offered by the providers, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

9.Your rights

Depending on your region (e.g. GDPR in the EU), you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. You can exercise most of these directly in the app, or by emailing us at support@ironshape.app. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali).

10.Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, communicated in the app.