Privacy policy

Last updated: April 2026 (v1.4.0)
Effective date: April 2026

What changed in v1.4.0: We removed date of birth, gender, height, weight, and profile photos as collected fields. Liftio now collects only your name, email, and workout data. See Section 3.2.

1. Who we are

Liftio is operated by MGKCodes Ltd, a company registered in England and Wales.

Contact:
Email: hello@mgkcodes.com
Website: https://www.mgkcodes.com

For all privacy-related enquiries, including requests to access, correct, or delete your data, contact us at hello@mgkcodes.com.

2. Who this policy applies to

This policy applies to all users of the Liftio iOS application.

Age requirement: Liftio is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at hello@mgkcodes.com and we will delete it promptly.

3. What data we collect

3.1 Account data

When you sign in with Apple, we receive:

• A unique Apple-generated identifier (used as your account ID, not your email address)
• Your email address, if you choose to share it with us during Apple Sign-In
• Your name, if you choose to share it during Apple Sign-In

Apple may provide a relay email address rather than your real one. We store whichever address Apple provides.

3.2 Profile data

The only profile field Liftio collects is your display name, which you can edit at any time in Settings. The name is shown in the home greeting and in any timelapse videos you generate.

When you are signed in, your display name and unit preferences (kilograms / pounds, kilometers / miles) are stored alongside your account so they restore on a new device or after a reinstall. They are stored under your account row and are not used for any other purpose. If you delete your account, the name and unit preferences are deleted with it.

We do not collect:

• Date of birth
• Gender
• Height or weight
• Profile photos

These fields were removed in v1.4.0. The data was never used to deliver core features and was retained only as profile metadata, so we removed it on data-minimization grounds.

3.3 Workout and training data

Data generated through your use of the app:

• Workout history (date, duration, name, notes)
• Exercise records (exercise name, muscle group, category)
• Set data (weight, reps, rest time)
• Personal bests and estimated 1-rep maxes

3.4 Subscription data

We use RevenueCat to manage your subscription. RevenueCat receives:

• Your Apple-generated user identifier (not your name or email)
• Your subscription status (active, expired, trial)
• Purchase timestamps

We do not receive or store your payment card details. All payment processing is handled by Apple.

3.5 Progress photos (subscribers only)

If you are a subscribed user and use the progress photos feature, we collect:

• Photos you take using the in-app camera or select from your photo library
• Pose type labels you assign to each photo (e.g. front, side, back)
• Crop and rotation metadata you apply to photos
• Optional notes you attach to photo sessions

Photos are stored locally on your device. As a subscribed user, your photos are also backed up to our cloud servers (Supabase Storage) to enable data recovery and device migration.

Camera and photo library access: The App requests permission to access your device camera and photo library solely for the purpose of capturing and selecting progress photos. We do not access your camera or photo library for any other purpose.

Photo deletion: You can delete any individual progress photo or entire photo session at any time through the App. Deleting a photo removes it from both your device and the cloud backup. Account deletion removes all progress photos permanently.

Timelapse generation: The App can generate timelapse videos from your progress photos. This processing is performed entirely on your device. No photos are sent to external servers for this purpose.

3.6 Daily training summary (subscribers only)

If you are a subscribed user, the App may generate a daily training summary using AI. To produce this summary:

• Pre-aggregated workout statistics (e.g. number of sessions, average frequency, trending exercises, weight changes) are sent to a server-side function
• The server-side function sends these statistics to a third-party AI service (Anthropic) to generate a short text summary
• No personally identifiable information is sent. The AI receives only anonymised numerical workout statistics. Your name, email, date of birth, and other personal data are never included in the request.
• Your first name is prepended to the summary locally on your device after the AI response is received

Summaries are cached locally on your device and refreshed once per day.

Your control over this feature:

• The daily summary card on the home tab includes an info icon ⓘ — tap it to see what the feature does, what data is shared, and where to disable it.
• You can disable the daily summary at any time in Settings → Daily Summary. When disabled, no aggregated statistics are sent to Anthropic and the LLM endpoint is not called.
• A full breakdown of every AI feature in Liftio, including the data sent and the AI provider used, is available at Settings → Account → AI features.

3.7 Technical data

We may receive basic technical information when you use the app:

• App version
• iOS version
• Device type (e.g. iPhone)

We do not use advertising identifiers (IDFA) or track you across other apps or websites.

4. Why we collect this data (legal basis)

Under UK GDPR, we process your data on the following legal bases:

5. How we use your data

We use your data to:

• Provide, maintain, and improve the Liftio app
• Sync your workout history and progress photos to the cloud so you can restore them on a new device
• Generate personalised daily training summaries using anonymised workout statistics
• Verify your active subscription on each app launch
• Enable you to restore purchases if you reinstall the app
• Respond to your support requests

We do not:

• Sell your data to third parties
• Use your data for advertising
• Share your data with third parties except as described in Section 6
• Use your data to train machine learning models
• Send personally identifiable information to AI services. Only anonymised workout statistics are used for summary generation
• Perform facial recognition, body analysis, or any automated processing of your progress photos

6. Third-party services

We share data with the following third-party processors to deliver the service. Each is bound by a data processing agreement with us.

Supabase (cloud storage)

Supabase stores your account data, profile data, workout data, and progress photos in the cloud, enabling backup and restore across devices.

• Data stored: Account identifier (Apple-generated), email (if shared by Apple Sign-In), display name, unit preferences (weight / distance), workout data, progress photos
• Location: EU (primary) / US (replicated)
• Privacy policy: https://supabase.com/privacy

Anthropic (summary generation)

Anthropic provides the AI model used to generate daily training summaries. Only anonymised, pre-aggregated workout statistics are sent to Anthropic. No personally identifiable information is included.

• Data shared: Anonymised workout statistics (session counts, frequency, trending exercises, weight changes)
• Location: US
• Privacy policy: https://www.anthropic.com/privacy

RevenueCat (subscription management)

RevenueCat validates your subscription status and manages entitlements.

• Data shared: Apple-generated user identifier, subscription status, purchase timestamps
• Location: US
• Privacy policy: https://www.revenuecat.com/privacy

Apple (authentication and payments)

Apple handles Sign in with Apple and all in-app payment processing. Apple's data practices are governed by their own privacy policy.

• Privacy policy: https://www.apple.com/legal/privacy/

7. Data retention

When you delete your account through the app:

1. All your data is permanently deleted from Supabase (your account, profile, workouts, exercises, sets, and progress photos)
2. Your subscription entitlement is removed from RevenueCat

Cloud data deletion is permanent and irreversible. We cannot recover your data after account deletion.

Local data: Workout data stored locally on your device (SQLite) is retained on-device until you uninstall the app, even after account deletion. This is intentional. Your data always remains accessible locally regardless of your subscription status.

8. Your rights under UK GDPR

As a UK resident, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure— request deletion of your data (the “right to be forgotten”)
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — request your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@mgkcodes.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been handled improperly:

• Website: https://ico.org.uk
• Phone: 0303 123 1113

9. Data security

We take reasonable technical and organisational measures to protect your data:

• Data in transit is encrypted using TLS
• Supabase uses row-level security (RLS) policies. Your data is accessible only to your authenticated account
• Authentication tokens are stored securely on-device using platform-standard storage
• No passwords are stored. Authentication is delegated entirely to Apple

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data using industry-standard practices.

10. International data transfers

Your data may be stored and processed in countries outside the UK, including the United States (Supabase, RevenueCat). Where this occurs, we rely on:

• Standard Contractual Clauses (SCCs) as approved by the UK ICO
• The data processor's own certifications and compliance frameworks

11. Changes to this policy

We may update this policy from time to time. When we do:

• The “Last updated” date at the top of this page will be revised
• If changes are material, we will notify you through the app

Continued use of Liftio after changes are posted constitutes acceptance of the revised policy.

12. Contact

For any privacy questions, data requests, or concerns:

MGKCodes Ltd
Email: hello@mgkcodes.com
Website: https://www.mgkcodes.com

This privacy policy applies to the Liftio iOS application only.