Privacy Policy

Our Commitment to Privacy

StrengthMaxxer is designed with privacy as a core principle. Your workout data belongs to you, and we've built the app to keep it that way.

Data Collection and Storage

What We Collect

StrengthMaxxer stores your core training data locally on your device. This includes:

• Workout logs (exercises, sets, reps, weights)
• Custom exercise definitions
• Workout programs
• Personal records
• App preferences (units, rest timer settings, etc.)

Optional Cloud Features

StrengthMaxxer is local-first. Maxx AI text chat and structured workout and program drafts use Apple's on-device Foundation Models when Apple Intelligence is available. Image input and image-analysis relays are disabled in this release. No external language model receives chat or builder requests.

Maxx AI

Maxx AI is optional. Each request requires your general Maxx AI consent, and chat history, training settings, and web research are separately controllable in the app. Text, selected training context, and structured drafts stay on your device. Optional PubMed Research queries NCBI directly from your device and does not use our relay, an app-generated identifier, or your purchase information. Safety reports use the separate submission flow described below. Please do not include personal information in free-form messages or web-research requests.

Data Maxx AI uses on your device

• Your message and a bounded local training summary, such as body-metric trends, workout and exercise names, recent workout and personal-record dates, sets, volume, and plateau signals. Maxx AI receives this summary rather than a copy of your complete training database. Goals, experience level, schedule, equipment, units, and progression preferences are only included when you enable Training Settings for that message.
• When you use @ mentions, the mentioned exercise, workout, or program's type, stable identifier, name, revision, and a bounded summary needed to answer the request or prepare a proposal.
• If you enable chat history, a bounded rolling summary and up to eight recent text-only turns from that Maxx AI chat. Turns that used images, Training Settings, web research, @-tagged training references, or training-change proposals are never reused as history unless you share context again. You can turn this off or clear the chat at any time.
• If you enable training settings, your goal, experience level, target days, default equipment, units, and progression preferences. Maxx AI does not receive your Apple account, payment data, name, avatar, date of birth, or analytics settings.
• Maxx AI does not read or send Apple Health (HealthKit) data. HealthKit access in StrengthMaxxer is used for workout tracking, such as heart rate and calories from a paired Apple Watch. Apple Health permissions and its own synchronization settings are separate from Maxx AI.
• Image input, image relays, and screenshot-to-workout import are disabled in this release. Previously granted image permissions do not enable uploading images.
• If you enable Research for a message, Maxx AI may send a short, privacy-screened training topic directly from your device to NCBI's PubMed service. Queries containing direct personal details are rejected. NCBI receives the query and normal network metadata, including your IP address. Chat history, training records, HealthKit data and purchase information are not sent. Limited article titles and abstract excerpts are processed on your device and linked to their PubMed pages. This is literature search, not a general web search. The NLM privacy policy and NCBI and NLM disclaimer apply; indexed studies and excerpts are not individualized medical advice.

AI safety reports

The in-app report form sends only the content you review and submit to StrengthMaxxer support through Cloudflare and email. A selected response, preceding prompt, research source, and reply email are optional. No conversation history, photos, HealthKit records, or training records are automatically attached. App version, build, OS version, and language help us investigate. Reports are managed in Gmail and removed from our support systems 30 days after resolution, with documented exceptions for unresolved incidents or required retention. Provider recovery and legal-retention copies are outside our control. Deleting AI data in the app does not automatically delete a submitted support case; contact support with its report reference to request removal. Temporary delivery queues retain each copy for at most 24 hours, with an absolute delivery deadline of 48 hours from submission. Receipt metadata contains no report text or reply address and expires after seven days.

What Maxx AI can do

• Provide strength-training guidance and explain the supplied summaries.
• Show PubMed source links from Research you explicitly enable for that message.
• Draft workouts, programs, and share copy that remain editable and are never saved until you explicitly review and save them in the app.
• AI features do not provide medical advice, diagnosis, or body-fat estimates.

Storage and retention

Attachment descriptors, Training Settings snapshots, generated skill drafts and payloads, approval state, web-source links, and Maxx AI conversation-memory settings are kept in a local-only app store. All chats, including ordinary text-only conversations, stay on the originating device in protected storage and are excluded from app backups. They do not follow the app's iCloud setting. Existing optional-context redaction and data controls remain in place for conversation history, source material, and generated skill payloads. This local storage is separate from the support-report boundary. Routine subscription checks and generation do not send purchase proofs or create sessions on our relay. Earlier versions may have created short-lived relay access records: tokens expire after 15 minutes, and scheduled cleanup removes expired session hashes and identities inactive for more than one day with no remaining session. Delete AI Data can send a deletion-only Apple purchase proof to remove those legacy records. Separate security counters expire after their rate window without activity. Provider backup and required-retention copies may persist under their own policies. Safety reports follow the separate submission and retention rules described above.

Cloudflare processes network and operational metadata, including IP addresses, approximate location inferred from IP addresses, request URLs, device or browser information, timing, and status, for delivery, security, and diagnostics. The app does not request GPS location for these services. Operational logs and sampled traces have separate provider retention periods. Direct PubMed requests do not pass through Cloudflare. NCBI's handling follows the NLM privacy policy: it retains query and network usage logs, including request times and approximate city-level location, and analyzes aggregate usage to improve its services. NLM states that it periodically deletes web logs without specifying a fixed retention period. Delete AI Data does not directly erase provider operational records, earlier search-provider records or recovery copies.

Text generation and structured drafts are processed by Apple Foundation Models on your device. Images and external language-model services are disabled. NCBI receives only a permitted public research query and normal network metadata, under its applicable privacy documentation.

AI Program Builder

When you ask to build a program, Foundation Models processes on your device the selections you make in that flow: priority muscles, workouts per week, session length, training volume, program goal, the experience setting already stored in your profile, and equipment. Custom-equipment labels are validated and used to match custom exercises in your local library; the AI model receives only whether custom equipment is present, not the labels themselves.

The on-device model returns a bounded weekly structure. Your device creates the exercises and prescriptions locally, and no generated program is saved until you explicitly choose to save it.

iCloud Sync (Optional)

Optional app sync is limited to plan names, exercises, set/rep prescriptions, rest settings, program schedules, and equipment defaults through your personal iCloud account when synchronization is available. Availability is shown in Settings. Working weights, notes, completed workout history, personal records, training progress, health measurements, body/profile records, session impact payloads, progress-photo copies, and Maxx AI chats remain in protected local storage and are excluded from app backups. They may be lost after app deletion or device loss. Original images already in your Photos library follow your Photos settings. Apple Health synchronization is separate and depends on its own permissions and settings. Previously synced copies may remain in iCloud; disabling sync does not remove those copies.

• Sync is controlled through your Apple ID and device settings
• Apple's Privacy Policy applies to iCloud services
• You can turn sync off in the app settings

You can disable app iCloud sync in Settings. Removing a local workout-health copy does not delete the workout or samples in Apple Health. You can manage Apple Health records separately in Health.

In-App Purchases

Purchases are processed entirely by Apple through the App Store. We do not have access to your payment information. Apple may share basic transaction information with us (such as whether a purchase was made), but not your personal financial details.

Third-Party Services

StrengthMaxxer integrates with the following third-party services:

• Apple (App Store, iCloud, StoreKit): For app distribution, optional cloud sync, and in-app purchases
• Apple Foundation Models: For on-device Maxx AI text generation and structured drafts when Apple Intelligence is available
• Cloudflare: For deliberate safety-report submissions, explicit deletion of legacy relay records, and website hosting
• Google Gmail: For support emails, including safety reports you choose to submit
• NCBI PubMed: For direct public literature searches you enable for a message; titles and abstract excerpts are summarized on-device

We do not sell your personal data. Our AI services use submitted content to operate the feature you request; providers may also process operational and aggregate usage information as described above.

Data Deletion

You can control or delete your data through the following options:

• Using Recently Deleted in Settings → Data & Privacy to permanently remove workouts you have deleted
• Using "Delete AI Data" in Settings → Data & Privacy, which deletes local Maxx AI chats and private AI context, plus AI-service records associated with your app-generated identity, including its short-lived relay session and entitlement-verification records. This is available even after an AI subscription expires. It does not delete workout logs, saved programs, or app account settings stored on your device.
• Uninstalling the app (this removes local app data)
• Deleting app data from iCloud (if sync was enabled) through your device's iCloud settings

You can also email support@strengthmaxxer.com to request deletion.

Children's Privacy

StrengthMaxxer is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us so we can promptly remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: support@strengthmaxxer.com