Privacy policy

Ironwright is a strength-training log and planner. This policy says what we collect, why, who else handles it, how long we keep it, and what you can do about it. In short: your training data is yours, we use it only to run the app for you, we do not sell it, and you can delete everything yourself at any time.

Who we are

the operator of Ironwright (“we”) runs Ironwright and decides how your information is used. Contact: help@ironwright.app. We are not a healthcare provider and this is not a medical service, so the rules for medical records (such as HIPAA in the United States) do not apply to us. We still treat injury and pain information as sensitive, and the section on health data explains how.

What we collect

• Sign-in details. Your email address and a password (stored by our sign-in provider as a one-way hash, so we never see it), or, if you use Continue with Google, your Google account’s email address and the basic profile details Google shares (such as your name and picture), which are kept with your sign-in record. The app does not show or use your name or picture. We also record that you confirmed you are 18 or older, and when.
• Your training profile. Experience level, equipment, units and the smallest weight steps you use.
• Your training. Plans, workouts, exercises, sets (reps, weight, effort, form notes you flag), swaps and changes you approve, readiness check-ins, exercises you like or dislike, and the history the app uses to suggest your next targets.
• Care information (optional). If you tell the app about an injury, pain or limitation, it stores the area, side, how much it hurts, check-ins, return-to-training steps and related reminders. This is health information. See health data.
• Workouts you import or describe. If you paste a workout from a video description or an article, we save the text you pasted and the draft built from it. If you use the AI reader for the “describe it in words” box, the sentence you type is sent for reading and is not saved.
• Reminders (optional). If you turn reminders on, we store your device’s push address, your reminder choices (including the time of day you choose for your morning reminders, if you move it) and a log of which reminders were sent, opened or put off with “Remind me later”, and when. The notification text is fixed and never mentions a body part, score or diagnosis.
• Technical data. Like any website, our hosting provider sees your IP address, browser type and the pages you request, and keeps short-lived logs to run and secure the service.

We do not use advertising or analytics trackers, we do not build advertising profiles, and we do not collect your precise location, contacts, photos or microphone.

Why we use it

• To provide the app: sign you in, log your sets without losing them, build workouts and plans, and show why each target is what it is.
• To adapt to what you tell us: for example, to train around an injury you chose to record.
• To send the reminders you asked for.
• To keep the service secure, prevent abuse, fix problems and meet legal duties.

The app suggests changes using fixed rules, and you approve them. It makes no decision about you with legal or similarly significant effect.

Our legal basis (if you are in the EU, the UK or similar)

• Providing the service you asked for (a contract): your account, profile, training and imports.
• Your explicit consent: health information you choose to record in Care, and reminders. You give it with a checkbox before anything is stored, and you can withdraw it at any time by deleting that data.
• Legitimate interests: security, preventing abuse and keeping the service working.
• Legal obligations, where a law requires us to keep or disclose something.

Who else handles your information

We do not sell your personal information, and we do not share it for advertising. These companies process it for us, only to run the app:

• Supabase hosts our database and sign-in. Your data is stored in the United States (US East).
• Vercel hosts and serves the website, so it handles your requests and keeps short-lived server logs.
• Google, only if you choose Continue with Google, to confirm who you are.
• OpenAI, for the optional AI features: reading a workout you paste into the importer, and the AI reader for the “describe it in words” box. Only the text you choose to submit is sent, not your name, email or training history. The words box tries to refuse sentences about pain or health before anything is sent, but that check is a keyword list and can miss unusual wording, so please do not put health details in it or in pasted workouts. OpenAI states that data sent through its API is not used to train its models by default and may be kept for up to 30 days to detect abuse.
• Push services run by your browser’s maker (for example Google, Apple or Mozilla), only if you turn reminders on. They carry the fixed reminder text.

We may also disclose information if the law requires it, to protect people’s safety or our rights, or in a sale or reorganisation of the service (we would tell you first).

Health data (injury, pain and recovery information)

This section is our consumer health data policy for people in Washington, Nevada and other places with similar laws, and it applies to everyone.

• What: the injuries, limitations, pain readings, check-ins and recovery steps you record in Care, and the in-workout “Something hurting?” flags you save. When you stop a lift for pain, the app also remembers which lift and area for seven days, so your next workouts can go easier on it.
• Why: only to adapt your workouts around what you told us, and to remind you to check in if you asked for that.
• Where it comes from: only from you. We do not get health data from anyone else.
• Who gets it: our database and hosting providers, as processors, to store it. We do not sell it or share it with anyone else, and it is not sent to the AI features.
• Consent: before anything is stored the app asks you to agree to it in a checkbox, and you can say no and still use the app. If your answers include red-flag symptoms the app tells you to get checked and does not store those answers; the one exception is if you choose to rest the area while you get it checked, which is saved as your choice.
• Your control: delete all of it any time from Care, without deleting your account, or delete the whole account in Settings. Withdrawing consent means deleting it.

How long we keep it

• Your account data: until you delete your account. Deleting is immediate and removes your sign-in and everything in it. We have no way to get it back.
• Care information: until you delete it in Care or delete your account.
• A lift you stopped for pain: a few days (seven at the moment; the number can change, and a stop already saved keeps its own end day), then it is deleted. You can delete it sooner with the rest of your Care information.
• Backups: short-lived backups held by our database host are not restored into the app after you delete, and age out on the host’s normal schedule.
• Server logs: kept by our hosting providers for a short period under their own settings.
• Text sent to OpenAI: OpenAI may keep it for up to 30 days, as described above.
• On your device: unsent sets, drafts, a rest timer and your theme choice are kept in your browser. Deleting your account removes this device’s data for that account; you can also clear your browser’s site data.

Cookies and browser storage

We use only what the app needs to work: sign-in cookies that keep you logged in, a cookie holding your time zone so “today” is your day, and browser storage for unsent workout sets, drafts and your theme. There are no advertising or tracking cookies, so there is no cookie banner and nothing to opt out of.

Your rights and choices

You can, free of charge:

• Delete your account and everything in it: Settings, then Delete my account. Without signing in, the steps are on the delete-account page.
• Delete your care information alone, from Care.
• See, correct or get a copy of your information. You can see and edit most of it in the app. For a full copy (there is no download button yet), write to help@ironwright.app.
• Object to or limit how we use it, and withdraw consent where we rely on it, by writing to us.
• Complain to your data protection authority or state attorney general if you think we have mishandled your information.

If you live in California, Washington or another state with a privacy law, you have the rights above under that law, and we will not treat you worse for using them. Because we do not sell or share your information for advertising, there is nothing to opt out of, and we do not respond differently to a Global Privacy Control signal. To make a request, write to help@ironwright.app from the email address on your account, so we can confirm it is you. We answer within the time the law gives us, which is usually 30 to 45 days. You can ask someone to act for you; we will need proof that they may.

Where your data goes

Our providers process your information in the United States. If you are in the EU, the UK or elsewhere, that means it leaves your country. We rely on the legal safeguards our providers offer for these transfers.

Security

Data is encrypted in transit. Each account’s data is separated in the database, so your workouts and care information are readable only by your account inside the app. No system is perfectly secure. If a breach affects your information we will tell you as the law requires.

Children

Ironwright is for people 18 and over. We do not knowingly collect information from anyone younger. If you think a child has an account, write to us and we will delete it.

Changes

If we change this policy in a way that matters, we will update the date at the top and tell you, in the app or by email, before it takes effect. We will not use health information for a new purpose without asking you first.

Contact

the operator of Ironwright. help@ironwright.app.