Isofit Privacy Policy

Version: 1.6
Effective Date: October 7, 2026
Data Controller: Isofit ltd.
Contact Email: privacy@isofit.app
Governing Frameworks: CCPA (California) | GDPR (EU, where applicable)
Consumer Health Data: See also our Consumer Health Data Privacy Policy, which supplements this policy for the health data Isofit collects.

Your Privacy Matters to Us

Isofit processes personal data including workout logs, health and fitness information, AI coaching conversations, and social interactions. We take our responsibility to protect this data seriously.

This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and what your rights are.

We do not sell personal information. We do not share your individual health or fitness data with advertisers.

1. Who We Are and How to Contact Us

Isofit is a fitness platform providing AI-powered coaching, workout logging, a community social layer, and a rewards economy through a native iOS application and web services at isofit.app.

For any privacy-related questions, concerns, or requests:

Privacy Contact: privacy@isofit.app
General Support: support@isofit.app

2. What Personal Data We Collect

We collect the minimum data necessary to provide our services. The data we collect falls into the following categories.

2.1 Data You Provide Directly

Account and Identity Data: First name, last name, email address, username, display name, avatar image, and bio. Collected during account creation and profile setup.
Preferences and Settings: Timezone, measurement units (imperial or metric), default post visibility, notification preferences, and Atlas personalization opt-in.
Workout and Training Data: Activity sessions, exercises performed, sets, reps, weight, RPE (Rate of Perceived Exertion), session notes, and freeform quick logs entered via text or voice.
Voice Input: Audio recorded when you choose voice workout logging or Atlas dictation, and the resulting transcripts. Section 3 explains how each feature processes this input and when audio is sent to Apple or to Isofit and OpenAI.
Atlas AI Conversations: Messages you send to Atlas (our AI coach), including text messages, images submitted for form checks, and any voice transcriptions. If you opt in to Atlas personalization, Atlas also stores persistent memory items it learns about you over time — such as your goals, injuries, and preferences.
Bonfire Community Content: Posts, comments, reactions, and media (photos and videos) you share in Bonfire, our community feed. Includes your chosen Bonfire nickname.
Payment and Subscription Information: Apple processes App Store payments, and RevenueCat manages subscription status using a pseudonymous app user identifier and purchase receipts. Isofit does not store your credit card number, CVV, or full card details on our servers.
Communications Data: Messages you send to our support team and feedback you provide.

2.2 Data Generated by Your Use of the Platform

$ISO Economy Data: Your in-app currency balance, transaction ledger (earning, spending, and redemptions), streak history, and reward tier status. This data is generated automatically as you log workouts, maintain streaks, and interact with the platform.
Training Analytics: Muscle group frequency data, personal records, training volume trends, and insights synthesized from your workout history.
Usage Data: Login events, features accessed, session duration, and app interaction patterns.
Technical Data: Device type, operating system version, IP address, and push notification tokens. Used for delivering notifications and maintaining platform security.
Moderation Data: If your Bonfire content is flagged or reported, moderation records are generated. These are not visible to other members.

2.3 Apple Health Data (Optional)

If you connect Apple Health from within the app, we read the following through Apple's HealthKit framework — only after you grant permission in the iOS authorization screen, where you can allow or deny each data type individually:

Workouts: Workout type, start and end time, duration, distance, average and maximum heart rate, and active energy. Each workout is imported into your Isofit log as a synced session.
Daily summaries (last 7 days): Steps, exercise minutes, sleep duration, resting heart rate, and walking and running distance. These are shown in the app and, if you have opted in to Atlas personalization, included in the context Atlas uses to coach you.

Connecting Apple Health does not require any subscription. See Section 5 for how we handle HealthKit data specifically.

2.4 Limits on Data Collection and Storage

We do not store your precise GPS location. Optional device location access for weather is described in Section 6.2.

We do not collect or store:

Data from your contacts, calendar, or camera roll unless you explicitly choose to upload a photo or video.
Full payment card details. Apple processes App Store payments, and RevenueCat manages subscription status.
Data from external social media platforms.

3. How and Why We Use Your Data

We process your data only where we have a valid basis. The purposes are as follows.

Provide workout logging and training analytics. Your workout data, quick logs, and training history are the core of the Isofit experience. Without this data, the app cannot function.
Process voice input. Apple speech recognition processes audio on your device when supported and may otherwise process it on Apple's servers. When you choose voice workout logging, the transcript is sent to Isofit and then to OpenAI to create a workout draft. If speech recognition is unavailable, fails, returns no text, or has low confidence, the recorded clip is sent to Isofit and then to OpenAI for transcription. You review the workout draft before saving it. This processing occurs when you choose voice workout logging, whether or not Atlas personalization is enabled. You can use text entry instead.
Deliver Atlas AI coaching. Atlas dictation places the recognized text in a draft; it does not send the audio to Isofit or OpenAI. Once you choose Send, that text is processed and stored like other Atlas messages. When you message Atlas, your message and the recent messages in that thread are used to generate a response. If you opt in to personalization, Atlas also receives your profile details, training insights, recent workout history, and the persistent memory items it has built from prior conversations, so it can provide personalized coaching.
Operate the $ISO economy. Your workout logs, streak activity, and membership tier determine your $ISO earnings. Spending, redemptions, and balance tracking require ledger data.
Power the Bonfire community. Posts, comments, reactions, and media you share are displayed to other members. Moderation systems process content to maintain community standards.
Generate training insights. Your workout history is used to identify training trends and, if you opt in to Atlas personalization, to give Atlas coaching context. If you also connect Apple Health, Atlas can use your recent daily summaries. This data is never used to train AI models.
Process payments and manage subscriptions. In the iOS app, membership is purchased through Apple's App Store in-app purchase system; Apple processes the payment and Isofit never sees your payment details. RevenueCat manages subscription state on our behalf.
Send notifications. Push notification tokens are used to send you streak reminders, reward alerts, social notifications, and system messages via Apple Push Notification service.
Send transactional emails. Your email address is used for account-related communications such as billing confirmations and referral notifications.
Maintain platform security. Technical data and login events are used for fraud detection, abuse prevention, and security monitoring.
Improve the platform. Aggregated, de-identified usage patterns help us understand how features are used and where to focus development.

4. Atlas AI and Your Data

This section describes how your personal data interacts with the Atlas AI coaching system.

4.1 What Atlas Receives About You

When you interact with Atlas, the following data is provided to the AI system to generate responses:

Your current message: The text, image, or voice transcription you send.
Conversation history: Recent messages from your current Atlas thread for conversational continuity.

If you opt in to Atlas personalization, Atlas also receives:

Your profile details: Such as your name, username, bio, training goals, experience level, and age range, along with app settings such as your measurement units and timezone.
Training insights: Muscle group activity data from your workout history (frequency, volume, last trained date, average RPE per muscle group).
Your workout history: Your last 30 days of structured workout data, including exercises, sets, reps, and weights, and a rolling summary of your training history prepared from your logs.
Memory items: Persistent facts Atlas has learned about you — such as goals, injuries, and preferences — drawn from prior conversations.
Apple Health daily summaries (if connected): Your last 7 days of steps, exercise minutes, sleep duration, resting heart rate, and walking and running distance.

Without personalization, Atlas answers as a general coach and does not receive your profile details, training insights, workout history, memory items, or Apple Health data.

4.2 How Atlas Uses Your Data

Model routing: Your message content and attachments determine which AI model processes your request. Simple questions are handled by a lighter model; form checks, injury-related queries, and deep analysis requests are routed to a more capable model. This routing is handled automatically.
Form checks: If you submit an image or video for form analysis, it is processed by a vision-capable AI model to generate feedback.
Memory building: If you have opted in to personalization, Atlas analyzes your conversations after extended exchanges to extract persistent facts. These memory items are stored in your account and used to improve future coaching.

4.3 AI and Automated Decision-Making

Atlas does not make decisions that produce legal or similarly significant effects on you. Atlas provides fitness coaching suggestions only. No training plan, exercise recommendation, or form feedback constitutes medical advice, and Atlas is not a substitute for professional medical or fitness guidance.

You can withdraw your Atlas personalization opt-in at any time in your account settings. Doing so will delete your stored Atlas memory items, and Atlas will stop receiving your profile details, training insights, workout history, and Apple Health daily summaries. Withdrawal does not affect messages already sent or coaching already delivered.

5. Apple Health and HealthKit Data

Isofit reads Apple Health data only if you choose to connect Apple Health in the app and grant permission through the standard iOS HealthKit authorization flow. No subscription is required. We treat HealthKit data with special care:

Express permission first. Before any Apple Health data is read, you consent to health-data processing in the app and then choose exactly which data types to allow in the iOS permission screen. You can grant or deny each one individually.
Purpose limitation. HealthKit data is used only to provide Isofit features for you: importing your workouts into your log, showing your recent daily summaries, and — if you have opted in to Atlas personalization — giving Atlas the same picture of your week when it coaches you.
No advertising or data mining. We do not use HealthKit data for advertising, marketing, or use-based data mining, and we do not sell it or disclose it to third parties for those purposes.
No AI training. Your HealthKit data is never used to train AI models. It is processed by our AI provider only to generate your coaching responses, under terms that prohibit the provider from training on it.
No disclosure without permission. We do not disclose your HealthKit data to any third party without your express permission. The service providers that process it on our behalf are listed in Section 6.2.
Revocable at any time. You can revoke HealthKit access at any time through iOS Settings (Privacy & Security → Health) or by disconnecting Apple Health within the app. Revoking access stops future syncs; previously synced data follows the retention rules in Section 8.

Our Consumer Health Data Privacy Policy sets out the categories of health data we collect, why, who processes it, and your rights over it in one place.

6.1 Other Isofit Members

Your Bonfire posts, comments, reactions, profile information (display name, avatar, bio, nickname), and leaderboard position are visible to other members according to your visibility settings. Your workout data is private by default unless you explicitly change your visibility setting.

6.2 Technology Service Providers

We use the following service providers to deliver Isofit. All are bound by their respective data processing terms.

Supabase: Backend infrastructure, database hosting, user authentication, and real-time features.
Google: Provides optional Google Sign-In for account authentication. If you choose it, Google processes your sign-in and shares the account information you authorize with Isofit, subject to Google's own privacy policy.
Apple App Store: Processes in-app membership purchases in the iOS app. Apple handles all payment data directly under its own privacy policy; Isofit never sees your payment details.
Apple Speech Recognition: Transcribes voice input for workout logging and Atlas dictation. Recognition runs on your device when supported; otherwise, Apple may receive and process the audio on its servers.
RevenueCat: Manages in-app subscription state (which plan you hold and whether it is active). Receives a pseudonymous app user identifier and purchase receipts — never your name, health data, or payment details.
Apple Weather (WeatherKit) and Open-Meteo: Provide the current-conditions line shown in the app header. Receive the coarse location you chose for weather (a zip code, your device location if you enabled it, or a city inferred from your timezone) — never your identity or health data.
OpenAI: Processes Atlas AI coaching requests. Your message content, and your training context if you have opted in to personalization, are sent to OpenAI's API to generate responses. OpenAI also receives voice workout transcripts to create workout drafts and, in the fallback cases described in Section 3, recorded workout clips for transcription. Voice workout processing does not depend on Atlas personalization. Under OpenAI's API terms, data submitted through the API is not used to train OpenAI's models by default; Isofit does not opt in to any such data sharing.
Resend: Delivers transactional emails. Receives your email address only.
Apple Push Notification service (APNs): Delivers push notifications to your iOS device. Receives a device-specific push token, not your personal information.

6.3 Legal and Regulatory Disclosures

We may disclose your data where required by law, court order, or regulatory authority. We will notify you of any such disclosure unless prohibited by law.

6.4 We Do Not Sell Your Data

Isofit does not sell, rent, or trade your personal information to any third party. We do not use your data for advertising or allow third-party advertisers to access your data. We do not use your fitness or health data to train AI models.

If you use Isofit through Muse (Section 6.5), Meta's own policies govern what Meta does with that information, including any use to train its AI. If you use Isofit through ChatGPT (Section 6.6), OpenAI's own policies govern what OpenAI does with that information.

6.5 Using Isofit Through Muse (Meta)

You can choose to connect Isofit to Muse, an AI agent provided by Meta Platforms, Inc. When you use Isofit through Muse, everything you say to Muse, and everything Isofit sends back through it, is handled by Meta under Meta's own terms, privacy policies, and settings. Those govern how Meta collects, uses, keeps, and shares that information, including whether Meta uses it to train its AI, and they take precedence over this policy for anything Meta does. Isofit has no control over Meta's handling of your information. Review Meta's Muse Privacy Policy before connecting.

This policy continues to govern the information Isofit itself receives through the connection (the workouts you log), which Isofit keeps in your Isofit account until you revoke the connection or delete your account. You can revoke Muse's access at any time from your Isofit account. Revoking deletes the workouts logged through Muse that Isofit holds; it does not delete anything Meta already holds.

6.6 Using Isofit Through ChatGPT (OpenAI)

You can choose to connect Isofit to ChatGPT, provided by OpenAI. When you use Isofit through ChatGPT, everything you say to ChatGPT, and everything Isofit sends back through it, is handled by OpenAI under OpenAI's own terms, privacy policy, and your ChatGPT settings. Those govern how OpenAI collects, uses, keeps, and shares that information, including whether OpenAI uses it to improve its services, and they take precedence over this policy for anything OpenAI does. Isofit has no control over OpenAI's handling of your information. Review OpenAI's Privacy Policy before connecting.

Some Isofit features in ChatGPT, such as searching exercises, work without connecting an Isofit account; Isofit does not store those requests.

This policy continues to govern the information Isofit itself receives through the connection (the workouts you log), which Isofit keeps in your Isofit account until you disconnect ChatGPT or delete your account. You can disconnect ChatGPT at any time from your Isofit account (You → Connections) or in ChatGPT. Disconnecting your last ChatGPT account deletes the workouts logged through ChatGPT that Isofit holds; it does not delete anything OpenAI already holds.

Isofit provides granular consent controls accessible in your account settings:

Operational consent (on by default): Required for the app to function. Covers core workout logging, $ISO economy, and account management.
Atlas personalization opt-in (off by default): Controls whether Atlas AI receives your profile details, training insights, and workout history, builds and retains persistent memory items from your conversations, and uses your Apple Health daily summaries if connected. Without this opt-in, Atlas still works as a general coach but does not receive that data or retain persistent memory items between sessions.
Usage analytics (on after you accept this policy; off anytime): Controls the in-app product analytics described in Section 2.2 (screens viewed, features used). Turn it off under Privacy & Terms in your account settings and collection stops immediately.

In addition, Apple Health requires the iOS HealthKit permission screen before any data is read (see Sections 2.3 and 5).

You can change these settings at any time. Changes take effect immediately.

8. Data Retention

We retain your data only for as long as necessary to provide the service or as required by law.

Active account data (profile, settings, workout logs, Atlas threads, $ISO ledger): Retained for the duration of your active use of Isofit.
Atlas memory items: Retained while personalization consent is active. Deleted when you withdraw consent or close your account.
Bonfire posts and comments: Retained while your account is active. Content deleted by you or by moderation is removed according to our data cleanup schedule.
Payment and billing records: Retained as required by applicable financial regulations (typically up to 7 years).
Security and audit logs: Retained for a limited period for security and compliance purposes, then purged.
Apple Health data: Workouts imported into your log and daily summaries are retained with your account data. Disconnecting Apple Health stops future syncs; data already imported remains part of your account data and is deleted with your account.
Consent records: When you grant or withdraw a consent — accepting the Terms, consenting to health-data processing, or opting in to Atlas personalization, for example — we record which consent, the version of the text you saw, when, and a hashed IP address and device identifier. We keep these records as evidence of consent, including after account deletion. On deletion the record is severed from your account and kept in pseudonymized form: your user ID is removed and only a salted one-way hash remains, which cannot be reversed to identify you.
Account deletion: When you delete your account, your personal data is deleted, except for the pseudonymized consent records described above and records retained as required by law. Anonymized, aggregated data that cannot identify you may be retained for platform analytics.

9. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect your personal information, including industry-standard encryption of data in transit and at rest. Apple processes App Store payments, and RevenueCat manages subscription status, so your full card details never touch our servers.

No method of transmission or storage is 100% secure, but we take security seriously and review our practices regularly.

If you discover a potential security vulnerability, please report it to privacy@isofit.app.

10. Membership Cancellation and Account Deletion

Canceling your membership restricts access to paid features but does not delete your account or your personal data. To delete your personal data, request account deletion through your account settings or by contacting privacy@isofit.app. Section 8 explains what we may retain after deletion: pseudonymized consent records, records retained as required by law, and anonymized, aggregated data for platform analytics.

If you subscribed through the Apple App Store, deleting your Isofit account does not cancel that subscription — Apple manages it, and you must cancel it yourself in your Apple account settings (Settings → your name → Subscriptions on iPhone). RevenueCat manages subscription status on our behalf.

11. Children's Privacy

Isofit is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has created an account or provided us with personal information, please contact privacy@isofit.app immediately and we will delete such data.

12. Cookies and Tracking

The Isofit iOS app does not use browser cookies. The Isofit web services at isofit.app use only essential cookies necessary for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics that share your data with advertisers.

13. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any right, contact privacy@isofit.app.

Access: Request a copy of the personal data we hold about you, including your workout logs, Atlas conversations, and $ISO ledger history.
Correction: Request correction of any inaccurate data we hold about you, either through your account settings or by contacting us.
Deletion: Request deletion of your personal data. Note that some records may be subject to legal retention requirements.
Data Portability: Request your personal data in a structured, machine-readable format.
Withdraw Consent: Withdraw any consent you have given at any time, including consent for Atlas personalization and Apple Health access. Effective for future processing.
Opt Out of Sale (CCPA): We do not sell personal information, so there is nothing to opt out of. If this changes, we will provide a clear mechanism.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

We will respond to verified requests within 30 days (or sooner where required by law).

14. International Data Transfers

Isofit's backend infrastructure is hosted by Supabase. Your data may be transferred to and processed in countries other than your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place, including compliance with applicable data transfer mechanisms under GDPR (such as Standard Contractual Clauses) where required.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification, and we will update the "Effective Date" at the top of this document. Your continued use of Isofit after notification of changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

Privacy Contact: privacy@isofit.app
General Support: support@isofit.app
Website: https://isofit.app

If you are a California resident, you may have additional rights under the CCPA. If you are located in the EEA, you may lodge a complaint with your local EU data protection authority.

End of Privacy Policy | Isofit | v1.6 | October 7, 2026