Privacy Policy

1. Who is responsible

The Service is operated by Think & Do Hub, LLC ("LiftIQ Solutions", "we", "us"). Privacy contact: [email protected]. Postal address: 1264 US-1 Ste 105, Rockledge, FL 32955, United States.

LiftIQ Solutions is not established in the European Union or the United Kingdom and has not appointed a representative there.

2. Who can use LiftIQ

LiftIQ is only for people 18 or older. We ask for your date of birth when you sign up so we can check this. If the date shows you are under 18, you cannot create an account. We do not ask for identity documents.

On the website, if the date of birth entered is under 18, your browser keeps a note of when that happened, but not the date itself, for 30 days, so that the age check cannot simply be repeated. If we learn that an account belongs to someone under 18, we will close it.

3. What we collect

3.1 Account

• Email and password. Passwords are handled by our authentication provider (Supabase Auth) and are never stored in plain text.
• Date of birth, asked at sign-up for the age check and also used for age-dependent calculations, such as calorie targets.
• If you sign up as a coach, a note that the account is a coach account.
• Sign in with Apple: we request your name and email. Apple may give us a private relay email instead of your real one.
• Sign in with Google: we receive your basic Google profile (name, email and an identifier).
• With either provider, we may use the name you have there as your display name.

3.2 Profile and onboarding

Display name, biological sex, date of birth, height, weight and starting weight, unit system, primary goal, activity level, training experience, training days and session length, training location, available equipment, dietary preferences, health conditions and injury details (area, side, status and movements to avoid). If you add a gym profile: its name, address and equipment.

3.3 Training, nutrition and body data

Workouts, sets, reps, weights, personal records, training plans and plan changes. Food logs, water logs, supplements (name, dose, timing and notes). Goals. Body measurements (weight, body fat, chest, waist, arms and muscle mass). Workout ratings.

Health conditions, injuries and body measurements are sensitive data. We use them only to personalize and keep your training and nutrition safe and, if you use them, for the AI features described in 3.5.

Adding health conditions and injuries is optional. Before you add them, we ask for your explicit consent, separate from accepting the Terms and this policy. You can withdraw that consent at any time by removing them from your profile. Withdrawing does not affect your account, but the App can no longer adapt your plan to them. We never sell health data and never use it for advertising.

3.4 Photos

All photos are optional.

We do not use profile photos for face recognition, we do not analyze them with AI and we do not use them in advertising.

3.5 AI features (AI Coach, food photos, physique estimates)

• AI Coach. Your conversation with the AI Coach is kept on your device. Each time you send a message, our server forwards the most recent messages (up to 20, each cut to 2,000 characters) to our AI provider, Groq, Inc., to generate the reply. We do not store the conversation text on our servers.
• What context goes with it. On the free tier, no profile or training data is added. On a paid plan or trial, our server adds context to give personal answers: an age range (not your date of birth), goal, training schedule, location, equipment and gym, dietary preferences, health conditions and injury details, supplements, recent workouts and personal records, your latest check-in (energy, sleep, soreness and stress), and food logs and macro targets from the last 7 days.
• Food photos. The photo, the meal type and your app language are sent to Groq for a nutrition estimate.
• Physique estimates. 1 to 3 photos are sent to Groq, together with your sex, height, weight, activity level and goal. Your date of birth and health conditions are not sent; we use them on our server only to check eligibility.
• What we keep. Counters of daily use, used to enforce usage limits. Suggestions the AI Coach proposes to change in your plan or logs, and whether you accepted them. Physique estimates and the photos used for them.
• Our provider. We do not sell your data to AI providers, and we do not use your data to train AI models. Under its terms with us, Groq may not use inputs or outputs to train or fine-tune any model. Groq does not keep inference requests by default, but it may log them for up to 30 days to keep its service reliable and to investigate abuse.
• Avoid sensitive information. Do not put sensitive medical or financial information in AI Coach messages that you do not want processed in this way.

3.6 Human coaching

If you use human coaching we store coach profiles (display name, bio, availability, photo, specialties, languages, format and base country), connection requests, coaching messages, check-ins (weight, energy, sleep, soreness, stress, notes and an optional photo), workout and nutrition proposals and decisions, and your sharing choices.

If you apply to be a coach we also store your application: display and professional name, country, experience, specialties, languages, format, photo, credential details (title, issuer, number and expiry), and your confirmation that you are an adult and agree to verification.

When certain coaching events happen (a new check-in or a connection request), an email notification is sent through our email provider. It contains the display name of the person involved, not the content of check-ins or messages.

3.7 Apple Health and steps

• Apple Health (iOS, optional). If you turn it on, LiftIQ writes completed workouts, active energy and body weight to Apple Health. LiftIQ does not read data from Apple Health.
• Steps. The App shows today's step count from your phone's motion sensor. The count is shown on your device and is not sent to our servers.

3.8 Notifications

Reminders (rest timer, workouts, water, nutrition, records and weekly nudges) are scheduled on your device. If you turn on push notifications for coaching, we store a push token, an installation identifier, your platform, time zone and language. We delete push tokens that have not been refreshed in 180 days. Push messages contain generic text, not your data.

3.9 Purchases

Subscriptions are bought through Apple or Google, who process the payment. We do not receive your card details. Our subscription provider, RevenueCat, identifies you by your LiftIQ user ID. We store whether your subscription is active, the product, and the purchase and expiry dates.

3.10 Usage analytics and diagnostics

• Our own event log. When you are signed in, the App records events such as app opens, workouts started and completed, onboarding steps, paywall views and supplements logged. Some events include details of the action, such as the workout name, exercise and weight, or the name of a supplement. Some technical events about plan generation also include identifiers of health conditions that the App could not map to an exercise rule. Each event is linked to your user ID and to the app version.
• HeyCatch (product analytics in the App). When you sign in, we link HeyCatch analytics to your user ID, email address and account creation date. When a subscription starts, we send HeyCatch your user ID and the plan. The HeyCatch SDK also collects usage events such as app opens and screen views, a session identifier and device information.
• Sentry (crash reports). In production builds, crash and error reports, with device and app information, are sent to Sentry. Before a report is sent, we remove authentication headers from it.
• App updates. The App contacts Expo's update service to download app updates.

3.11 Food lookups and grocery features

• Barcode scans. The barcode number is sent to Open Food Facts, from your device and from our server, to look up the product. Products we find are saved to a shared catalog that does not record who scanned them.
• Kroger (if you use it). The ZIP code you enter, or a store and a search term, is sent to Kroger. No user identifier is sent.
• Instacart (if you use it). The list of items and quantities is sent to Instacart to create a shopping link. When you open the link, Instacart's own privacy policy applies.
• Food images. We can generate illustrative food pictures. Only the food name is sent to Cloudflare's image service. The pictures are public and shared by all users. We record which account requested each one.

3.12 Other things you send us

• Feedback you send in the App: category, message and app version.
• Promo codes you try to redeem.
• Consent records: when you accept these documents in the App or on the website, we record the version of the Terms and Privacy Policy you accepted, the server time, the sign-up method and a request identifier. If you make a choice about marketing emails, we record it separately, with the version of the wording you saw. If you give or withdraw consent for health data (section 3.3), we also record that separately, with the version of the wording you saw.

3.13 Website

• Account features on liftiqsolutions.app use the same LiftIQ account and the same provider (Supabase). Your session is kept in your browser's storage: in local storage if you choose "Keep me signed in", otherwise only for the browser tab. Your theme preference is also kept in the browser.
• Website analytics. Only the home page (English and Spanish) uses HeyCatch to measure visits, clicks and referral sources, including which campaign link brought you to the App Store. HeyCatch collects a pseudonymous visitor and session identifier, device and browser information, and request information such as IP address. It uses PostHog as its analytics infrastructure. No other page of the website, including the account pages, loads analytics. We do not use advertising cookies.

3.14 On your device

The App keeps some data on your phone so it works offline and stays fast: active and completed workouts, your AI Coach conversation, reminder settings and cached account data. Most account-specific caches are cleared when you sign out. Your login session is kept in the device's secure storage.

4. Why we use your data

• To provide the Service: account, plans, logs, coaching and AI features.
• To personalize training plans, macro targets and coaching, and to keep them safe given your health conditions and injuries.
• To check that you are 18 or older.
• To manage subscriptions and enforce usage limits.
• To understand how features are used and improve them (analytics), and to find and fix errors (Sentry).
• To contact you about your account and the Service.
• To record which version of our documents you accepted, and your marketing choice.

We do not sell your personal data.

5. Who receives your data (service providers)

These providers process data for the purposes above, under their contractual terms with us. Each also has its own privacy policy. When you open an Instacart shopping link, or sign in with Apple or Google, those companies also apply their own privacy policies.

We do not use payment processors other than Apple and Google today. Paid human coaching is prepared in the code but is not offered to users. If it is ever offered, this policy will be updated first.

6. Sharing with a human coach

Only approved coaches who are actively connected to you can see data you share. You decide separately for each category: training, nutrition, measurements and progress photos. Every category starts turned off. Turning a category off stops new access to it. Ending or changing the coaching relationship removes the former coach's access to your record. A photo that was already opened may remain available briefly, and a coach may keep a copy they saved outside LiftIQ.

Coaching messages, check-ins and proposals are available to the people in that coaching relationship.

7. Marketing communications

We only send marketing emails (tips, product news and offers) if you give separate, optional permission:

• the box is unticked by default and is separate from accepting the Terms and this policy;
• creating an account or using the Service is not permission;
• you can withdraw at any time, and we keep a history of your choices with the wording version you saw;
• withdrawing does not affect your account.

At the time of this version, no marketing campaigns are active. Account and service messages are not marketing.

8. How long we keep data

• Account data (profile, logs, photos in your folders, coaching data, consent records and analytics events linked to your account) is kept until you delete your account. Deletion removes it, with the exceptions listed in section 9.
• Push tokens are deleted after 180 days without refresh. Push delivery records are deleted after 30 days, or after 2 days if a message was never sent.
• Food photos are not stored.
• Data on your device stays until you sign out, delete the App or clear it.
• Coaching email delivery log (recipient email, event type and date): deleted after 90 days.
• Consent records are deleted together with your account.
• Data held by our providers:
  • Sentry keeps crash and error reports for up to 90 days.
  • Groq keeps no inference requests by default, and logs kept for reliability or abuse checks last up to 30 days.
  • HeyCatch keeps analytics data while we use its service, and deletes or anonymizes it within 2 months after we stop.
  • RevenueCat keeps subscription records while your LiftIQ account exists, and we ask it to delete them when you delete your account.
  • Resend keeps email data only as long as necessary under its own policy.
  • Supabase database backups are rolling daily copies, overwritten after the backup period of our plan (at most 30 days). Data deleted from the live database disappears from backups when that period ends.

9. Deleting your account

You can delete your account in the App (Profile → Delete Account). This permanently deletes your account and the data linked to it in our database. That includes your profile, workout history, nutrition logs, body measurements, personal records, plans, coaching data, physique estimates, consent records and analytics events. We also delete your photo files: profile, coach photo, progress, check-in and physique photos. If you signed in with Apple, we revoke LiftIQ's access to your Apple account.

• Active subscriptions are not cancelled. Cancel them in your device's subscription settings.
• Shared food images are not linked to you and stay.
• The coaching email delivery log is deleted after 90 days (section 8), and copies in database backups disappear when the backup period ends.
• We ask RevenueCat to delete your subscription records. Data held by HeyCatch and Sentry is deleted under the periods in section 8. If you want it deleted sooner, write to us and we will send the request to them; HeyCatch deletes within 30 days of a request.
• To delete an account without the App, write to [email protected].

10. Security

All connections use encryption in transit (HTTPS). Database access rules limit each account to its own data, except data you choose to share with a coach. Passwords are not stored in plain text. Progress, check-in and physique photos are kept in private storage and shown only through temporary links.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data; to object to or restrict some processing; to withdraw consent at any time; and to complain to your data protection authority. To delete your account, use the in-app option. For anything else, write to [email protected].

• California (CCPA). We do not sell personal information. You have the right to know, delete and correct your personal information, and you will not be discriminated against for using your rights. We respond to verifiable requests within 45 days. If we need more time, we may extend this once by another 45 days and will tell you why.
• EEA/UK (GDPR). Our legal bases are:

  Processing	Legal basis
  Account, plans, logs, coaching, AI features you use, subscriptions, age check	Performance of our contract with you
  Health conditions and injuries	Your explicit consent (see 3.3)
  Marketing emails	Your consent (section 7)
  Product analytics, crash reports and security	Our legitimate interest in keeping the Service working and improving it
  Record of accepted documents, and keeping records the law requires	Legal obligation and legitimate interest

  We respond to requests within one month. That period can be extended by two further months for complex requests, and we will tell you if it is. Your data is processed in the United States. Where the law requires a transfer safeguard, we rely on the safeguards in our contractual terms with our providers, such as Standard Contractual Clauses where they apply.

12. Changes to this policy

Each version of this policy has a version identifier and an effective date. When we change it, we publish a new version with a new identifier. If a change is material, we will tell you before it takes effect, in the App, on the website or by email. If a change needs your consent, for example a new use of health data, we will ask for it and will not apply the change to you without it.

13. Contact

[email protected]