Privacy Policy

Last updated: November 6, 2026

Strength IO is a strength-training app for iOS and watchOS operated by Crimson IO LLC ("we," "us," "our"). Your health data is yours — we built Strength IO to help you train smarter, not to monetize your information.

This Privacy Policy describes what information we collect, how we use it, and your choices. By using Strength IO, you agree to this policy.

Information We Collect

Account Information

Strength IO uses Sign In with Apple or email/password for account creation. When using Sign In with Apple, Apple provides us with an anonymized user identifier, and optionally your name and email address (Apple offers a relay option that hides your real email). Email sign-up collects your name, email address, and a password. Your profile also holds the details you give during setup or in Settings — your date of birth, sex, weight and body fat. These are stored on your device and synced to our secure servers with your account. Every weight and body fat you type in the app is also kept with its date, on your device and on our servers, so you keep a history without Apple Health. You can delete any of them in the app.

Your profile also keeps your phone model, app version and whether an Apple Watch is connected, to help us with support.

Fitness & Workout Data

When you use Strength IO, the app stores data you create — including workout history, exercise logs, personal records, recovery scores, training metrics, gym profiles, goals, and preferences. This data is stored on your device and synced to our secure servers, tied to your account, so it is backed up and restores when you set up a new iPhone.

Workout summaries synced to our servers include aggregate metrics such as average and maximum heart rate, calories burned, duration, volume, and exercise details. Each set you log is synced with the heart rate saved for it, when there is one. The status you set in the app — sick, injured or on a break — is synced as well, so it restores on a new device. We also sync your daily readiness score — the computed score only — so your readiness history is backed up and restores on a new device. The health readings the app reads for recovery (heart-rate variability, Recovery HRV on Apple Watch Series 12 and Ultra 4, resting heart rate, sleep duration, respiratory rate, blood oxygen, wrist temperature, and their personal baselines) stay on your device and are never uploaded to our servers, and so does all raw HealthKit time-series data (individual heart-rate samples, sleep stage transitions, and other continuous readings).

Apple HealthKit Data

With your permission, Strength IO reads health data from Apple HealthKit to power its recovery and readiness features and to import your workouts. This includes:

With your permission, Strength IO also writes to Apple Health: your completed workouts, while the Workouts switch in Strength IO’s Sync Options is on, and any weight or body fat you log in the app, while the Body switch is on.

Some Apple Health values are copied to your profile and synced to our servers with it. While the Body switch in Strength IO’s Sync Options is on, the latest weight and body fat in Apple Health update those fields on your profile. Each of the two is synced with the date it was measured. Your date of birth and sex are filled in from Apple Health if you have not set them yourself.

Apart from those profile details, raw HealthKit data — individual samples, continuous time-series readings, and the daily health values the app reads for recovery (heart-rate variability, Recovery HRV on Apple Watch Series 12 and Ultra 4, resting heart rate, sleep duration, respiratory rate, blood oxygen, wrist temperature, active calories outside workouts, resting daytime heart rate, and their personal baselines) — is processed on your device: it is never uploaded to our servers, never shared with third parties, never used for advertising or marketing, and never sent to any third-party AI service. Aggregate workout-level metrics (such as average heart rate per workout) and your computed daily readiness score are synced to our secure servers, tied to your account, so your history restores on a new device. You can revoke HealthKit access at any time in iOS Settings.

Location Data

If you grant location access, Strength IO captures your location once when a workout begins to tag that workout with a single pin — its coordinates and, when the spot is a named place such as your gym, that place’s name. A street address is never stored as a place name, and when your iPhone shares only your approximate location the pin is kept as an approximate area and not named. This is a one-time tag at the start of the workout, not continuous tracking and not a route. When location permission is granted, that pin is stored with your workout and synced to our servers as part of your workout data. There is no separate in-app sharing toggle: location is optional and controlled entirely by the permission you grant in iOS Settings — deny or revoke it there at any time and workouts recorded from then on will simply not include a location tag. Revoking applies going forward: pins already saved stay attached to the workouts that carry them, so your map history survives reinstalling the app. A pin is part of its workout, so deleting that workout deletes its pin, and deleting your account deletes all of them.

Separately, a workout imported from Apple Health that recorded a route — an outdoor run, ride or walk you tracked on your Apple Watch — is tagged with that route’s starting point and, when it is a named place, that place’s name. Only the starting point is kept: the route itself is not stored or uploaded. This tagging is controlled by the workout permission you grant Apple Health and by the Workouts switch in Strength IO’s Sync Options — not by the location permission above — so it can happen even if you have never granted Strength IO location access. Turn the Workouts sync switch off, or revoke workout access in Apple Health, and imported workouts will not be tagged. To find a pin's place name and draw its map, the app sends the pin's coordinates to Apple's maps service.

On-Device Processing

Strength IO's recovery calculations, and the daily notes it writes about your readiness and training load, run entirely on your device using Apple's on-device frameworks. Your data is never sent to any AI service — Apple's or anyone else's — for processing.

Analytics & Crash Reporting

We use service providers for analytics (to understand how the app is used) and crash reporting (to identify and fix bugs). These services collect usage data such as which screens you visit, which features you use, and technical information about crashes or errors.

Analytics events also carry coarse facts about your training, so we can tell how the app is working for different kinds of athlete: your answers from setup, such as experience level, fitness goal and weekly goal; summary facts about a workout, such as its type, how long it ran and its counts of exercises, sets and personal records; the exercises you swap; the goals and badges you set and earn; and whether you have marked yourself as away from training, without saying why. They also carry your subscription state and, when you subscribe, the plan you chose (see Subscription Data below). Our analytics provider also works out your approximate location — city, region and country — from the internet address your iPhone connects from when it sends an event, and stores it with that event. This is separate from the workout location tag described above: it does not use your iPhone’s Location Services, and turning location access off does not change it. Analytics never receives your health readings — no heart-rate variability, resting heart rate, sleep, blood oxygen, respiratory rate or wrist temperature — and never the weight or reps of an individual set. This data is associated with a random account identifier, not your name or email. We do not use advertising networks or ad-supported analytics services.

Subscription Data

Subscriptions are handled by Apple's App Store, and Strength IO verifies your subscription on your device using Apple's StoreKit. Your payment details — card, billing address, receipts — stay with Apple and never reach us or anyone we work with. What does leave your device is your subscription state (trial, active, expired, refunded or none) and, when you subscribe, the plan you chose with its price and currency: the state is stored on your account profile so the app knows which screens to show you, and both are sent to our analytics and crash-reporting providers under the same random account identifier as the rest of your usage data, so we can tell how the app is working for subscribers. See the App Store terms for Apple's handling of payment information.

How We Use Your Information

We use your information to:

Decisions the App Makes

Strength IO’s software, not a person, builds your workouts and works out your readiness score. The workout builder chooses exercises, sets, reps and weights from your goals, experience, equipment, training history and recovery. The readiness score is worked out from your health readings, compared with your own usual levels, and from your recent training. Both use fixed rules on your iPhone. They only suggest how to train. They never decide your access to the app, its price, or anything outside the app, and you can change or ignore any suggestion.

What You Have to Provide

You need an account to use Strength IO, because the app backs up your training to it. Without an account you cannot use the app. Connecting Apple Health and allowing location are optional. Without Apple Health you can enter your details by hand, but the readiness and recovery features will have little or no data. Without location, workouts are simply not tagged with a place.

Service Providers

We use four companies to run the app. Each handles your data to provide its service to us. Mixpanel’s terms also let it use the analytics data it receives to improve its own service.

Apple provides Sign in with Apple, payments, Apple Health and the maps service that names a workout’s location, under Apple’s own privacy policy.

We do not sell, rent, or trade your personal data. We do not share your data with any AI service, and your data is not used to train AI language models. We do not use advertising networks or share data for advertising or marketing purposes. No other company is allowed to collect data about your activity across other apps or websites through Strength IO.

Where Your Data Is Stored

Strength IO is run by Crimson IO LLC in the United States. Your data is stored and processed in the United States, by us and by the four companies above. If you live outside the United States, this means your data is sent to and stored in the United States.

The United States does not have one national privacy law like those in Australia, New Zealand or Singapore. Your data there is protected by the encryption and access controls described below, by the data protection terms each of the four companies has agreed with us, and by this policy, which applies wherever your data is held.

Data Storage & Security

Your fitness and workout data is stored on your device and synced to our secure servers, tied to your account and encrypted in transit and at rest.

Account information and your synced workout data are stored on secure servers with encryption in transit and at rest. We use industry-standard security measures including encrypted connections, secure authentication, and access controls. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Data Retention

Your account and fitness data is retained for as long as your account is active. You can delete your data at any time from within the app.

Crash reports are kept by our crash-reporting provider for 30 days. Usage analytics events are kept by our analytics provider for 2 years. Both carry a random account identifier, never your name or email, and after you delete your account they are no longer linked to any account profile. Records of password-reset emails are kept by our email provider for 30 days.

Deleting Your Account

You can delete your account and all associated data at any time from Settings within the app. This permanently removes:

Two limited categories may persist after account deletion. First, administrative and security audit logs (records of privileged actions taken on the backend) are retained for security and legal-compliance purposes; any reference they held to your account identifier is cleared. Second, the usage and crash-reporting data described above is not linked to your identity: deleting your account deletes your analytics profile, and any remaining crash data (kept 30 days) and usage events (kept 2 years) carry only a random identifier that no longer maps to any account. Neither category can be used to reconstruct your profile or fitness data.

You can also delete the app to remove all local data from your device.

Your Rights

You have the right to:

If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy sets out the health data we collect and your rights over it.

California Residents

Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To exercise these rights, contact us at support@strengthio.app.

Children's Privacy

Strength IO is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact

Strength IO is operated by Crimson IO LLC, Georgia, United States. Our privacy officer can be reached at support@strengthio.app for questions, requests, or complaints about how we handle your data. We’ll reply within 20 working days. If you’re not satisfied with our answer, you can contact the privacy regulator where you live.