Liftgeist is a workout, nutrition and bodyweight tracker. This policy explains exactly what it collects, who receives it, how long it is kept, and how to get rid of it. It covers the website at liftgeist.com, the web app at app.liftgeist.com, the web dashboard at web.liftgeist.com, and the Liftgeist apps for iOS, Android and Apple Watch.
The short version. Your training data is yours. We never sell it and never use it for advertising. You can export all of it as a file at any time, free. You can delete your account from inside the app. Guest mode needs no account and never syncs. Purchases go through Apple, so we never see your card. The longer version below names every company that receives anything, because a summary is not a disclosure.
Liftgeist is operated by Luka Jorjoliani, an individual trading as Liftgeist ("we", "us"). We are the data controller for the personal data described here.
Contact: [email protected]. We will provide a postal address on request to anyone exercising a data protection right.
We have not appointed a Data Protection Officer, because we do not meet the criteria in Article 37 of the GDPR. We do not currently have an establishment in the EU or the UK, and we have not appointed representatives there under Article 27. If you are in the EEA or the UK and want to raise something, email us and we will deal with it directly.
If Liftgeist is later operated by a company, the controller named above will change and this policy will be updated with the company name and registered address.
Hide My Email. Sign in with Apple can give us a private relay address instead of your real one, and we then hold only the relay address: it identifies your account, and it is what Settings shows you. Nothing in the app needs the address behind it. Three consequences worth knowing: Apple only delivers mail to a relay address from senders it has on file, so if you sign in with Apple and hide your address, use the Apple button to sign in again rather than the email link; if you switch the relay off in your Apple ID settings we have no other address to try; and because we match a request to an account by its address, a relay user should delete in the app or write to us from the relay address.
A meal photo takes two paths, and both matter:
Both copies are redrawn in your browser before they leave the device, which strips EXIF metadata including any GPS coordinates.
Liftgeist Pro and its free trial are bought in the iPhone app through Apple. Apple processes the payment, so Liftgeist never receives your card details or your Apple ID. The app receives Apple's signed record of the purchase: which product, when it was bought, the price and App Store country, and a transaction number, with the technical values Apple uses to prove the record is genuine. It sends that record to our server with each coach request, so the server can confirm Pro before it answers. The record is not linked to your account in our database. Once it checks out, the server keeps the product and purchase dates in a short-lived cache, so the next few coach messages skip re-checking, and then deletes them. The app also remembers on the device whether Pro is unlocked, so the extra styles work offline.
| What | Why | Legal basis (UK and EU) |
|---|---|---|
| Account and sign-in data | To create your account, sign you in and sync across devices | Performance of a contract |
| Training, body and nutrition data | To provide the tracker itself: logging, charts, PRs, targets | Performance of a contract, and explicit consent for health data (section 4) |
| Meal photo and text sent to AI | To estimate calories and macros because you asked for an estimate | Explicit consent, asked for in the app before anything is first sent (section 6) |
| Coach and program builder inputs | To generate the program or answer you requested | Explicit consent, asked for in the app before anything is first sent (section 6) |
| IP address at the AI endpoints | To stop abuse and enforce a daily limit | Legitimate interests: keeping the service available |
| Analytics on web surfaces | To see which pages and features get used | Consent where required. See section 7 for the current status, stated honestly |
| Apple's record of a Liftgeist Pro purchase | To confirm Pro before the coach answers | Performance of a contract |
| Email about the service | To send sign-in links and essential service notices | Performance of a contract |
Providing your data is not a statutory requirement. If you provide none of it, guest mode still works; an account and cloud sync do not.
Bodyweight, waist measurements, meals, calories, macros, readiness answers and pain reports are health data, and so is everything read from Apple Health with your permission: weigh-ins, daily step counts, active energy, and workouts such as runs and rides (section 14). Under the UK and EU GDPR this is special category data (Article 9), and in Washington, Nevada and Connecticut it is consumer health data under those states' health privacy laws.
We rely on your explicit consent to process it, which you give by entering it. You can withdraw that consent at any time by deleting the data or your account, which stops the processing. Withdrawal does not affect processing that already happened.
Washington and Nevada require a separate document covering this data specifically. It is here: Consumer Health Data Privacy Policy.
Everyone. Not categories, names.
| Company | What it receives | Role |
|---|---|---|
| Supabase | Your email and account record, and your entire synced ledger, held as one row: workouts, sets, bodyweight, meals, meal photo thumbnails, notes, targets and check-ins | Processor (acts on our instructions) |
| Cloudflare | Hosting and the API. Sees request metadata including IP. Briefly stores your IP for the AI rate limit, a short-lived record of your sign-in check (your account identifier and a one-way hash of your email), and caches AI results as described in section 8 | Processor |
| Anthropic | Whatever you submit to an AI feature: meal text and photos, program notes, uploaded plans; for the program and exercise builders your recent training; for targets your age, sex, height and weights; and for the coach a summary of your bodyweight and trend, PRs, recent sessions, nutrition against targets, recent check-in notes, and daily steps, active energy and workouts from Apple Health if you connected it | Processor |
| Apple (App Store) | The purchase itself when you buy Liftgeist Pro or take the free trial, including the payment. Apple returns a signed record of the purchase to the app, as section 2 describes | Independent controller for payment |
| Microsoft (Clarity) | Analytics and session-replay data from our web surfaces. See section 7, which explains what this means, plainly | Independent controller, by Microsoft's own terms |
| Google (Analytics) | Analytics from liftgeist.com and web.liftgeist.com only. Not from the web app | Independent controller in practice |
| Google (Fonts) | Your IP address and browser, whenever a web page loads our typeface. The installed apps ship the font inside the app and never request it | Independent controller |
| jsDelivr | Your IP address when exercise demonstration images load | Independent controller |
| Open Food Facts | The barcode you scan or the food name you search, plus your IP address. Sent directly from your device, including from the installed apps | Independent controller |
| Apple, Google | If you use their sign-in, the sign-in itself: the provider learns that you are signing in to Liftgeist, sees your IP address and browser as any visited page does, and returns the identity we then hold. Apple's button is in the iOS app and on the dashboard, Google's is on every surface. No training, body or nutrition data goes to either. Their own privacy policies govern that step | Independent controllers |
We do not sell your personal data, and we do not share it with advertisers or data brokers.
Meal estimates, program building, plan imports, target setting and the in-app coach are powered by Anthropic's Claude models. Your input goes over an encrypted connection to our server on Cloudflare, and from there to Anthropic's API using our key. When you are signed in, the request to our own server carries your sign-in token, so the server can recognise you and apply your daily usage limit to your account rather than to everyone sharing your connection. What we pass on to Anthropic carries no name, email or account identifier.
Your permission comes first. Before the app sends anything to an AI feature for the first time, it asks whether you allow it, and nothing is sent until you say yes. If you choose not now, nothing is sent and the app asks again next time. You can turn AI features off at any time in Settings, and the app then asks again before it sends anything.
The coach sends more than the others, so it is worth stating outright: using it transmits a summary of your bodyweight and its trend, your personal records, your recent sessions with actual loads, your nutrition against your targets, your recent readiness notes, and, if you connected Apple Health, your daily steps, active energy and workouts. That is health data leaving your device. If you would rather it did not, do not use the coach; every other part of the app works without it. Each coach request also carries Apple's record of your Liftgeist Pro purchase (section 2), which our server checks and does not pass on to Anthropic.
We do not write your meal text, photos, notes or coach messages to our own logs. Anthropic processes them to produce your result under its commercial API terms, which provide that inputs and outputs submitted through the API are not used to train its models.
AI outputs are not used to make any decision with a legal or similarly significant effect about you. They are suggestions you can edit or ignore, and every estimate is presented as editable before it is saved.
Liftgeist stores your ledger and preferences, including whether you have allowed AI features and whether Liftgeist Pro is unlocked, in your browser's local storage, and on iOS and Android mirrors them into the operating system's app storage so they survive. This is how the app works offline. It is not tracking, and it is not shared.
We use two analytics tools on our web surfaces. Neither runs inside the installed iOS or Android apps.
| Surface | Microsoft Clarity | Google Analytics | Cloudflare |
|---|---|---|---|
| liftgeist.com (marketing) | Yes | Yes | No |
| app.liftgeist.com (web app) | Yes | No | Yes (Cloudflare Web Analytics) |
| web.liftgeist.com (dashboard) | Yes | Yes | No |
| iOS / Android apps | No | No | No |
What Clarity actually does. Microsoft Clarity is a session-replay tool. It records how pages are used, including clicks, scrolling, mouse movement and page changes, and sets cookies (_clck, roughly a year; _clsk, roughly a day) that pseudonymously link your visits. Microsoft states that it acts as a data controller for this data, which means Microsoft may use it for its own purposes under the Microsoft Privacy Statement, not only for ours. We do not send Clarity your name, email or account identifier. Session replay reconstructs the page, though, so on the signed-in surfaces a replay can include training and nutrition figures that were on screen. What a replay captures is governed by settings in Microsoft's own console rather than by anything in our code, so we will not promise you more than our code can prove: if you would rather no replay tool ever saw your numbers, use the installed app, which loads none.
Google Analytics sets its own cookies and reports aggregate usage of the marketing site and the dashboard.
Cloudflare Web Analytics runs on the web app and counts page views without cookies.
Current status, stated honestly rather than aspirationally: Liftgeist does not yet present a cookie consent banner, so these tools currently load without asking first. That is being changed. Until it is, if you are in the EEA, the UK or Switzerland and would prefer no analytics at all, use the installed app, which loads none, or block the domains clarity.ms and google-analytics.com in your browser. We will update this section and the date above when the consent banner ships.
| Data | Kept for |
|---|---|
| Your ledger: workouts, sets, bodyweight, meals, macros, notes, check-ins | Until you delete it or delete your account. It does not age out |
| Meal photo thumbnails | Removed once more than 60 days old, applied the next time you log a meal |
| Account and email address | Until you delete your account |
| AI results cached on Cloudflare (the estimate, not the photo) | Up to 24 hours, keyed by a hash of the request |
| IP address at the AI endpoints, for the daily limit | Up to about 25 hours |
| Deletion records, so a deleted item cannot reappear on another device | An internal id and a timestamp, no content. Meal and freestyle records are pruned after 180 days; deleted-program records are kept |
| Apple's record of a Liftgeist Pro purchase | Not linked to your account. After a check, the product and purchase dates sit in a short-lived server cache so repeat coach messages skip re-checking, then are deleted. Apple keeps your purchase history under its own policies |
| Analytics data held by Microsoft and Google | According to those products' own retention settings and policies. It is pseudonymous and not linked to your account |
| Automatic snapshots of your synced row, the safety net against accidental data loss | At most the last 24, each replaced as you keep using the app. Removed with your account: see section 12 |
| Encrypted database backups | Deleted data may persist in routine backups for a short period before they rotate out. It is never restored to the service |
Wherever you live, you can ask us to do all of the following, and we will not treat you differently for asking:
Email [email protected]. We answer within 30 days, and within 45 days for US state requests, extendable once where the law allows. We may need to confirm you control the account email before acting.
We are based in the United States and our providers are largely US-based, so data about EEA and UK users is transferred to the United States. Where a provider offers Standard Contractual Clauses or participates in the EU-US Data Privacy Framework, that is the mechanism relied on, and each provider named in section 5 publishes its own data processing terms.
All traffic between the app, our servers and our providers uses HTTPS. Cloud data is protected by database-level access rules so an account can only read its own row; we have verified that an unauthenticated request cannot read any user's data. There is no password to steal, because we do not use passwords.
Two limits worth stating: on iOS and Android your sign-in token is held in the operating system's standard app preference storage rather than the secure keychain, and Android's system backup may copy the app's data to your Google account unless you turn that off. We are addressing both.
No system is perfectly secure. If a breach affects your rights we will notify you and the relevant authority as the law requires.
In the app: You tab, gear icon, Settings, Delete account. It asks twice, then deletes immediately.
What that removes: your account, your sign-in identity and your entire synced ledger from our database.
Liftgeist Pro is not affected. It belongs to your Apple ID, not to your Liftgeist account, so deleting the account neither cancels nor refunds it. Apple keeps its own record of the purchase.
What it does not remove: the copy already on the device you are using. That stays until you delete the app (iOS and Android) or clear the site data (web). We say this plainly because the alternative would be untrue.
Automatic snapshots: our database keeps at most the last 24 snapshots of your synced row so that an accidental loss can be undone. Deleting your account removes them in the same step. They are unreadable to the app, never restored to the service, and used for nothing else.
Without the app: email [email protected] from your account address and we will delete it for you. A public page describing this is at liftgeist.com/delete-account.
Analytics data held by Microsoft or Google is pseudonymous and not linked to your account, so we cannot single it out for deletion; you can clear those cookies in your browser.
Liftgeist is not intended for children. You must be at least 18 to create an account. We do not knowingly collect data from anyone younger, and if we learn that we have, we will delete it. If you believe a child has created an account, email us.
Liftgeist reads nothing from Apple Health until you turn one of the Health switches on in Settings, and each switch asks iOS for permission at the moment you use it. You can revoke any of it at any time in iOS Settings, Apps, Health, Data Access & Devices; iOS grants and revokes each data type separately.
What it reads, with your permission:
What it writes, with your permission:
Where it goes. Health data is treated exactly like the data you type into Liftgeist yourself, and not kept separate from it:
Health data is never sold and never used for advertising or marketing, and we share it with no one beyond the recipients named in section 5. One honest exception on the web: the numbers read from Apple Health are shown on screen like any other, so the session-replay tool described in section 7 can capture them as part of the page. The installed apps load no analytics at all. Turning the Health switches off stops the reading; data already imported stays in your ledger until you delete it (daily step counts, active energy and imported cardio are additionally pruned once they fall outside the app's own rolling history window), and deleting your account removes it with everything else.
Note that the rest-complete notification and the Live Activity display the exercise name and set count on your lock screen, which is visible without unlocking. You can turn notifications off in system settings.
California. We are almost certainly below the thresholds that make the CCPA apply to a business, but we honour its rights anyway. We collect the categories described in section 2: identifiers (email), health and nutrition information (sensitive personal information), internet activity, and, if you buy Liftgeist Pro, commercial information: Apple's record of which product you bought and when, which we check with coach requests but do not store. We use sensitive personal information only to provide the service you asked for, never to infer characteristics about you. We do not sell personal information and do not share it for cross-context behavioural advertising. Because our analytics tools may be treated as "sharing" under some readings, you can opt out by declining analytics once our consent banner ships, by blocking those domains, or by using the installed app. We honour Global Privacy Control signals where our tooling supports it. To exercise any right, email us; an authorised agent may act for you with written permission.
Washington, Nevada and Connecticut. Your consumer health data rights, and the disclosures those laws require, are in our separate Consumer Health Data Privacy Policy.
Other states. Where your state gives you rights to access, correct, delete, port or opt out, we honour them through the same contact address, and you may appeal a refusal by replying to our decision.
Liftgeist is not a medical device. It does not diagnose, treat, cure or prevent any medical condition. Its numbers, including AI calorie and macro estimates and estimated one-rep-maxes, are approximations for tracking trends, not medical or nutritional advice. Talk to a qualified professional before making health decisions, especially if you have a medical condition or an eating disorder.
We will update this page and the version and date at the top. For changes that materially affect how your data is handled, we will tell you inside the app before they take effect, and where the law requires it we will ask for your consent again. Previous versions are available on request.
Questions, requests, or anything in this policy that looks wrong: [email protected].
This policy is linked from the app, from the App Store and Google Play listings, and from every Liftgeist website.