Privacy Policy

• Account data: email address, password hash, display preferences.
• Profile data: training profile, body metrics, goals, equipment access, injuries you choose to log.
• Workout data: exercises, sets, reps, weights, notes, timestamps, training plans.
• Progress photos: images you upload to track physique progress (see Section 5).
• Weigh-ins and biometrics: values you log manually.
• Device & usage data: browser type, OS, app version, error diagnostics, IP address (for rate-limiting and abuse prevention only).
• Communications: messages you send via the contact form or to support@ironoasis.app.

We do not collect precise geolocation, contacts, microphone, or camera data beyond what you explicitly upload.

• Authenticate you and provide the Service across devices.
• Save and display your workout history, plans, and progress.
• Send transactional emails (account verification, password reset, contact replies).
• Diagnose errors and improve reliability.
• Prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell your personal information. We do not use it for advertising or share it with advertisers.

If you are in the EEA or UK, our legal bases are: performance of contract (providing the Service), legitimate interests (security and product improvement), consent (where required), and legal obligation.

We use a small set of vetted providers to operate the Service. Each is bound by contract to protect your data:

• Lovable Cloud / Supabase — application backend, database, authentication, storage (United States).
• Cloudflare — edge hosting and DNS.
• Mailgun (via Lovable Emails) — outbound transactional email delivery.
• ElevenLabs — text-to-speech voice cues, when you enable that feature.

Progress photos are private to your account. They are stored in a non-public storage bucket protected by row-level security so that only your authenticated account can read or download them.

• RSS Digital LLC operators do not view, export, browse, or use your progress photos for any purpose.
• Photos are served via short-lived signed URLs — no public links are generated.
• We do not analyze, fingerprint, or share photo content with third parties.
• You may delete any photo from within the app at any time; deletion removes the underlying file from storage.
• When you delete your account, all progress photos are permanently removed from storage.

Data is stored on infrastructure provided by Supabase (PostgreSQL + S3-compatible storage) hosted in the United States. We use:

• TLS encryption in transit.
• Encryption at rest provided by the underlying cloud provider.
• Row-level security policies that scope every record to its owning user.
• Hashed passwords (bcrypt) — we never see your password in plaintext.

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you as required by applicable law.

We retain your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal, accounting, or fraud-prevention purposes.

Regardless of where you live, you may:

• Access, correct, or export the personal data in your account from within the app.
• Delete your account and all associated data at any time by emailing support@ironoasis.app.

California residents have additional rights — see our California Privacy Notice.

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal information, contact us and we will delete it.

Our infrastructure is hosted in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S.

We use first-party local storage and cookies strictly to keep you signed in and remember your preferences. We do not use third-party advertising cookies, analytics trackers, or fingerprinting tools.

We may update this Policy from time to time. We will post the new "Last updated" date at the top. Material changes will be announced in-app or by email.

RSS Digital LLC
California, USA
support@ironoasis.app