Last updated: May 24, 2026
StrengthSync ("SS", "we", "us") is a fitness and wellness app for logging workouts, cardio sessions, nutrition, and personal health metrics, with AI-assisted features such as a coach chat and food parser. This Privacy Policy explains what we collect, how we collect it, why, who we share it with, how long we keep it, and the choices you have. It applies to your use of the StrengthSync app and our website.
What we never do. We do not sell your personal data. We do not share your data with third-party advertising networks. We do not use any data for cross-app or cross-website tracking. We do not use your data to train AI models.
StrengthSync is not a HIPAA covered entity and the app is not a medical device. See our Terms of Service, Section 9, for the health and medical disclaimer.
StrengthSync collects only the data you explicitly enter into the app, authorize us to read, or that is generated as a necessary part of running the service:
We do not collect contacts, photos, audio recordings, browsing history outside the app, search history outside the app, or any data from other apps on your device. Precise location is only collected during GPS-tracked fitness tests (see Section 4).
We collect information through three paths:
When you run a GPS-tracked fitness test (such as the 1.5-mile Cooper test), StrengthSync uses your device's location to measure distance and pace. Location samples are processed on-device and only the aggregated test result (total distance and duration) is stored in our database. Raw GPS tracks are not sent to our servers or retained after the test session ends.
You can revoke location access at any time from iOS Settings → Privacy → Location Services → StrengthSync.
Your data is used exclusively to provide and improve the StrengthSync service:
We do not use your data to train AI models. We do not build advertising profiles from your data. We do not sell or rent your data to third parties for marketing.
Your data is stored using Supabase (hosted on Amazon Web Services infrastructure in the United States). Access to your data is enforced with row-level security policies in the database, so only your authenticated account can read or write rows associated with your user ID. All data is transmitted over HTTPS/TLS. Passwords are hashed by Supabase Auth and are never visible to us or stored in plaintext.
We do not store payment card information. All in-app purchases are processed by Apple via StoreKit; subscription state is relayed to us via RevenueCat without exposing card details.
No system is perfectly secure. While we apply commercially reasonable safeguards, we cannot guarantee absolute security.
Breach notification. If we confirm a data breach involving your personal information, we will notify affected users by email within seventy-two (72) hours of confirmation, in addition to any notifications required under applicable law. The notification will describe the nature of the breach, the categories of data involved, the steps we have taken in response, and the steps we recommend you take. We maintain encrypted daily database backups via our infrastructure provider with a target recovery-point objective of twenty-four (24) hours and a commercially reasonable best-effort recovery-time objective.
StrengthSync relies on the following third-party services. Each receives only the subset of data needed for its function, and each is bound by its own privacy policy and terms.
StrengthSync does not use any data for "tracking" purposes as defined by Apple's App Tracking Transparency framework. Specifically: we do not link your data to third-party data for targeted advertising or advertising measurement; we do not share your data with a data broker; we do not use the IDFA; and we do not display third-party advertising in the app.
The app provides optional fields for family-history flags (e.g., family history of type-2 diabetes, cardiovascular disease, or myocardial infarction under age 60) and medication flags (e.g., statin, beta blocker). These fields are optional and exist solely to refine general fitness calculations such as cardiovascular-risk-aware educational content and training-load suggestions.
StrengthSync does not interpret these fields as a clinical assessment. We do not diagnose conditions, recommend medications, or provide medical advice. See Terms of Service Section 9.
Information you enter into these fields is treated with the same row-level-security protections as the rest of your account data and is sent to AI providers only when it is relevant to the specific prompt you are running (see Section 10).
When you use the coach chat or food parser, we send the text of your message to an AI provider (Anthropic or Groq) to generate a response. Along with the message text, we send minimal context needed to produce a useful response — typically a summary of your recent activity (up to the prior 7 days), and, when relevant to the prompt, a subset of your body profile or sensitive-health-context flags described in Section 9.
We strip your account email and your name before sending. Where we need to associate a request with your account for rate-limit or safety purposes, we send your StrengthSync user UUID — an opaque random identifier issued by our authentication provider that cannot be reversed into your name, email, or any external identifier.
Sensitive health context is sent only when relevant. The sensitive-health-context fields described in Section 9 (family-history and medication flags) are sent to AI providers only when the specific prompt you are running requires them — for example, when you explicitly ask about training or nutrition adjustments given a medication or family-history factor. These fields are not included automatically with every AI request.
Per Anthropic's current commercial API terms, Anthropic does not train its models on customer API inputs or outputs. Groq operates under similar commercial-API terms. We do not authorize either provider to train on your inputs.
Providers may log requests on their side for a limited period for safety, abuse-prevention, and operational purposes per their own privacy policies. We do not control how long those provider-side logs are retained. See each provider's privacy policy for details.
StrengthSync operates alongside sibling products under the same LLC. Inter-product data sharing is opt-in only and requires your explicit acceptance of a per-flow consent prompt.
No data flows to a Periodize coach or to Metacor unless and until you opt in via the per-flow consent prompt.
StrengthSync retains your account data — body profile, workouts, cardio sessions, nutrition entries, health metrics, HealthKit data we have read, AI chat history, and purchase events — for as long as your account is active, so that your progress charts and history remain available to you.
You can delete your account and all associated data at any time from inside the app (Settings → Account → Delete Account) or by emailing support@strengthsync.net. Upon a deletion request, your account data is permanently removed from our active databases within thirty (30) days. Encrypted backups containing historical snapshots may persist for up to an additional ninety (90) days before they are overwritten in the normal backup rotation, after which no copy of your data remains.
Unconverted-trial purge. If you start a paid subscription via a free trial and the trial concludes without converting to paid (for example, the trial ends without a successful charge, or you cancel before conversion), we retain your account data for thirty (30) days after the trial-end date and then automatically purge it from our active databases (with the same backup-rotation tail described above). We send a reminder email at fourteen (14) days post-trial-end so you can reactivate or export your data before purge. Reactivating during the 30-day window restores your account; reactivating after purge requires creating a new account.
Data sent to Anthropic, Groq, RevenueCat, PostHog, Vercel, Upstash, or other third-party services is governed by each provider's own retention policy. We do not control how long those providers retain transaction logs on their side. See each provider's privacy policy for details.
Regardless of where you live, we honor the following rights on a non-territorial basis:
StrengthSync is not currently offered to users in the EU, EEA, United Kingdom, Brazil, China, or South Korea. Account creation from those jurisdictions is not supported; if we identify an account that appears to be located in or operated from one of these jurisdictions, we may suspend the account pending dedicated regional compliance work. The rights above are honored for users in jurisdictions where the app is available, including CCPA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), and similar U.S. state privacy frameworks.
StrengthSync is not intended for users under 18, and accounts may only be created by individuals who are 18 or older. We do not knowingly collect personal information from users under 18. If we learn that we have collected personal information from a user under 18, we will delete that account and the associated data. Parents or legal guardians who believe their child has provided us information may contact privacy@strengthsync.net.
Apple requires every app on the App Store to publish a Privacy Nutrition Label describing the categories of data collected and how that data is used. StrengthSync's Privacy Nutrition Label is visible on the App Store product page for the app. The categories declared there correspond to the data types and purposes described in this Privacy Policy, including: Contact Info (email), Identifiers (user ID), Health & Fitness, Sensitive Info, Usage Data, Diagnostics, Purchases, and User Content (coach chat messages).
StrengthSync does not declare any data under Apple's "Used to Track You" category — see Section 8.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and bump the internal Privacy Policy version. Material changes will trigger an in-app re-consent prompt on your next authenticated app open; minor changes will be posted here without a separate notice.
Privacy questions, data-access requests, deletion requests, or portability requests:
General support: