Privacy policy

Summary

Apex Metric is operated by [Company legal name], [City, State/Province, Country] ("we", "us"). We are the controller of the personal data described here.

Data stored only on your device

Most of what you enter stays on your phone, in the app's database. iOS encrypts it with keys tied to your passcode, and photos and exported files use iOS's strongest file protection (unreadable while your phone is locked). We cannot access this data. It includes:

• Your training plan, workouts, sets, weights, reps, records and notes.
• Body measurements and body-composition results you enter, scan or import.
• Meals, nutrition, water and supplements.
• Progress photos and food photos.
• Setup answers such as goal, schedule, experience, sex for body calculations, gender, birth year, pronouns, diet and allergies.
• If you turn on Start at my gym: your gym's name and location. iOS tells the app when you arrive there; your location is never tracked, kept as a history or sent to us.

Deleting the app deletes this data from your phone.

Apple Health and Health Connect

If you allow it, Apex Metric reads from Apple Health (and, on Android, Health Connect) your body weight, body composition, workouts, heart rate, heart-rate variability, resting heart rate, sleep, active energy and distances, and writes your strength workouts, body weight and water.

Health data is used only to provide features inside the app, such as your plan, recovery check and progress. It is never sent to our servers, never stored in iCloud by us, never used for advertising and never shared with anyone. You can change these permissions anytime in the Health app (Sharing › Apps) or in Health Connect.

Encrypted iCloud backup

Apex Metric backs up your plan, settings and workouts to the private iCloud database of your Apple ID, so you can restore them on a new phone. The backup is encrypted on your phone with a key kept in your iCloud Keychain, so neither Apple nor we can read it. Health and body data is not included. You can delete the backup in iOS Settings › your name › iCloud › Manage Account Storage › Apex Metric.

Community features (optional)

If you create a community account, we store the following on our servers (provided by Supabase, hosted in the United States):

Photos are stripped of location and camera details before upload. Access is enforced by the database itself, so private and crew content cannot be read by anyone outside its audience. Notifications never contain health data.

Apex Coach (AI answers)

Simple questions (muscles, rest, breathing) are answered on your phone. For other questions, Apex sends the following to our server, which passes it to our AI provider to write the answer:

• Your question and the last few questions and answers of the same chat.
• The exercise: its name, equipment, muscles, how-to steps and the alternatives available.
• Today's sets and your last session for that exercise (weight and reps), your unit, goal, level, equipment and any injuries or limits you chose in the app, so the answer is safe for you.
• A random device code (not linked to your name or account) used only to apply the daily question limit.

No Apple Health data, body measurements, nutrition, photos, name or email are sent. We don't store your questions or answers; our server only counts how many questions a device asked today. Our AI provider processes the request to return the answer, doesn't use it to train its models, and may keep it for a limited time for safety and abuse monitoring under its own terms. Answers are general fitness guidance, not medical advice.

Foods, recipes and hotel gyms you share

If you choose to share a food (its label values, brand, barcode and optional photo), a recipe, or what a hotel gym has (equipment, heaviest dumbbell, hours, notes and an optional photo of the gym), it is stored on our servers and anyone using Apex can see it, even without an account. Your name is not shown next to it. For hotel gyms we store the hotel's name, address and map position — never your trip dates or your location. Sharing requires a community account so we can remove abuse; three reports hide an item until we review it. You can delete what you shared at any time.

Your food diary itself is never shared: it stays on your phone.

Service providers

We use a small number of providers who process data on our behalf, only to run the app:

• Apple: Sign in with Apple, App Store purchases, push notifications, iCloud backup, Apple Health.
• Supabase: community database, sign-in and photo storage (United States).
• Resend: sends your sign-in codes and our moderation alerts by email.
• Google: Google Play purchases, Firebase Cloud Messaging for Android notifications, and Sign in with Google if you choose it.
• Open Food Facts: when you scan a barcode, only the barcode number is sent to look up the product. No personal data.
• Food databases (USDA FoodData Central, FatSecret): when you search for a food, only the search words are sent, through our server. No personal data.
• Anthropic (or another AI provider we may switch to, listed here): writes Apex Coach answers from the details described above.

Purchases are handled by Apple or Google. We never see your payment card details.

How we use data and our legal bases

• To provide the app (performance of our contract with you): plans, workouts, backup, community.
• Health data is processed only with your explicit consent, which you can withdraw in the Health app at any time.
• Safety and moderation (legitimate interest): handling reports, blocking abuse.
• Legal obligations: responding to lawful requests and protecting minors.

We do not use your data for advertising, profiling or automated decisions with legal effects.

How long we keep data

• Device data: until you delete it or the app.
• iCloud backup: until you delete it in iCloud settings.
• Community data: until you delete your account, then removed from our servers immediately; server backups roll off within 30 days.
• Reports: up to 12 months, or longer if needed for a legal claim.

Your rights

Depending on where you live (including the EU and UK under the GDPR, Brazil under the LGPD, and California under the CCPA/CPRA), you can access, correct, export, delete or restrict your personal data, and object to processing. Most of this you can do yourself in the app: edit your profile, export your data in Settings › Backup & your data, and delete your account in Profile › Edit profile.

For anything else, email us. We reply within 30 days. You can also complain to your local data protection authority.

We do not sell or share personal information as those terms are defined under California law.

Children

Apex Metric is not directed at children under 13, and community features require you to be at least 16. We do not knowingly collect data from children. If you believe a child has created a community account, contact us and we will delete it.

Security

Data is encrypted in transit (HTTPS) and at rest. Community data is protected by row-level security in the database, community accounts are private by default, and sign-in uses Apple, Google or one-time email codes instead of passwords. No method is perfect, but we design every feature to collect as little as possible.

International transfers

Our community servers are in the United States. When we transfer personal data from the EU, UK or Brazil, we rely on our providers' standard contractual clauses or equivalent safeguards.

Changes and contact

We will post any changes on this page and update the date at the top. For important changes we will also tell you in the app.

[Company legal name], [City, State/Province, Country].