Privacy Policy

Last updated: October 20, 2026

Strength IO is a strength-training app for iOS and watchOS operated by Crimson IO LLC ("we," "us," "our"). Your health data is yours — we built Strength IO to help you train smarter, not to monetize your information.

This Privacy Policy describes what information we collect, how we use it, and your choices. By using Strength IO, you agree to this policy.

Information We Collect

Account Information

Strength IO uses Sign In with Apple or email/password for account creation. When using Sign In with Apple, Apple provides us with an anonymized user identifier, and optionally your name and email address (Apple offers a relay option that hides your real email). Email sign-up collects your name, email address, and a password. Your profile also holds the details you give during setup or in Settings — your date of birth, sex, height, weight and body fat. These are stored on your device and synced to our secure servers with your account.

Your profile also keeps your phone model, app version and whether an Apple Watch is connected, to help us with support.

Fitness & Workout Data

When you use Strength IO, the app stores data you create — including workout history, exercise logs, personal records, recovery scores, training metrics, gym profiles, goals, and preferences. This data is stored on your device and synced to our secure servers, tied to your account, so it is backed up and restores when you set up a new iPhone.

Workout summaries synced to our servers include aggregate metrics such as average and maximum heart rate, calories burned, duration, volume, and exercise details. Each set you log is synced with the heart rate saved for it, when there is one. The status you set in the app — sick, injured or on a break — is synced as well, so it restores on a new device. We also sync your daily readiness score — the computed score only — so your readiness history is backed up and restores on a new device. The health readings the app reads for recovery (heart-rate variability, Recovery HRV on Apple Watch Series 12 and Ultra 4, resting heart rate, sleep duration, respiratory rate, blood oxygen, wrist temperature, and their personal baselines) stay on your device and are never uploaded to our servers, and so does all raw HealthKit time-series data (individual heart-rate samples, sleep stage transitions, and other continuous readings).

Apple HealthKit Data

With your permission, Strength IO reads health data from Apple HealthKit to power its recovery and readiness features and to import your workouts. This includes:

With your permission, Strength IO also writes to Apple Health: your completed workouts, while the Workouts switch in Strength IO’s Sync Options is on, and any weight or body fat you log in the app, while the Body switch is on.

Some Apple Health values are copied to your profile and synced to our servers with it. While the Body switch in Strength IO’s Sync Options is on, the latest weight, body fat and height in Apple Health update those fields on your profile. Your date of birth and sex are filled in from Apple Health if you have not set them yourself.

Apart from those profile details, raw HealthKit data — individual samples, continuous time-series readings, and the daily health values the app reads for recovery (heart-rate variability, Recovery HRV on Apple Watch Series 12 and Ultra 4, resting heart rate, sleep duration, respiratory rate, blood oxygen, wrist temperature, active calories outside workouts, resting daytime heart rate, and their personal baselines) — is processed on your device: it is never uploaded to our servers, never shared with third parties, never used for advertising or marketing, and never sent to any third-party AI service. Aggregate workout-level metrics (such as average heart rate per workout) and your computed daily readiness score are synced to our secure servers, tied to your account, so your history restores on a new device. You can revoke HealthKit access at any time in iOS Settings.

Location Data

If you grant location access, Strength IO captures your location once when a workout begins to tag that workout with a single pin — its coordinates and, when the spot is a named place such as your gym, that place’s name. A street address is never stored as a place name, and when your iPhone shares only your approximate location the pin is kept as an approximate area and not named. This is a one-time tag at the start of the workout, not continuous tracking and not a route. When location permission is granted, that pin is stored with your workout and synced to our servers as part of your workout data. There is no separate in-app sharing toggle: location is optional and controlled entirely by the permission you grant in iOS Settings — deny or revoke it there at any time and workouts recorded from then on will simply not include a location tag. Revoking applies going forward: pins already saved stay attached to the workouts that carry them, so your map history survives reinstalling the app. A pin is part of its workout, so deleting that workout deletes its pin, and deleting your account deletes all of them.

Separately, a workout imported from Apple Health that recorded a route — an outdoor run, ride or walk you tracked on your Apple Watch — is tagged with that route’s starting point and, when it is a named place, that place’s name. Only the starting point is kept: the route itself is not stored or uploaded. This tagging is controlled by the workout permission you grant Apple Health and by the Workouts switch in Strength IO’s Sync Options — not by the location permission above — so it can happen even if you have never granted Strength IO location access. Turn the Workouts sync switch off, or revoke workout access in Apple Health, and imported workouts will not be tagged.

On-Device Processing

Strength IO's recovery calculations, and the daily notes it writes about your readiness and training load, run entirely on your device using Apple's on-device frameworks. Your data is never sent to any AI service — Apple's or anyone else's — for processing.

Analytics & Crash Reporting

We use service providers for analytics (to understand how the app is used) and crash reporting (to identify and fix bugs). These services collect usage data such as which screens you visit, which features you use, and technical information about crashes or errors.

Analytics events also carry coarse facts about your training, so we can tell how the app is working for different kinds of athlete: your stated experience level and fitness goal, whether an Apple Watch is connected, and, for a completed workout, its type and its counts of exercises, sets and personal records. They also carry your subscription state and, when you subscribe, the plan you chose (see Subscription Data below). Our analytics provider also works out your approximate location — city, region and country — from the internet address your iPhone connects from when it sends an event, and stores it with that event. This is separate from the workout location tag described above: it does not use your iPhone’s Location Services, and turning location access off does not change it. Analytics never receives your health readings — no heart-rate variability, resting heart rate, sleep, blood oxygen, respiratory rate or wrist temperature — and never the weight or reps of an individual set. This data is associated with a random account identifier, not your name or email. We do not use advertising networks or ad-supported analytics services.

Subscription Data

Subscriptions are handled by Apple's App Store, and Strength IO verifies your subscription on your device using Apple's StoreKit. Your payment details — card, billing address, receipts — stay with Apple and never reach us or anyone we work with. What does leave your device is your subscription state (trial, active, expired, refunded or none) and, when you subscribe, the plan you chose with its price and currency: the state is stored on your account profile so the app knows which screens to show you, and both are sent to our analytics and crash-reporting providers under the same random account identifier as the rest of your usage data, so we can tell how the app is working for subscribers. See the App Store terms for Apple's handling of payment information.

How We Use Your Information

We use your information to:

Service Providers

We use a limited number of trusted service providers to operate the app — for account authentication and data storage, and product analytics and crash reporting. These providers process data only as needed to provide their service and are contractually prohibited from using your data for their own purposes.

We do not sell, rent, or trade your personal data. We do not share your data with any AI service. We do not use advertising networks or share data for advertising or marketing purposes.

Data Storage & Security

Your fitness and workout data is stored on your device and synced to our secure servers, tied to your account and encrypted in transit and at rest.

Account information and your synced workout data are stored on secure servers with encryption in transit and at rest. We use industry-standard security measures including encrypted connections, secure authentication, and access controls. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Data Retention

Your account and fitness data is retained for as long as your account is active. You can delete your data at any time from within the app.

Crash reporting data is retained by our crash-reporting provider for approximately 90 days. Usage analytics events are retained by our analytics provider for longer under its standard retention policy; they are associated with a random account identifier, never your name or email, and after you delete your account they are no longer linked to any account profile.

Deleting Your Account

You can delete your account and all associated data at any time from Settings within the app. This permanently removes:

Two limited categories may persist after account deletion. First, administrative and security audit logs (records of privileged actions taken on the backend) are retained for security and legal-compliance purposes; any reference they held to your account identifier is cleared. Second, the usage and crash-reporting data described above is not linked to your identity: deleting your account deletes your analytics profile, and any remaining crash data (kept ~90 days) and usage events (kept longer under our analytics provider's standard retention policy) carry only a random identifier that no longer maps to any account. Neither category can be used to reconstruct your profile or fitness data.

You can also delete the app to remove all local data from your device.

Your Rights

You have the right to:

California Residents

Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To exercise these rights, contact us at support@strengthio.app.

Children's Privacy

Strength IO is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact

Questions? Contact us at support@strengthio.app.