Privacy policy
Last updated: November 11, 2026
The short version
We store your training data so you can sync it and keep it safe. We do not sell it, we do not show ads, and we do not use third-party analytics. Your data is stored in the United States. You can export it or delete it from the app at any time.
Who is responsible
<company> runs Lyftora. The person in charge of the protection of personal information is Karim Rhoualem, reachable at privacy@lyftora.com.
What we collect and why
| What | Why |
|---|---|
| Email and sign-in details | To create your account and sign you in |
| Workouts, programs, sets, reps, loads | To sync across your devices and back them up |
| Body weight and notes, if you enter them | Same; they are optional |
| Messages and photos or videos you exchange with a coach | To deliver them to the people you chose |
| Crash reports (when enabled) | To fix bugs. They exclude your training data and notes |
| Subscription status | To unlock paid features |
Your workouts are logged on your device first. If you never sign in, nothing leaves the device.
We compute a weekly aggregate report from synced training data to assess the beta and email it to the founder through AWS SNS; it contains only counts and statistical summaries, with no identifiers, names, email addresses or weights.
Where it is stored
On Amazon Web Services servers in the United States (us-east-1, Northern Virginia). That means your information leaves Quebec and Canada, and US authorities may be able to request access under US law. We assessed this before launch (a privacy impact assessment) and protect the data with encryption in transit and at rest and strict access controls. If you prefer not to have your data stored in the US, do not sign in; the app works offline.
Who else handles it
If you create a personal access token and configure an integration or MCP host, it can read the training data covered by the scopes you selected. Review the recipient's privacy policy before sharing your token. Tokens expire and can be revoked in Settings → Developer → Personal access tokens. Revocation prevents future access; it cannot remove copies the recipient already received. Lyftora does not automatically send this data to an AI provider. We store only token hashes and metadata; usage audits expire after 90 days or account purge.
When you send feedback, Linear receives your message, app version, optional diagnostics and screenshots to help us respond. Review them before sending. We send your account email only if you opt in to sharing it for that request. AWS screenshot copies expire after 90 days or account deletion; Linear keeps its own copies, which we remove on a privacy deletion request. Your account deletion automatically removes feedback stored in AWS; removal from Linear is handled by the founder.
AWS (hosting), Expo (app builds and updates; no user data), RevenueCat and Stripe (payments, when enabled), Sentry (crash reports, when enabled), Apple and Google (app stores). The list and what each receives is in docs/privacy/processors.md and will be published here.
What we never do
- Sell your data or share it for advertising or marketing.
- Use advertising or third-party analytics tools.
- Use health, fitness or body data (including HealthKit or Health Connect data) for advertising, or share it with data brokers, as required by Apple guideline 5.1.3 and the Health Connect policy.
- Use your data to train AI models (ADR-0016).
Coaches and friends
Everything is private by default. A coach sees only what you choose to share with them, and you can stop at any time. Messages and media are visible only to the two people in the conversation. You can block, report and delete messages. The friends feed shows only completed workouts and PRs you opt to share.
How long we keep it
- Your data: as long as your account exists.
- Deletion: when you delete your account, it is scheduled and you have 30 days to cancel. After that your data is permanently deleted.
- Backups: our database keeps point-in-time backups for 35 days, so deleted data can remain in backups for up to 35 days more.
- Server logs: about 30 days. Crash reports: up to 30 days.
- A minimal deletion record with no personal details is kept for 365 days to prove the deletion happened.
Your rights
Under Quebec's Act respecting the protection of personal information in the private sector and Canada's PIPEDA, you can ask to access, correct or delete your information, withdraw consent, and ask for your data in a portable format. In the app: Settings, Export (JSON or CSV, always free) and Settings, Delete account. Otherwise write to privacy@lyftora.com; we reply within 30 days. You may complain to the Commission d'acces a l'information du Quebec or the Office of the Privacy Commissioner of Canada.
Children
Lyftora is not for children under 14. Social features (friends, coaches) require age 16 or older. If you believe a child has given us information, write to us and we will delete it.
Security and incidents
Encryption in transit and at rest, least-privilege access, and no sensitive data in logs. If an incident creates a risk of serious injury, we will notify you and the CAI.
Changes
We will tell you in the app before material changes take effect.
Contact
privacy@lyftora.com, attention: person in charge of privacy.