Privacy policy

This is the same text the Liftrung app shows in Settings.

This website and the waitlist

Waitlist in 30 seconds.
What we collect: your email address and when you agreed, which list you joined, the page language, and any optional answers you choose to give (stored with your email).
Why: to email you once when Liftrung is on the App Store, and to decide what to build next.
How long: until 12 months after the launch email, never more than 24 months after you joined, or until you unsubscribe.
How to leave: click unsubscribe in any email, or write to hello@liftrung.com.

Who is responsible. Contact: hello@liftrung.com.

Cookies and analytics. liftrung.com sets no first-party cookies and has no advertising or tracking pixels. The forms use Cloudflare Turnstile, a security check loaded from challenges.cloudflare.com; it may store data in its own frame, which is strictly necessary to tell people from bots. We also use PostHog (EU cloud) in cookieless mode: it sets no cookies and stores nothing on your device. To count one visit across pages, the PostHog server combines your IP address and browser type with a random key that changes every day and is then deleted, so the same visitor cannot be recognised on a later day; your IP address itself is not stored. It measures page views, which page or link brought you here (UTM tags and referrer), your country, button clicks, whether a form was opened, submitted or failed, and how far you scroll. The legal basis is our legitimate interest in understanding how the site is used. To object, email hello@liftrung.com.

Waitlist. If you join a waitlist we store your email address, which list you joined (iPhone or Android), the page language, the date you agreed, and any answers you choose to give to the optional questions (your phone, what you would use most, what you use today, and whether you would pay for AI food scanning). We use this to email you when Liftrung is available and to decide what to build next, including whether to make an Android version. The legal basis is your consent, which you can withdraw at any time by unsubscribing from any email or writing to us. We keep it until 12 months after the launch email, and never more than 24 months after you joined, or until you unsubscribe, whichever comes first.

Optional questions. The four questions on the waitlist are optional. If you answer, your answers are saved with your email address and used only to decide what to build next. Leave them blank and nothing is saved. Ask us to delete them at any time.

Emailing us. If you email hello@liftrung.com, we keep your message and our reply to answer you. The legal basis is answering your request. Please do not include health details. Messages are kept for 24 months after the conversation is closed.

Where your data goes. Cloudflare hosts this site, runs Turnstile and forwards email sent to hello@liftrung.com. It runs a global network that includes the United States; Cloudflare states on its public GDPR page that it relies on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework for such transfers. Brevo (France, EU) stores the waitlist and sends its emails. PostHog (EU cloud, Frankfurt) handles the analytics described above. We are based in Israel, which has an EU adequacy decision (2011, reaffirmed in January 2024).

Your rights. You can ask for access to your data, correction, deletion, restriction of use, a copy you can move elsewhere (portability), or object to how we use it, and you can withdraw consent at any time. Write to hello@liftrung.com; we reply within one month. You can also complain to a data protection authority: the Irish Data Protection Commission (dataprotection.ie), the Danish Datatilsynet (datatilsynet.dk), the authority in your own country, or in Israel the Privacy Protection Authority.

Last updated: October 12, 2026

The operator of Liftrung is the controller of your data. This document describes what the Liftrung app and its server actually do, checked against the app's own source code rather than against a plan for what it might do later. Where a capability exists in code but nothing in the app can reach it yet, that is stated plainly rather than left out or implied to be live.

Not all services are live yet: Liftrung is not yet on the App Store. Account and AI services, purchase restoration, vendor retention and complete deletion are described below as they are designed to work, and this policy is not a statement that any of them is publicly available today.

Questions about this policy or your data: hello@liftrung.com. This address is monitored.

The short version

The iOS app requires an account sign-in before first use and offers Sign in with Apple, Sign in with Google, and email-code sign-in. The app is not yet publicly released, and sign-in will not be available to the public until it is. When an account service is configured, it verifies your provider identity and creates an internal account and session. The current sign-in routes do not upload your profile, bodyweight, XP, streak, best lifts or friends.

The current app stores training, food, measurements and routines locally. It does not automatically upload your complete training or food history. Individual features, exports and sharing can send the information described below. These distinctions matter: a local food diary does not mean a photo you deliberately send for AI identification stays on the device.

A few individual features send one specific piece of information to a named outside service, and only when you use that specific feature. Every one of them is listed below. Nothing here is sold, and nothing here is used for advertising — Liftrung has no advertising code of any kind.

Your account

The iOS app requires an account sign-in before first use and offers Sign in with Apple, Sign in with Google, and email-code sign-in. The app is not yet publicly released. Apple may provide an email address and name when you authorize sign-in. Hide My Email can provide a relay address instead of your personal email address.

The current server authentication path stores an internal account ID and a provider/subject identity mapping. A verified email is returned in the auth response; provider identity mappings do not persist the profile fields listed in earlier versions of this document. For email-code sign-in, the normalized email address is stored with the account mapping. The one-time code is sent through the configured Resend adapter, while the server stores only an HMAC digest of the code, never the plaintext code. Email challenges expire after 10 minutes and allow five verification attempts. A scheduled backend cleanup removes expired or consumed challenges and throttle rows after their one-hour window and, for email throttles, after the resend cooldown has also elapsed; cleanup is best-effort and depends on the configured database and Worker schedule. Account deletion also removes challenges associated with that account. The AI allowance also uses account identity, home timezone and the date an allowance was consumed. Session and access records support authentication, revocation and limits.

If another user reported the account, the report keeps its username snapshot for 90 days after account deletion and then replaces that snapshot with [erased].

Deleting your account

Settings has a "Delete account" action. When a server session is available, the app sends an authenticated deletion request. The server is designed to erase the account and revoke its sessions. Revocation of the Apple or Google sign-in grant is attempted when the required provider credential is available; it is not guaranteed by simply tapping the button.

Deletion is not yet available to the public. Deleting a Liftrung account does not erase records held separately by RevenueCat, PostHog, email providers or provider backups. Contact us to request confirmation of these separate steps. Local records, exported files and copies on other devices also require separate handling.

Deleting your account is separate from cancelling a paid subscription: purchases go through Apple or Google, not Liftrung directly, so deleting your account does not automatically cancel a subscription, and cancelling a subscription does not delete your account.

Moderation bans and reports

We review every report within 48 hours. The reporter receives an in-app notice after the report has been reviewed; the notice does not disclose the outcome.

If an account is banned, Liftrung canonicalises an email for matching by lower-casing it and, for Gmail, folding dots and +alias suffixes (and treating googlemail.com as gmail.com). The server stores only a keyed hash, not the canonical email or provider subject. Ban hashes expire after 24 months from ban time. This value is defined by the server's ban_hash_retention_months() constant and mirrored by Worker BAN_HASH_RETENTION_MONTHS; an expired hash no longer blocks sign-in and is deleted by the scheduled sweep.

A banned user can still request account erasure. Their account, sign-in identities and owned content are hard-deleted; the keyed ban hashes remain only until their expiry. Moderation cases and actions identify the reported account by user UUID or case id, not by a plaintext username. A separate username snapshot may be used for moderator display. Ninety days after that reported account is erased, the server redacts the snapshot, report text and moderator action note while retaining the audit linkage.

Training history, food records, measurements, saved routines and recorded run routes are stored locally in the current app. The app does not currently call the server training-archive upload described below. CloudKit sync is not included.

An export or share action can create a copy outside the app. Copies you send to another application and device backups have their own storage and deletion behavior. Sending a food image or phrase for AI processing is a separate action from storing an ordinary food entry.

For Social workouts, users aged 16 and over have a separate “Muscles and levels” switch that controls whether the workout headline also includes which muscle groups they trained and their gem level for each. It is on when they join Social, and the join screen tells them so; they can turn it off at any time in Social & privacy. Users aged 13–15 cannot turn it on and do not send those details. When it is on, the muscle and level details have the same audience as that workout. Turning it off stops those details being sent with future workouts; details already attached to a past post remain until that workout or the account is deleted. Our stricter reading treats these details as health-related; we have not had this reading confirmed by a lawyer.

Apple Health and Motion & Fitness

Apple Health and Motion & Fitness access depends on the permissions you choose. Health data read by Liftrung is used for local fitness features; it is not an intended input to Liftrung analytics, AI food or server account data. The app's event and food-request payloads exclude those health values.

With the relevant write permission, Liftrung can save an app-recorded run and its route to Apple Health. You can change permissions in iPhone Settings. Your own export and share actions are separate from automatic analytics.

What does leave your phone, feature by feature

Every network destination the app can reach. Nothing here happens unless you use the specific feature it belongs to.

Signing in — Apple, Google, or email code

The app offers sign-in with Apple, sign-in with Google, and email-code sign-in, each of which verifies an identity before creating the account described above. The app is not yet publicly released.

When you use the email-code option, the email address you enter is normalized and sent to the Liftrung server. The server stores that normalized address for the account mapping and sends a six-digit, ten-minute code through the configured Resend email delivery service. The code is never stored in plaintext; only an HMAC digest is stored. IP and email throttle keys are also HMAC digests. The app contains this server path; it will not be available to the public before launch. Resend-held copies and retention are governed by Resend's service terms, not by this policy.

Your training log — built, not confirmed reachable yet

Liftrung's server has a feature designed to hold a backup copy of your full training log (sessions, sets, routines) as one compressed file per account, gated by a strict allow-list that rejects anything not explicitly permitted — including a rejection, by name, of food logs, custom foods, body measurements beyond current weight, HealthKit-derived fields, and past weigh-ins. As of this writing, we could not find any place in the app that actually calls this upload. If and when it is turned on for real users, it will work exactly as described here — and this document will be updated with confirmation, not a promise, before that happens.

Barcode scanning → Open Food Facts

Scanning a barcode Liftrung doesn't already have in its bundled database sends the barcode number only to Open Food Facts (world.openfoodfacts.org), a volunteer-run public food database, to look up the product. No account identifier and no other data travels with that request.

AI food photo, and the typed-phrase fallback → Google Gemini

Liftrung has code for two features that can send what you photographed or typed to Google's Gemini API (generativelanguage.googleapis.com) so it can describe the food for you: a camera button in food logging, and a fallback for a typed food description the app's own local parser can't confidently read. Neither sends your other food entries, your workouts, or any health data — only the one photo or the one typed phrase for that single entry.

The app sends these requests through an authenticated Liftrung service, which calls Google Gemini. You do not enter a personal API key. The service checks account identity, subscription access and a shared free allowance for photo and typed-description requests. These requests therefore involve both the individual food input and account/access metadata.

This service is not live yet. We will update this policy before launch with the provider's retention terms. Until then this policy does not promise a photo-deletion deadline. Manual food logging remains separate from using AI assistance.

A third Gemini surface — a training-summary reviewer, currently unused

Liftrung's code also contains a feature that would send your exercise names, sets/reps/weight, muscle groups, and calculated best lift to Google's Gemini API for a written training review. As of this writing, nothing in the app calls it — it is fully built and tested code with no button, screen, or trigger that reaches it. It never sends anything HealthKit-derived, by the same structural rule described above. This document will be updated before this feature is ever turned on for anyone.

Purchases → RevenueCat

When configured, RevenueCat handles subscription products, purchase state and entitlements. The app links RevenueCat to a provider-qualified Liftrung sign-in identifier so access can be associated with the account. Apple processes App Store payments; Liftrung does not collect card details.

Purchases are not live yet: RevenueCat is currently set up with a test store, not the App Store. We will update this policy before paid subscriptions open. RevenueCat also has an EU PostHog integration for subscription events.

Product analytics → PostHog

PostHog analytics are enabled only in builds configured with a PostHog project key, and are hosted in the EU. There is no user-facing switch for this build-level setting. When enabled, analytics help us understand which parts of the app people actually use — for example, whether someone finished their first workout. This is tied to your account's sign-in identity so we can measure things like return visits, but it is configured to specifically NOT record your screen, your taps, or a video-like replay of your session, and the list of things it is allowed to record is fixed in code to exclude any set, rep, weight, food entry, or HealthKit-derived value — those simply have no field in what gets sent. Automatic app lifecycle events also include app/device metadata. The EU project has been observed deriving approximate location from the network IP address; this is separate from a recorded GPS route.

If you use "Report a problem", analytics receives bounded event metadata. Your written description stays in a visible pre-filled email, which you can review before sending. Opening that email does not send it. Do not include health or personal details that are unnecessary to explain the problem.

Crash and freeze reports

iOS MetricKit can produce technical diagnostic reports. Liftrung keeps a local copy for troubleshooting. A later launch or foreground flush can attempt server upload when both a crash endpoint and bearer token are configured; upload is not guaranteed at the moment of a crash. This version has no configured crash endpoint, so that upload is not active.

The implemented server route stores the authenticated account identifier, report kind, build number, capture time and MetricKit JSON. Its configured storage lifetime is 30 days. These reports are technical diagnostics, not an intentional upload of your training log or food diary. Local copies and vendor-held diagnostics are separate storage locations.

Separately, if you've turned on Apple's own system-wide "Share With App Developers" setting on your phone, Apple sends crash reports directly to us through Apple's own infrastructure — that setting is yours to control in iOS, not something Liftrung's code decides.

Optional music panel → Apple Music or Spotify

Liftrung can show what's playing and let you skip a track while you train, but this whole panel is off by default. If you turn it on and choose Apple Music, Liftrung reads the current track and controls play/pause/skip through Apple's own MusicKit — nothing about your training, food, or health data is involved. Choosing Spotify is built but not active in this build: the app has not been registered with Spotify, so nothing happens when you pick it — no browser opens, no request is sent.

Neither music option shares any fitness or health data with the music service.

Location

Liftrung uses your location only while you are actively recording a run, to measure distance, pace, and route. The route stays on your device. It is never sent anywhere automatically. If you use the app's own share button to send a run to another app, that is your choice at that moment, exactly like sharing a photo — it is not something Liftrung does on its own.

Data sources and licenses

Some of Liftrung's food and exercise information comes from outside sources, credited in the app under Settings → Data sources: USDA FoodData Central (public domain), Open Food Facts (Open Database License), and the free-exercise-db project (public domain, Unlicense). This is a licensing credit, not a privacy disclosure — none of these sources receive information about you, except for the barcode number described above.

Website and waitlist

If you join the Liftrung waitlist on liftrung.com, we store your email address, which list you joined, the page language, the date you agreed, and any optional answers you give, and use them to email you when Liftrung is available. We keep waitlist emails until 12 months after the launch email, and never more than 24 months after you joined, or until you unsubscribe, whichever comes first. You can withdraw consent at any time by unsubscribing or writing to hello@liftrung.com. Emails to support are kept for 24 months after the conversation is closed. The privacy page on liftrung.com describes the website in full, including its analytics and where its data goes.

Your rights

You can ask for access to your data, correction, deletion, restriction of use, a portable copy, or object to how it is used, and you can withdraw consent at any time. We reply within one month. You can complain to the Irish Data Protection Commission, the Danish Datatilsynet, or the data protection authority in your own country.

Use the app's available editing and export controls to manage local records. For help accessing, correcting or deleting account data, analytics, purchase records or support correspondence, contact hello@liftrung.com. Say which storage location or service your request concerns; deleting a local entry does not automatically remove separately held copies.

Retention periods for launch services, vendor erasure and backup expiry will be added to this policy before those services open. Until then this policy does not promise a retention or erasure period beyond the ones stated in it.

Liftrung is for people aged 13 and over. People under 13 cannot use Liftrung. If the app does not yet have a birth date, Social asks for it using the existing on-device age step. The birth date stays on the device and in the user's backup; Social sends the server only a self-attested young_teen (ages 13–15), teen (ages 16–17), or adult age band.

For ages 13–17, the Social profile is always private: follow requests require approval. Adults who do not follow a teen cannot search for or follow that teen, react to the teen's activities, or see the teen's workouts. Users under 18 never appear on global, following, or segment leaderboards shown to another user. They can still view those boards and see their own rank among the entries visible to them privately. A teen-created public segment is visible only to its creator, including against approved followers. Existing accepted follows continue to show the teen's activities and profile statistics. Teen-to-teen use and a teen's interaction with adults they follow are unchanged. Safety reports to moderation remain available.

Users under 16 may use Liftrung only with a parent's or guardian's permission. Because users under 13 cannot use Liftrung, this applies in practice to ages 13–15. Liftrung does not verify the parent or guardian, capture their permission, or create a guardian-linked account; a parental-consent flow is not part of the app. We have not had the legal reading behind this requirement confirmed by a lawyer.

Heart-rate data may be used on the device, but it never leaves the device for any user and is never included in a shared image, Social post, leaderboard, or other output seen by another user. Users aged 13–15 also never send muscle groups or gem levels. Users aged 16–17 may share muscles and levels with followers they approve. The under-16 age rule is an additional fail-closed guard, including when the user's age is unknown.

Liftrung is launching in Ireland and Denmark. Social starts at 13 with the limits above, users under 16 need a parent's or guardian's permission, all users under 18 stay off public boards, and users under 16 share neither heart rate nor muscles/levels.

We have not had the parental-permission and minor-data legal readings confirmed by a lawyer. This policy records the product's protections and does not claim that they resolve every legal requirement.

Changes to this policy

If what Liftrung actually does changes — a new feature that sends data somewhere new, a currently-unreachable feature described above becoming reachable, or a change to who receives data — this document will be updated, and the "Last updated" date at the top will change. We will not silently remove a description of something the app used to do without saying so.

Contact

hello@liftrung.com