Privacy Policy
Last updated: 3 November 2026
This policy explains what personal data Ironwork (the iPhone app and the web app at ironwork.fit) collects, why, who processes it, how long it is kept and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR) and Apple's App Store rules.
In short
•
You can use Ironwork without an account. Then everything stays on your device.
•
With an account, your training data is stored on our servers in the EU (Ireland) so it syncs between your devices and, if you choose, reaches your coach.
•
Apple Health data leaves your device only if you turn on reading Apple Health while signed in, and only the daily values listed below.
•
Friends are two people who both said yes. A friend sees your workouts and records, and in a challenge you joined how many sessions you did, never your body data, Apple Health, check-ins, messages or the time of day; you choose per friend, and can hide a workout, remove or block a friend without them being told.
•
No ads, no tracking cookies, no selling of data. The app uses no third-party analytics; the website counts page visits with Cloudflare Web Analytics, without cookies. Apple Health data is never used for advertising or marketing.
•
With an account, Ironwork records which features you use, in its own database, to improve the app. You can turn this off in Profile → Privacy → Usage Data.
•
You can export your data and delete your account from the app at any time.
Who is responsible
The controller of your personal data is Federico Giaj Levra, Italy ("we", "us"). Contact: [email protected].
What we collect and why
Your account
•
Email address and password, when you create an account. The password is stored only as a secure hash by our authentication provider; we never see it.
•
If you use Sign in with Apple: an identifier from Apple, and the name and email address you choose to share (this can be an Apple private relay address).
•
Sign-in records: when your account was created and last used. Our provider also logs the IP address and device type of sign-in requests to protect accounts against abuse.
•
Emails we send you: account confirmation and similar account emails, sent from [email protected] through our email provider.
Why: to give you an account that works on all your devices. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); keeping security logs is our legitimate interest in protecting the service (Art. 6(1)(f)).
Your profile
•
Display name, whether you train, coach or both, and your units (kg or lb).
Why: to show your name to a coach or client you connect with and to set up the app for you. Legal basis: contract (Art. 6(1)(b)).
Your age
•
That you confirmed you are 18 or older, and when. We do not ask for your date of birth to create an account.
Why: Ironwork accounts are for adults. Legal basis: contract (Art. 6(1)(b)).
Your training
•
Workouts: title, notes, start and end time, the exercises in order, supersets and exercise notes, and every set (type, weight, reps, effort, time, distance, done or not).
•
Routines and folders you create, including targets per set and rest times.
•
Custom exercises you create.
•
Personal records and workout totals, which our server works out from your workouts.
•
Imports: when you import a Hevy or Strong export, the file is read on your device; the workouts in it become part of your history like any other workout.
Why: to keep your training history, sync it between devices and the web, and show your progress. Legal basis: contract (Art. 6(1)(b)).
Body weight
You can log your body weight, or have it filled in from Apple Health. Your body weight says something about your health, so we treat it the same way whichever route it comes by: we process it only with your explicit consent, which you give by logging it and, for a coach, by turning on Body Weight in Profile → Privacy (GDPR Art. 9(2)(a) and Art. 6(1)(a)). A coach sees it as a day and a value, only while they coach you, and it is off until you turn it on. You withdraw your consent by deleting your weigh-ins or turning the switch off.
Apple Health
On iPhone, Ironwork asks Apple Health for permission when a feature first needs it: when you save your first workout, and when you turn on the upload described below. Apple asks for your permission for each type of data and, on recent versions of iOS, whether Ironwork may read your full history or only a recent window; you can change both at any time in Settings or the Health app.
•
Saving workouts to Apple Health: when you finish a workout, Ironwork writes it to Apple Health on your device as a strength-training session with its time and an energy estimate. Nothing is uploaded for this.
•
Reading from Apple Health: Ironwork reads daily steps, active energy, resting energy, dietary energy (what other apps you use record as eaten; Ironwork never asks for food data itself), resting heart rate, heart rate variability, VO2 max, sleep (minutes asleep, when you fell asleep and woke up), body weight, body-fat percentage and height. Your latest body weight is used on the device for workout calculations; with energy burned and eaten, weight, body fat and height let Ironwork show your body trends, such as an estimate of what you eat from how your weight moves.
•
What is uploaded: nothing, unless you turn on Upload to Account in Profile → Privacy → Apple Health while signed in. Ironwork first explains what it will upload and asks you to agree. If you agree, it uploads one row per day with the values above to your account: your full history, from the first day Apple Health lets Ironwork read (only the recent window, if that is what you allowed Apple Health to share), and then each new or changed day, which Ironwork uploads by itself while the upload is on, also in the background when Apple Health reports new data. If you agreed when the upload covered only the last 7 days, Ironwork keeps uploading only those 7 days until you agree to the full history in Profile → Apple Health. Nothing more is uploaded once you turn the upload off, and you can then also delete the values already uploaded.
Why: so you can see these values across devices and, only if you choose, share them with your coach. Health data is a special category of personal data; we process it only with your explicit consent (GDPR Art. 9(2)(a) and Art. 6(1)(a)), which you can withdraw at any time by turning the upload off.
Apple Health data is never used for advertising, marketing or data mining, never sold, and never shared with anyone except a coach you choose to share it with. We do not store Apple Health data in iCloud.
Coaches and clients
•
Invite codes: a coach creates a code and gives it to a client. When the client enters it, the app shows the coach's name and what they will see, and the two accounts are connected only when the client taps Start Coaching.
•
What a coach sees: only what you choose, per coach, in Profile → Privacy. By default a coach sees workouts from programs they assigned or routines they sent, and workouts they logged or took part in; check-ins you send; and messages. Everything else is off until you turn it on: your other workouts, workouts from before coaching (and how far back), body weight, measurements, progress photos, and Apple Health sleep, heart rate and steps. Resting and dietary energy, body fat and height are for your own view and are not shared with a coach. The coach also sees your display name.
•
When a workout reaches a coach: you choose per coach: right away, at the end of the day (the default) or once a week. Share Now sends one workout early, and sending a check-in sends that week's held workouts from that coach's programs. Workouts a coach logged or took part in reach them straight away.
•
No time of day: a coach sees the day and the duration of a workout, never when it started or finished, and the day of a weigh-in or measurement. Sets, workout comments, progress photo sets and sleep have no time of day for a coach either. Messages and check-ins you send do show when you sent them, and a session the coach booked keeps its booked time.
•
What is computed for a coach: their charts, totals, week view and best sets come only from the workouts they can see. They are not your lifetime records.
•
If you narrow or refuse: turning something off applies at once, including to what was already shared. The coach is not told, and nothing in the app shows them what you chose.
•
What a coach adds: routines written into the client's library, comments on the client's workouts (which the client can reply to), and private notes that only the coach can see.
•
Private notes: a coach's notes about a client are written and kept by the coach, and the client does not see them in the app. They stay with the coach after coaching ends, until the coach deletes them or their account. The End Coaching alert tells you this. Notes are not part of your export; if you ask for everything we hold about you, write to [email protected] and we include them.
•
Workouts a coach logs for you: only if you switch on Let Your Coach Log Workouts for You in Profile → Privacy (off by default). A coach training with you can then record the session on their phone; it is saved to your account as your workout, shows who logged it, and you can delete it like any other. The coach can add a note you see with the workout and a private note only they see. Once the session is finished the coach can no longer change or delete it.
•
When coaching ends: either of you can end it; a client ends it in the app, and blocking ends it for either. The coach then sees nothing more of your data and their access to your photos, 1RMs and booking notes ends. What a former coach keeps: their private notes, the conversation (see Messages), and the dates of sessions they booked.
•
Dates of coaching: we keep when each coaching period started and ended, for the coach's billing. If a client deletes their account, the dates stay with the coach without the client's identity. If a coach deletes theirs, the dates go with it.
•
Report and Block: you can report or block a coach or client from the app. A report goes to our support inbox with both account identifiers, your reason and any details you add; support may reply by email. We keep it for as long as we need it to handle the report, and it loses the link to an account that is deleted. A block ends coaching and stops messages and invites both ways; the other person sees an ordinary ending, never that they were blocked. Who you blocked is kept until you unblock them or delete your account. Legal basis: our legitimate interest in keeping people safe and the service free of abuse (Art. 6(1)(f)).
•
Reminders: Home tells you who sees your data every 90 days while you have a coach.
Why: to provide the coaching features you asked for. Legal basis: contract (Art. 6(1)(b)); for Apple Health data, your consent (Art. 9(2)(a)).
Check-ins
A coach can ask you a few questions on a day of the week, for example hours of sleep, soreness from 1 to 5, your body weight and a note in your own words. When a check-in is due, Ironwork shows it on Home; you answer the questions you want to and send it, or skip the week.
•
What is stored: the coach's questions and the day; for each check-in you send, the date, your answers and the wording of each question as it was asked. If you skip a week, we store that for you; your coach does not see it. The body weight question is filled in from your latest weigh-in or from an Apple Health day you chose to upload, and you can change it before sending.
•
Who sees it: only the coach who asked, and only while they coach you. Other coaches, including another coach of yours, never see it. When coaching ends, the coach can no longer see your answers; you still can.
•
Reminder: on iPhone you can turn on a reminder for the day a check-in is due. It is a notification your iPhone schedules on its own; nothing about it is sent to us.
Why: so your coach can follow how you recover between sessions. Your answers can say something about your health (sleep, soreness, weight, an injury in a note), so we process them only with your explicit consent, which you give by sending a check-in after the app has told you who sees it (GDPR Art. 9(2)(a) and Art. 6(1)(a)). Every question is optional. You withdraw your consent by skipping check-ins or ending the coaching; to have past answers deleted without deleting your account, write to [email protected].
Progress photos
You can take progress photos (front, side and back) and compare them over time, with or without a coach. A coach can ask for photos in a check-in; sending them is always your choice.
•
What is stored: each photo at full size and a smaller copy for the screens, which your phone makes before uploading; the date, the pose, how it was framed (full body or in a mirror) and the outline you fitted to your first photo of a pose. The photos are redrawn on your device before upload, so they carry no location or device data. They are never saved to your photo library, iCloud Photos or Apple Health.
•
Who sees them: you. A coach sees only the sets you share with them, the smaller copy only, and only while they coach you; you can stop sharing any set at any time and it is gone for them at once. Ending the coaching removes their access to every photo. Other coaches, including another coach of yours, never see them. Ironwork staff and support never open them.
•
Where they are: in a private storage area of our database provider, behind the same access rules as your check-ins, reached only through links that expire within 15 minutes; a link already issued works until then.
•
Reminder: on iPhone you can turn on one reminder for photos and measurements, every two weeks. It is off unless you turn it on, and your iPhone schedules it on its own; nothing about it is sent to us.
Why: so you can see changes the scale does not show, and so your coach can follow them if you want. Photos of your body can say something about your health, so we process them only with your explicit consent, which you give by taking them and, for a coach, by sharing a set (GDPR Art. 9(2)(a) and Art. 6(1)(a)). You can delete one set or all of them in Profile › Progress Photos; deleting is permanent.
Body measurements
You can log tape measurements (for example waist, chest, hips, arms and thighs, the arms and legs right and left) with an optional note, and see how each changes. A coach can ask for one in a check-in.
•
What is stored: the date, each value in centimetres, the note and where it came from (logged by you, or a check-in answer). On iPhone, a waist value you log is also saved to Apple Health, after you allow it the first time; Ironwork reads your waist and body fat from Apple Health to show them with your measurements.
•
Who sees them: you. A coach sees your measurements only while they coach you and only if you turn on Measurements in Profile → Privacy (off unless you turn it on); a measurement you send in a check-in is part of that check-in. Coaching again after it ended starts with the switch off.
Why: so you can follow changes the scale does not show. Measurements can say something about your health, so we process them only with your explicit consent, which you give by logging them and, for a coach, by turning on the switch or sending a check-in (GDPR Art. 9(2)(a) and Art. 6(1)(a)).
Messages with your coach or clients
A coach and each of their clients can write to each other in the app, one conversation per coaching relationship.
•
What is stored: the text of each message, who wrote it and when, and how far each of you has read the conversation (so the app can show unread counts and "Read" under your message).
•
Who sees it: only the two of you. Another coach of yours, or another client of your coach, never sees it. Messages are not end-to-end encrypted: they are stored in our database like the rest of your account, and we look at them only to handle a request you make or when the law requires it. New messages reach the other person's open app through our database provider's live connection; Ironwork sends no push notifications.
•
When coaching ends: the conversation stays readable for both of you and neither can send new messages. If you start coaching together again, it continues.
•
Editing and deleting: a sent message cannot be edited or deleted on its own. If either of you deletes their account, the other keeps their copy of the conversation, with the deleted person shown as Deleted Account and their messages as they were. We keep the copy for the person who stays because it is what they received; it is erased when they delete theirs too.
Why: so you and your coach can talk about your training without leaving Ironwork. Legal basis: contract (Art. 6(1)(b)). What you write may say something about your health, for example an injury; you decide what to write, and we process it only to keep it in the conversation for the two of you (Art. 9(2)(a), your explicit consent, given by sending it). To have a conversation deleted without deleting your account, write to [email protected].
Friends
You can add friends: two people who both said yes see each other's workouts and records. Friends are separate from coaching; a person can be your coach and your friend, and each has its own settings.
•
Invitations: you add a friend by sending them a link from the app. Each link works once and for 7 days. When your friend opens it, the app shows your name and what you will share, and you become friends only when they tap Add. Nobody can find you by name, email or phone number, and there are no public profiles or followers.
•
What a friend sees: your display name; for each workout, its name, the day, how long it took, the exercises and sets, and any record you set; the Strong reactions on it; how many sessions you did this month and your streak in weeks.
•
What a friend never sees: your body weight, measurements, progress photos, Apple Health data, check-ins, messages, workout notes, effort ratings (RPE) or the time of day of a workout.
•
Your choices: in Profile → Friends each friend has a screen with Workouts, Records and Challenges switches, all on when the friendship starts. Turning one off applies at once, also to what was already shared, and the friend is not told. You can hide any workout from all friends (Hide from Friends), and take a friend's workouts out of your own feed (Show in Feed).
•
Strong: you can give a friend's workout one reaction, Strong. Your friends see how many people did; only the workout's owner sees who.
•
Challenges: you can start a challenge with friends who share Challenges with you: Most Sessions, Weekly Streak or Shared Goal, with a name, an end date and, for a Shared Goal, a number of sessions. We keep who started it, who was asked and who joined or left. The people in a challenge see each other's display name and one number, counted from the day each joined: sessions finished, or weeks in which the planned sessions were done. They never see your workouts, weights, plan or times through a challenge. You choose whether to join; Not Now leaves the invitation unanswered. You can leave a challenge while it runs, after which the others no longer see you in it; once it has ended, its results stay as they were.
•
Removing and blocking: removing a friend ends what you share both ways at once, and removes the reactions you gave each other; the other person is not told. We keep a note that the two accounts were friends, so that neither of you sees the other in a challenge you share; it is deleted when either of you deletes their account. Blocking does the same and stops new invitations both ways; the other person sees an ordinary removal, never that they were blocked. Report and Block work as described under Coaches and clients.
Why: to provide the friends features you asked for. Legal basis: contract (Art. 6(1)(b)). Friends never receive health data.
How you use the app (usage data)
With an account, Ironwork records the actions in the app that tell us what works and what does not, so we can decide what to build and fix. The list is fixed, and each item answers a question about the app:
•
which screens you open, and from which screen;
•
where you start a workout from, and workouts you discard;
•
sets you change or delete after logging them, and when you skip or change the rest timer;
•
what you search for in the exercise library and how many results it found (the search text itself, cut to 64 characters, so we can see which exercises are missing), and the filters you use in the library, History and charts;
•
forms and sheets you close without saving, and edits you discard;
•
imports from other apps: started, finished (with counts) or failed;
•
settings you change, including the accent colour and the language, and turning Usage Data back on;
•
turning the Apple Health upload on or off (never the Health values);
•
coaching actions such as inviting a client, joining a coach, changing what you share, sending a message, a routine or a check-in, booking a session (that it happened, never what was written or who it was for);
•
choosing or stopping an active program;
•
onboarding steps, signing in and out (and whether it failed), and exporting your data;
•
on the web, keyboard shortcuts and resizing a split view.
Each event is stored with the time, the screen it happened on (its type, such as "client page", never which client), whether it was the iPhone or the web, the app version and a random number that groups the events of one visit. Events never contain your messages, notes, names, workout contents or Apple Health values. They are not used for advertising, profiling or automated decisions, and nobody else sees them, your coach included.
Without an account: on iPhone the events wait on your device for up to 7 days and are sent only if you sign in; on the web nothing is recorded without an account, and nothing is recorded on the home page's demo.
Why: our legitimate interest in improving Ironwork (Art. 6(1)(f)), limited to the list above. You can object at any time: turn off Profile → Privacy → Usage Data. Recording stops on every device signed in to your account, and the events already recorded are deleted at once.
Exercise animations
Exercise animations are licensed from MoveKit and stored with the rest of your data on Supabase. The app downloads them only while you are signed in, through links that expire after an hour; nobody else receives these requests. Without an account the app shows a still image bundled with it.
The website
The web app on ironwork.fit is hosted by Cloudflare, which processes your IP address and browser information to deliver the pages and to protect the site against attacks. The site sets no cookies. When you use the web app, your session and app data are kept in your browser's local storage, which you can clear at any time.
Website visit counts
The website on ironwork.fit (not the iPhone app) uses Cloudflare Web Analytics to count page visits. For each page view it records the page address (without the part after "?"), the page you came from, your browser, operating system and device type, your country, and how long the page took to load. We see totals, not individual visitors.
According to Cloudflare, Web Analytics uses no cookies or local storage, does not fingerprint visitors by their IP address or browser, does not track people across websites, and does not collect visitors' personal data (Cloudflare Web Analytics; how the data is collected). Cloudflare does this for us as our processor, under the same terms as the hosting.
Why: our legitimate interest in knowing how many people visit the site and where they come from (Art. 6(1)(f)).
Emails to us
When you write to [email protected] or [email protected] we receive your email address and your message, and keep them to answer you and to keep a record of requests about your data.
What stays on your device
Your preferences, plate and bar settings, tab order and the workout in progress are kept on your device. If you use Ironwork without an account, your workouts, routines and custom exercises stay on your device too.
Notifications: the rest timer, and the check-in reminder if you turn it on, use local notifications scheduled on your iPhone. Ironwork does not use push notifications and does not register or store a push token.
What we do not do
•
No advertising, no ad networks.
•
No third-party analytics, crash reporting or tracking tools in the app, and no tracking across other companies' apps or websites. Usage data (above) stays in our own database and is never linked with data from other companies. The website's only analytics are the cookieless visit counts above.
•
We do not sell or rent your personal data, and we do not use it for profiling or automated decisions.
Who processes your data for us
These providers act on our instructions under data processing terms:
•
Supabase (database, authentication and API), hosting our database in the AWS eu-west-1 region (Ireland).
•
Resend (sending account emails). Emails are sent from its EU region (Ireland); its records of sent emails (address, subject, delivery status) are stored in the United States and kept for 30 days.
•
Cloudflare (website hosting, DNS, protection against attacks and website visit counts).
•
Apple (iCloud Mail for [email protected] and [email protected]; Sign in with Apple if you use it; Apple Health stays on your device and under Apple's own terms).
Some of these companies are based in the United States. Where your data is transferred outside the European Economic Area, the transfer is covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework or by its Standard Contractual Clauses.
How long we keep data
•
Account and training data: for as long as you keep your account. When you delete your account, it is erased at once from our database, including Health values, body measurements, coach connections, check-ins, progress photos, your name on messages, comments and notes. What stays with the other person is set out under Messages, Private notes and Dates of coaching. If a coach deletes their account, the check-ins you sent them stay in yours. Our database plan keeps no backups today; if we add them, deleted data will be gone from them within 7 days.
•
Data shared with a coach: a coach sees it only while the relationship is active and only what you choose. Check-ins you sent are kept in your account until you delete it.
•
Progress photos: kept until you delete them or your account; ending the coaching only removes the coach's access. Export My Data includes every photo at full size.
•
Usage data: 24 months from when it reaches us, then deleted automatically each day; at once if you turn Usage Data off or delete your account.
•
Friends: a friendship and what you share with that friend are kept until either of you removes or blocks the other, or deletes their account. The note that two accounts were friends is kept until either of them is deleted. An invitation link that is not used stops working after 7 days.
•
Challenges: kept while they run and for 12 months after they end, then deleted automatically each day. Deleting your account removes you from every challenge at once.
•
Messages: for as long as either person keeps their account. Deleting your account removes your name from the conversation; the other person keeps their copy. Ending the coaching keeps the conversation readable for both of you.
•
Website visit counts: Cloudflare keeps each page view for 7 days, then only an aggregated sample.
•
Logs at our providers: request logs at our database provider, which include IP addresses, are kept for 1 day; records of sent emails for 30 days.
•
Support emails: as long as needed to handle your request, and records of data requests for up to 3 years so we can show how they were handled.
•
On your device: until you sign out (Ironwork then removes your account's data from the device), delete the app, or clear your browser's storage.
Your rights
Under the GDPR you have the right to access your data, to receive it in a portable format, to have it corrected or erased, to restrict or object to processing, and to withdraw consent at any time (this does not affect processing that happened before).
•
Export: Profile → Privacy → Export Data gives you a file (JSON) with everything stored in your account.
•
Correct: edit or delete workouts, routines, custom exercises and your profile in the app.
•
Delete: Profile → Privacy → Delete Account erases your account and its data at once, except what stays with the other person as set out above.
•
Apple Health: turn Upload to Your Account off in Profile → Privacy → Apple Health and choose to delete uploaded values; change or revoke access in Settings or the Health app.
•
Coach sharing: change it per coach in Profile → Privacy; end it there or in Profile → Coach.
•
Report and Block: on a coach's screen in Profile → Privacy, in a conversation, or on a client's page. Unblock in Profile → Privacy → Blocked.
•
Check-ins: every answer is optional and you can skip any week; your export includes every check-in you sent.
•
Messages: your export includes every conversation, both sides; to delete one without deleting your account, write to us.
•
Usage data: your export includes every event recorded; turn off Profile → Privacy → Usage Data to stop recording and delete what was recorded.
•
Friends: change what each friend sees in Profile → Friends; remove, block or report a friend there. Your export includes your friends and what you share with each, the invitations you sent, the workouts you hid, the Strong reactions you gave and the challenges you were asked to or joined.
For anything else, write to [email protected] from the email address of your account. We answer within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Ours is the Garante per la protezione dei dati personali, Italy's data protection authority (garanteprivacy.it).
Children
Ironwork accounts are for people aged 18 and over, and you confirm this when you create an account. Someone under 18 can use Ironwork without an account, with everything kept on their device. We do not knowingly keep accounts of people under 18: if you tell us in the app, you can export your data and delete the account, and your workouts stay on your device; if you believe someone under 18 has an account, write to us and we will delete it.
Security
Data is encrypted in transit (HTTPS) and at rest at our database provider. Database access rules make sure each account can read only its own data and what others have chosen to share with it.
Changes
If we change this policy we will update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app before it takes effect.