Privacy Policy

This Privacy Policy explains how Havasi Holding LLC ("LiftLogic," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the LiftLogic mobile application for iOS, watchOS, and any LiftLogic widgets (collectively, the "App"), the liftlogic.fit website (the "Site"), and any related services we provide (together, the "Services").

If you do not agree with this Privacy Policy, please do not use the Services. By creating an account or using the Services, you confirm that you have read and understood this Policy.

1. Who we are

The Services are operated by Havasi Holding LLC, a Utah limited liability company. Our registered office is:

Havasi Holding LLC
7533 S Center View St, Ste N
West Jordan, UT 84084
United States

Privacy questions: privacy@liftlogic.fit
Legal questions / data subject requests: legal@liftlogic.fit
Product support: support@liftlogic.fit

Havasi Holding LLC is the controller of personal information collected through the Services for the purposes of the EU and UK General Data Protection Regulation ("GDPR" / "UK GDPR"), the California Consumer Privacy Act as amended ("CCPA/CPRA"), and similar comprehensive privacy laws in other US states.

2. Summary of key points

This summary highlights the most important things in this Policy. Each point links to the full section.

• Where your training data lives. On your device, synced through your own iCloud account. Your workouts, routines, records, journal, and nutrition entries are stored on your iPhone and mirrored into your personal iCloud so your devices stay in step. That sync happens inside your Apple account — we cannot read it, and it is not stored on our servers. This changed in version 4.2.0; before then, this data was stored on our backend.
• What we collect. Much less than we used to. Your account details (name, email), optional health metrics you allow us to read from Apple HealthKit, basic device and diagnostic information, and anything you send to support. Photos you add in version 4.4.0 or later stay on your device. See section 3.
• What we do not do. We do not sell your personal information. We do not use your health or fitness data for advertising. We do not use your data to train AI models. We do not show third-party ads in the App or integrate any advertising network. LiftLogic contains no product-analytics or ad-attribution tracking of any kind, does not ask for App Tracking Transparency permission, and never accesses your device advertising identifier (IDFA). LiftLogic is free: there is nothing to sell you, and no billing information to collect.
• Where the rest lives. The limited data we do hold is on Google Cloud in the United States. Where a processor operates globally, transfers from the EEA or UK rely on Standard Contractual Clauses.
• Your controls. You can export the data we hold from inside the App (Settings, then Privacy, then Request data export), delete your account permanently (Settings, then Account, then Delete account), and revoke Apple HealthKit access from the iOS Settings app. Your on-device and iCloud data is already in your hands. See section 12.
• Children. The Services are intended for users aged 13 and older. Users under 18 require a parent or guardian to accept the Terms on their behalf. See section 11.
• Contact. Email privacy@liftlogic.fit for any privacy request.

3. Categories of personal information we collect

We collect the categories of personal information listed below. Not every category applies to every user — for example, we only receive health metrics if you grant Apple HealthKit permission.

3.1 Account and profile

• Email address.
• Display name (and, if you sign in with Apple or Google, your given/family name if you choose to share it).
• Password hash (we never see your raw password; Firebase Authentication handles this).
• Authentication provider identifier (Sign in with Apple, Google, or email address).
• Optional profile fields you provide: date of birth, height, weight, sex, fitness goals, equipment available, bio, profile photo.

3.2 Workout and fitness data (stored on your device and in your iCloud)

The following is created and stored locally on your device, and synced through your own iCloud account. We do not receive it:

• Workouts you create, schedule, or complete: exercises, sets, reps, weights, RPE, rest times, notes, dates.
• Custom routines, progressions, and templates you save.
• Custom exercises you author (name, muscles, equipment).
• Personal records, streaks, body-weight log, body-measurement log.
• Nutrition entries you log in the food diary (foods, calories, and macros), and daily journal entries — including subjective wellbeing scores (mood, energy, stress, sleep quality, soreness) and any free-text notes you write.

Photos and video, as of version 4.4.0. Anything you attach to a journal entry, a completed workout, or a custom exercise, along with your profile picture, is stored on your device and syncs only through your own private iCloud. We do not receive it.

One honest caveat. If you used LiftLogic before version 4.4.0, copies of the photos you uploaded back then still sit in our file storage. Version 4.4.0 downloads them onto your device so you keep them, but it does not erase the originals from our side. Those remaining copies are deleted when we shut the backend down on 7 November 2026, and you can have them deleted sooner by deleting your account (see section 12).

3.3 Health metrics (from Apple HealthKit, when you grant permission)

See section 15 for the full HealthKit disclosure, including the exact data types we request and how to revoke access.

3.4 Communications

• Emails you send to support, plus our reply thread.
• Feedback you submit from inside the App, which reaches us through Sentry (see section 7).
• Voice input, if you use voice workout logging or dictation: speech recognition runs on your device (your audio is not sent to our servers or to anyone else), and the resulting text is parsed by a model on your device.

3.5 Device, log, and diagnostic information

• iOS / watchOS version, device model, app version, locale, time zone.
• Crash reports and performance telemetry (via Sentry — see section 7).
• Approximate IP address (captured transiently by Firebase services for security and abuse prevention; not used for advertising).
• App Attest / App Check attestation tokens that verify requests are coming from a genuine, unmodified copy of the LiftLogic App.

Notifications and reminders are scheduled by the App on your device. Your device holds a push-notification token, but it is not sent to us and we do not maintain a list of tokens.

3.6 Product analytics and advertising measurement — none

LiftLogic contains no product-analytics SDK and no advertising or attribution tracking. The Firebase Analytics and PostHog integrations described in earlier versions of this Policy were removed from the App, along with all ad-attribution measurement. The App does not present Apple's App Tracking Transparency prompt and never accesses your device advertising identifier (IDFA), because there is nothing in the App that would use it. The only diagnostic reporting that remains is crash and error reporting through Sentry, described in section 7.

The liftlogic.fit website carries no analytics either — no tracking scripts, no first-party cookies, and no consent banner, because there is nothing to consent to. See our Cookie Notice.

4. Sensitive personal information

Some of the categories above are treated as "sensitive personal information," "special categories of personal data," or "consumer health data" under applicable laws (including GDPR Art. 9, CCPA/CPRA, the Washington My Health My Data Act, the Connecticut Data Privacy Act, and similar laws). Specifically:

• Health, fitness, and biometric data — heart rate, HRV, resting heart rate, sleep, body weight, body composition, and activity / step / workout records.
• Precise location — only in two optional, permission-gated cases: (a) if you enable gym-arrival reminders, in which case your device monitors a geofence around the gym location you selected and location processing happens on your device — the gym coordinates you chose are stored with your gym, not a log of your movements; and (b) if you use the outdoor-training feature, in which case your approximate location is sent to Apple's WeatherKit service to fetch local weather conditions and is not stored by us. We do not otherwise collect location from your phone, and we never use location for advertising or build a history of the places you visit.
• Account credentials — handled by Firebase Authentication; we never see your plaintext password.

We use sensitive personal information only for the purposes you have asked us to (operating the App, generating your personalized recommendations, syncing to your Apple Health profile, etc.) plus the limited backend purposes listed in section 6. We do not use sensitive personal information for advertising, profiling beyond what is necessary to deliver the Service, training third-party machine-learning models, or any purpose unrelated to your use of LiftLogic.

We do not collect government identifiers (such as Social Security numbers, passport numbers, or driver's license numbers) for any purpose.

5. Sources of personal information

We collect personal information from three sources:

• Directly from you — when you create an account, complete your profile, upload a photo, use an AI feature, or contact support.
• Automatically from your device — your iOS/watchOS device provides version, model, crash logs, and (transiently) IP address so the Services can operate.
• From Apple HealthKit, if you authorize it — we only read the data types listed in section 15, and only after you grant permission on the HealthKit permission sheet.

6. How we use your information

We use personal information for the following purposes:

• To provide the Services — let you log and view workouts, sync to Apple Health, generate recommendations, send notifications, surface streaks and personal records, and present your training history across iOS, watchOS, and widgets. Most of this happens on your device.
• To authenticate you and protect your account — Firebase Authentication, Apple Sign In, Google Sign In, and Apple App Attest / Firebase App Check to block fraudulent or modified clients.
• To hold pre-4.4.0 photos until the shutdown — journal and workout photos uploaded before version 4.4.0 remain in our file storage so the App can still copy them onto your device. New photos are never uploaded. See section 3.2.
• To migrate your existing history — if you used LiftLogic before version 4.2.0, the App reads your previous data from our backend once, on first launch after updating, to move it onto your device. See section 7.1.
• We no longer send you email at all. LiftLogic sends no digests, no product updates, and no re-engagement mail. Anything the App needs to tell you, it tells you in the App. There is nothing to unsubscribe from.
• To debug and improve the App — using crash and error reports (Sentry) and your support messages. We do not use product analytics.
• To generate your plan and suggestions — entirely on your device. Your weekly plan, journal summaries, and daily training suggestions are produced on your iPhone and send nothing to us or to any inference provider (see section 16).
• To comply with legal obligations and enforce our Terms — including responding to subpoenas, defending claims, preventing fraud and abuse, and enforcing acceptable use.

Our legal bases under GDPR / UK GDPR are: performance of a contract (operating the Services you signed up for), your consent (HealthKit access, location permissions), our legitimate interests (security, fraud prevention, improving the product), compliance with legal obligations, and, for sensitive data, your explicit consent.

7. Who we share information with

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not have advertising partners.

We share personal information with the following categories of recipients, all of whom act either as our service providers / processors (bound by written agreement) or as independent controllers for narrowly defined purposes:

7.1 Infrastructure and security

• Apple Inc. — iCloud / CloudKit is where your training data syncs. It is stored in your own private iCloud database, under your Apple account and Apple's privacy terms; we have no access to it. Apple also provides Sign in with Apple, the Apple Push Notification service, App Attest, WeatherKit, App Store hosting, and HealthKit (see section 15).
• Google LLC (Firebase / Google Cloud) — authentication, client attestation (Firebase App Check), remote configuration, and serverless functions. It also still holds the photos uploaded before version 4.4.0, pending the shutdown described in section 3.2. Data hosted in the United States.
• Google LLC (Firestore) — migration only. Before version 4.2.0 your workout data was stored in our Firestore database. The App now reads that database once per installation, to copy your existing history onto your device, and never writes to it again. No workout data recorded in version 4.2.0 or later is stored there.
• Cloudflare, Inc. — DNS, CDN, and edge security for liftlogic.fit. Cloudflare may process IP addresses to deliver and protect the Site.
• Google Secret Manager — to store our server-side API keys and the encryption key used to wrap your Apple refresh token; never used to store user data itself.

7.2 Communications

• Loops.so — formerly our email service provider. LiftLogic no longer sends email, so nothing new is passed to Loops. The only remaining contact with it is a deletion call: when your profile is deleted, we ask Loops to purge your address from its records.

7.3 Diagnostics and feedback

• Functional Software, Inc. d/b/a Sentry — receives crash and error events, and the feedback you submit from inside the App. We configure the SDK with sendDefaultPii=false, so events are tagged with your Firebase user ID for triage but contain no email address or other directly identifying personal data. Sentry is the only diagnostic service in the App; we use no product-analytics provider.

7.4 Nutrition lookups

• Open Food Facts — a public food database we may query to look up nutrition facts for an item, by barcode or by search. The query contains the food, not you.
• No AI or inference provider. LiftLogic no longer sends any of your data to OpenAI or to any other inference provider. Your weekly plan and every other generated suggestion are produced on your device. See section 16.

7.5 Other recipients

• Google LLC (YouTube) — exercise demonstration videos are played through an embedded YouTube player. When you play a video, YouTube receives your IP address and standard playback telemetry under Google's own privacy policy. No workout or health data is shared with YouTube.
• Legal, regulatory, or governmental authorities where required by law, court order, or a binding request, or where necessary to protect our rights, your safety, or the safety of others.
• Acquirers in a corporate transaction — if we are involved in a merger, acquisition, financing, restructuring, or sale of assets, personal information may be transferred to the acquiring party subject to the same protections described in this Policy.

8. International data transfers

Our primary infrastructure is located in the United States. If you use the Services from outside the United States, your personal information will be transferred to and processed in the United States and in other jurisdictions where our service providers operate.

For transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses ("SCCs"), the UK Addendum to the SCCs, and equivalent safeguards offered by our processors (including Google Cloud's, and Sentry's published Data Processing Addenda). You can request a copy of the relevant SCCs by emailing privacy@liftlogic.fit.

9. How long we keep information

We keep personal information only as long as we need it for the purposes described in this Policy or as required by law. The table below summarizes our standard retention windows.

10. How we keep information safe

We use technical and organizational measures designed to protect your information. These include:

• Keeping your training data out of our hands entirely. Since version 4.2.0 it lives on your device and in your own iCloud, protected by your Apple account and your device passcode or biometrics. Data we never hold cannot be breached from our side.
• Encryption in transit (TLS 1.2+) for all client-server traffic.
• Encryption at rest for Cloud Storage and our remaining application databases (Google-managed keys).
• Application-layer AES-256-GCM encryption for your Apple Sign-In refresh token; the encryption key lives in Google Secret Manager and is only accessible to our Cloud Functions runtime.
• Server-side security rules enforced on every read and write, so a user can only reach their own data.
• Firebase App Check + Apple App Attest to verify requests come from a genuine LiftLogic App on an unmodified device.
• Secrets (service credentials and similar) held in Google Secret Manager — never embedded in the iOS bundle, never returned to clients.
• Principle of least privilege for our team's access to backend systems, with audit logging and multi-factor authentication required on all administrative accounts.

No security measure is perfect. If we become aware of a breach that affects your personal information, we will notify you and any required regulator as required by applicable law (e.g., GDPR Art. 33–34, US state breach-notification statutes).

11. Information from minors

The Services are intended for users aged 13 and older. If you are under 18, you may only use the Services with the involvement and consent of a parent or legal guardian, who must accept the Terms of Service on your behalf. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and you believe a child under 13 has provided us with personal information, please contact privacy@liftlogic.fit. We will delete that information promptly upon verification.

12. Your privacy rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information. We honor these rights for all users, regardless of jurisdiction, except where law requires us to retain information.

• Right of access / portability. You can request a copy of the personal information we hold from inside the App: Settings → Privacy → Request data export. We generate a downloadable ZIP archive, in a structured machine-readable format (JSON), containing your account and profile record, the photos you have uploaded, and any pre-4.2.0 training history still held on our servers from before the App became local-first.
  
  Your current training data is not in that archive, because it is not ours to give you. Workouts, routines, records, journal entries, and nutrition logged in version 4.2.0 or later are stored on your device and in your own iCloud account. They are already in your possession, and we have no copy to export. You reach them through the App itself and through Apple's own iCloud data tools, which Apple provides independently of us.
• Right to deletion. You can permanently delete your account from inside the App: Settings → Account → Delete account. This triggers a server-side cascade that removes your account record, any photos you uploaded before version 4.4.0, and any pre-4.2.0 data still held on our servers; it also revokes your Apple Sign-In token with Apple as required by Apple App Store Review Guideline 5.1.1(v). To remove the data held on your own device and in your own iCloud, delete the App and its iCloud data — we cannot do that for you, because we cannot reach it.
• Right to correction. You can update most of your information (name, email, profile, height, weight, workout history) from Settings inside the App. For corrections you can't make yourself, email privacy@liftlogic.fit.
• Right to object / restrict processing. You may object to or ask us to restrict certain processing. There is now very little to object to: LiftLogic sends no marketing email, and no generated feature sends your data off your device.
• Right to withdraw consent. Where we rely on your consent (HealthKit, location permissions), you can withdraw it at any time without affecting the lawfulness of prior processing.
• Right to opt out of marketing. Already done, for everyone. LiftLogic sends no marketing email and no transactional email. If you believe you have received email from us, tell us at privacy@liftlogic.fit and we will look into it.
• Right to non-discrimination. We will not deny, charge different prices for, or provide a different quality of service because you exercised your privacy rights.
• Right to complain to a supervisory authority. If you are in the EEA, UK, or Switzerland, you may lodge a complaint with your local data-protection authority. We would appreciate the chance to address your concerns first — please email privacy@liftlogic.fit.

To submit a request that you can't fulfill from inside the App, email privacy@liftlogic.fit from the address associated with your account. We will verify your identity before fulfilling a request, and we will respond within the timelines required by applicable law (typically 45 days under US state laws, one month under GDPR / UK GDPR).

You may use an authorized agent to submit a request on your behalf where allowed by law. We may ask the agent to provide proof of authorization and may verify your identity directly.

13. Cookies and tracking

The iOS App does not use web cookies, includes no advertising SDK, and performs no tracking. It does not show Apple's App Tracking Transparency prompt, because nothing in the App would use the device advertising identifier (IDFA) if you granted it. See section 3.6.

The liftlogic.fit website uses a limited set of cookies and similar technologies. For details — including the cookie names, providers, and how to control them — please see our Cookie Notice.

14. Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal. We do not sell or share personal information for cross-context behavioral advertising, so a "do not sell or share" signal has no operative effect — there is nothing to opt out of. We treat GPC as a valid opt-out signal under the CCPA / CPRA where applicable and honor it as such.

15. Health & fitness data (Apple HealthKit)

If you grant LiftLogic permission to read or write Apple Health data, the following applies. HealthKit access is always optional — the App's core features work without it.

15.1 What we read

We request read access to the data types below, grouped by purpose. You can grant or deny each group individually on the HealthKit permission sheet, and you can change your selections at any time in iOS Settings → Privacy & Security → Health → LiftLogic.

• Workouts (including workout routes) — to show your training history and avoid double-logging sessions you have already recorded with another app.
• Sleep analysis — to recommend rest days when you have slept poorly.
• Heart rate, heart-rate variability (HRV), resting heart rate — for recovery and effort scoring.
• Body mass — to track weight trends over time.
• Active energy, basal energy, step count, exercise minutes — to round out your daily activity picture.
• Oxygen saturation, flights climbed, cycling power, swimming stroke count — surfaced inside workout details when your tracker provides them.

15.2 What we write

• Workouts that you complete in the App, so they appear in the Apple Health app and any other app you have connected to HealthKit.
• Body mass entries you log in the App.

15.3 How HealthKit data is handled

• HealthKit data is read directly from your device and stays there. It is not uploaded to our servers. Where it needs to reach your Apple Watch, a widget, or another of your devices, it travels through your own iCloud account, which we cannot read.
• We never use HealthKit data for advertising or marketing.
• We never sell HealthKit data.
• We never use HealthKit data to train machine-learning models, ours or anyone else's.
• We do not share HealthKit data with any data broker or marketing platform.
• If you revoke our HealthKit access from iOS Settings, we stop reading immediately. HealthKit-derived data held on your device is removed by deleting the App and its iCloud data; see section 12.

16. On-device intelligence

Some parts of LiftLogic are generated rather than hand-written: your weekly plan, a summary of your own journal entries, a daily training suggestion. All of it runs on your device. LiftLogic does not send your training data to any third-party AI or inference provider, and it does not send it to us.

16.1 What runs on your device

These use Apple's on-device model, where your iPhone supports it, or plain calculation on your own logged data where it does not. The input and the result never leave your phone:

• Your weekly plan. Built on your iPhone from your own training history, recovery signals, and preferences. Nothing is sent to a server to produce it.
• Voice workout logging. Speech recognition and the parsing of what you said into exercises, sets, reps, and weights both happen on your device.
• Journal summaries — the highlight and suggestion generated from your own journal entries.
• Your daily training suggestion and the short comment on a finished workout.

16.2 What we no longer do

Earlier versions of LiftLogic sent some requests to OpenAI, L.L.C. as an inference provider. That is no longer the case. As of version 4.3.0:

• The weekly plan is generated entirely on your device. It is no longer sent to OpenAI or to any other inference provider.
• Food-photo nutrition analysis has been retired. LiftLogic no longer sends meal photographs anywhere. Barcode scanning, food search, and typing a meal in yourself all remain, and nutrition facts are looked up against the Open Food Facts public database (see section 7).
• We hold no OpenAI API agreement covering your data because no data is sent.

Two things still apply to everything in this section:

• These features are optional. The rest of the App is fully functional without them.
• Generated suggestions are not medical, training, or nutritional advice from a licensed professional. Always use your judgment and consult a qualified professional where appropriate.

17. Third-party links and services

The App and Site may contain links to third-party websites and services (App Store pages, vendor authorization flows, social-media posts, etc.). Those third parties are governed by their own privacy policies. We are not responsible for the practices of any third party we do not control.

18. Updates to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. If we make material changes, we will notify you by email (to the address on your account) or by an in-App notice at least 30 days before the change takes effect, except where a shorter notice is required by law.

Your continued use of the Services after the effective date of an update means you accept the revised Policy.

19. State-specific and regional disclosures

19.1 California (CCPA / CPRA)

In the 12 months preceding the "Last updated" date above, we collected the following CCPA-defined categories of personal information from California residents. This is a backward-looking disclosure, so it covers a period during which LiftLogic was still a paid app with product analytics — some categories listed here are no longer collected at all, as noted in the table.

We do not sell personal information and have not done so in the 12 months preceding this Policy. We do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

California residents have the rights described in section 12, including the right to request the categories and specific pieces of personal information we have collected, the right to delete, the right to correct, and the right to limit our use of sensitive personal information to that necessary to provide the Services (which is already our practice).

Shine the Light (California Civil Code § 1798.83). We do not disclose personal information to third parties for those third parties' own direct-marketing purposes.

19.2 Other US states

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have rights similar to those described in section 12 under their respective state privacy laws. Washington and Nevada residents have additional rights regarding consumer health data under the My Health My Data Act and equivalents. Submit any state-law request to privacy@liftlogic.fit.

19.3 European Economic Area, United Kingdom, Switzerland

If you are in the EEA, UK, or Switzerland, our legal bases for processing are described in section 6, and your rights (including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent) are described in section 12. You also have the right to lodge a complaint with your local supervisory authority. Where required, we transfer data to the United States under the Standard Contractual Clauses or equivalent safeguards (section 8).

20. Contact us

For any privacy question, data-subject request, or complaint:

Email privacy@liftlogic.fit or legal@liftlogic.fit.
Mail: Havasi Holding LLC, 7533 S Center View St, Ste N, West Jordan, UT 84084, United States.