Privacy at LIFT

LIFT is a general-wellness and exercise-planning tool for adults 18 and older. It provides educational workout guidance generated by versioned rules informed by published exercise research. LIFT does not provide medical advice, diagnosis, treatment, rehabilitation, medical clearance, or emergency monitoring, and it cannot determine whether exercise is safe or appropriate for you. If you have a medical condition, injury, are pregnant or postpartum, or have symptoms or concerns, consult an appropriately qualified healthcare professional before exercising. Stop exercising and contact local emergency services for chest pain or pressure, fainting, severe or unusual shortness of breath, new confusion, or another possible emergency. Plans and load estimates are estimates; results and injury prevention are not guaranteed.

This notice describes data handled by the LIFT pilot website, installable PWA, native iOS client, and separately authorized Apple Watch companion. The LIFT pilot team operates the service. Authenticated participants can submit privacy questions or requests through in-app Support.

In-app Support is the primary contact for privacy questions and requires sign-in. Any additional contact details appear below when available.

The current adult-eligibility acknowledgement is lift-adult-eligibility-2026.07.13. LIFT stores the accepted policy version and timestamp rather than asking for a birth date in that acknowledgement.

LIFT handles account identifiers such as user ID and email, eligibility and policy acknowledgements, display name, units, appearance and notification settings, and account permissions. It also handles profile and Training Passport answers such as goals, experience, confidence, schedule, available equipment, training locations, movement preferences and avoidances, and optional height, weight, gender, or limitation information you submit.

Some profile and training data may qualify as consumer-health or sensitive personal data because it can reveal body measurements, limitations, symptoms, goals, fatigue, readiness, or exercise behavior. Do not submit diagnoses, full medical histories, body photos, precise location, contacts, or unrelated sensitive information.

LIFT handles saved workouts, active and completed workout sessions, exercises, sets, repetitions, loads, duration, distance, RPE or RIR, rest timing, workout feedback, substitutions, generated or curated Training Plans, enrollment, progress, metrics, and body-weight entries.

Workout records remain private unless you intentionally use a social publishing feature. A workout post may be visible globally, to as many as five selected active organizations, or only to you. The shared snapshot is limited to meaningful strength, cardio, or hybrid summary fields. Private notes, readiness, profile answers, body measurements, sensor data, and support reports are not made social merely because a workout is published.

LIFT also handles organization memberships and roles, invitations, claims, announcements, event participation and display identity, derived event scores, human-coaching relationships and consent revisions, exact-version plan proposals, contextual feedback, reports, blocks, mutes, and activity-inbox items. Membership alone never grants a human coach access to private workout data.

If you choose Apple Watch & Health features, LIFT requests Apple's permissions to schedule compatible workouts, record workouts, read matching workout summaries, and display available heart rate, distance, pace, and active energy. Supported recordings and optional effort can be saved to Apple Health and Apple Fitness. Permissions and available measurements depend on your device and the feature you choose.

Outdoor tracking, when available and started by you, may use device location to measure distance and record a workout route, including while the screen is locked. LIFT uses workout location only for the recording you start. You can manage Health and location permissions in Apple's settings.

Raw heart-rate samples, GPS points, and routes stay in Apple Health or device-local native displays and do not enter LIFT's servers, logs, analytics, caches, or Community posts. LIFT may sync matching workout identifiers, start and end times, activity type, aggregate results, and phase or lap summaries to provide workout History and eligible Training Plan credit. Saving a workout to Apple Health does not by itself confirm that LIFT has imported it.

Google Places matching and new gym creation are disabled for this release. Creating a Circle does not send a place search to Google or attach a new Google Place ID.

Organizations created in an earlier pilot may retain a historical Google Place ID and gym label so their existing records remain readable. LIFT does not infer, backfill, or use that legacy identifier as proof of ownership. Restoring place matching would require a future reviewed product and privacy release.

An athlete chooses each coaching permission separately and may revoke it independently of organization membership. Summary access, workout-detail access, categorical readiness, plan proposals, and contextual feedback are distinct scopes. Future-program changes and delegated logging remain unavailable unless separately released.

When a coach reads workout details or readiness, LIFT records the relationship, actor, resource kind, time, and access outcome without copying the sensitive content into the audit record. Cross-user coaching data is online-only and is cleared from client memory when access changes, the route closes, the user signs out, or the account changes.

LIFT handles support and bug reports, replies, attachments or context you submit, and operational records needed to respond. Staff access is limited by assigned permissions but is not the same as no human access.

Operational telemetry can include an account user ID, event name, timestamp, feature step, route or source context, request status, latency, and sanitized failure code. Unless an event has been irreversibly aggregated, LIFT describes this as account-linked telemetry—not anonymous or de-identified data.

LIFT uses data to authenticate accounts; provide workout logging and recovery; generate, display, and progress plans; estimate future sets; show history and metrics; operate selected social features; answer support requests; prevent abuse; diagnose failures; and maintain service security.

Custom plan generation is deterministic and does not send plan inputs to an external generative-AI model. LIFT may use genuinely aggregated statistics for product operations, reliability, and pilot evaluation.

LIFT does not sell consumer-health data, use it for targeted or cross-context behavioral advertising, or provide it to train a general-purpose or external AI model.

Operational service providers may process data under LIFT's direction to provide authentication, hosting, databases, security, communications, or support. Internal account-linked operational analytics are not described as anonymous and are limited to operating and improving the pilot.

Data may be disclosed to service providers acting for LIFT, to people you intentionally share social content with, to protect users or the service, to investigate abuse, or when required by a valid legal process. LIFT does not promise that private data is inaccessible to every authorized processor, operator, or legal recipient.

Before public release, the operator must complete and publish a current processor inventory and state-specific consumer-health consent and authorization flows where applicable.

The current application architecture uses Supabase for account authentication, database storage, and related backend services. Supabase sends account confirmation and password-reset emails through Resend, which processes recipient email addresses, authentication message content, and delivery records. Resend normally retains email and log data for 30 days and provider backups for seven days. Deleting a LIFT account does not immediately erase these provider delivery records; early removal of a specific message requires a request to Resend. Email click and open tracking are not configured. LIFT does not include workout records or raw Health data in these authentication emails.

If you email the public support address listed on LIFT's Help page, Google Gmail processes your sender address, message content, and any attachments to deliver and store that correspondence. This support mailbox is separate from in-app Support records. Deleting your LIFT account does not automatically delete emails held in the support mailbox.

Supabase gateway diagnostics include IP addresses, approximate IP-derived location (city, region, and country), and request timing; authenticated requests may be linked to your account. These diagnostics support app functionality and security.

The repository is configured for Netlify application hosting; when the pilot is deployed there, Netlify processes network and request data needed to deliver the website and server routes.

Organization invitations use a code or share link, and coaching invitations are delivered to an existing LIFT account in the app. Organization and coaching invitations and organization-claim decisions are authoritative in Activity. LIFT does not send Community transactional email or provide those recipient addresses to a Community transactional-email service.

If you enable web push notifications, LIFT stores the browser-issued subscription endpoint and sends notification payloads through the browser or operating-system push service identified by that endpoint. Email and push delivery can therefore involve the infrastructure providers configured by Supabase, the browser, or the operating system.

Provider roles, subprocessors, hosting regions, contracts, and production configuration can change. A verified, current production processor list and any legally required category or specific-recipient disclosures remain public-launch blockers.

Supabase/Postgres is the source of truth after successful sync. LIFT may use local browser storage to protect active workout drafts, optimistic set state, and queued completion recovery while your device is offline or refreshing.

Local storage may also retain account-scoped custom-plan drafts, interface preferences, timers, support or bug drafts, and install state. It remains on that browser until the app clears it, you clear site data, or the feature expires it. Shared-device users should use browser and operating-system protections.

The native iPhone app stores workout drafts, pending sync operations, timers, and recovery records in an encrypted local database, with its encryption key held separately in device secure storage. This protects unfinished work across app restarts and temporary loss of connectivity. The Apple Watch app uses protected device storage for downloaded workouts and recording recovery.

If you choose Use location this session for the circadian appearance filter, the browser supplies coordinates to calculate local sunrise and sunset in memory. LIFT does not send those coordinates to its server or retain them in browser storage; they are cleared on reload or when the page closes. The app removes coordinates saved by older pilot builds.

Account records are generally retained while the pilot account is active. Completed workouts and plan history are preserved when a generated plan is archived unless the account is deleted.

Operational organization and sensitive-access audits are ordinarily retained for up to 24 months; resolved claim and invitation metadata for up to 90 days; and deleted-feedback tombstones for up to 30 days. Account deletion takes precedence for account-linked data in LIFT-controlled application stores. Service-provider authentication-email records follow the separate retention described above.

After processing completes, backups capable of restoring LIFT account or application-database records may retain deleted account data for no more than 0 days. LIFT keeps only the non-reversible restore tombstone and minimized deletion record for 30 additional days, then purges both. Separate service-provider operational records follow the retention described below.

LIFT uses authenticated routes, database access policies, least-privilege staff permissions, and conservative service-worker caching. No internet service or storage system can guarantee absolute security. LIFT will evaluate suspected unauthorized disclosures under applicable breach-notification requirements.

You can edit profile details, body-weight entries, notification settings, Training Passport answers, and workout history through the app surfaces that manage those records.

You can leave or mute organizations, withdraw from eligible events, hide event identity, block athletes, revoke coaching scopes or relationships, decline plan proposals, and review sensitive coaching-access history. Leaving an organization removes its audience from prior workout shares without deleting your workout or other audiences.

When account deletion is enabled, you can start it inside Account & privacy after entering the current password. Acceptance is irreversible: LIFT blocks new writes, revokes sessions and installations, deletes profile, wellness, workout, plan, social, support, bug, upload, notification, and LIFT Watch data, and deletes public posts, reactions, and reports rather than anonymizing them.

LIFT retains only request timestamps, policy version, numeric category counts, sanitized status, backup and purge dates, and a non-reversible restore tombstone during the documented backup-safety period. It does not retain the deleted account's email, content, credentials, tokens, device identifiers, or Storage paths in that record.

You may request access, correction, or export through in-app Support before deletion. Support and bug records are included in deletion, and in-app Support is unavailable after your account is removed. If you are testing through TestFlight, use its Send Beta Feedback option for follow-up. Processing failures retry automatically against the same request.

Deleting LIFT-owned Watch state does not delete workouts that Apple Health or Fitness already stores; those records remain under Apple's controls.

LIFT is restricted to adults 18 and older and is not intended to collect children's data. If you believe an ineligible account or another person's data was submitted, contact Support with only the minimum information needed to investigate.

Material changes receive a new effective date or policy version and may require a fresh acknowledgement. This pilot notice does not replace the state-specific notices, consents, authorizations, or appeal procedures that qualified counsel may require before broad public launch.