Privacy Policy
IronLog is a workout tracker. This page explains what information the app keeps, who can see it, and how to remove it. We don't sell your information or show ads.
Using IronLog without an account
If you continue as a guest, everything you log stays in your browser's storage on that device. Nothing is sent to our servers, except an equipment photo if you use photo identification, which needs an account.
What we store when you have an account
| Information | Why |
|---|---|
| Email address, display name and password (stored only as a salted hash) | To sign you in |
| Workouts, sets, notes, journal entries and moods | To sync your training between devices |
| Meals, calories, macros and nutrition targets | To sync nutrition tracking |
| Goal, days per week, equipment, theme and coach settings | To build plans and remember your preferences |
| Gym memberships, assigned programmes and trainer notes | If you join a gym or train clients |
| Friend codes, friendships and workouts you choose to share | For the social features |
| Form-check videos you record, and a still frame from each one | To keep a clip with the exercise it belongs to |
| Short-lived counters tied to your email or network address | To block password guessing and limit AI usage. They expire within 24 hours. |
Sign-in tokens last up to 90 days, or until you sign out.
Who can see your information
- You. Everything above.
- Your gym, if you join one with an invite code. The gym's owner, and the trainer you're assigned to, can see your name, email address, your last 60 logged workouts (including set notes), your form-check videos, the programme they assigned, and notes they write about you. They cannot see your journal, meals or nutrition. If you're locked out, they can give you a one-time code to set a new password; the app tells you whenever one is used and who issued it. Leaving the gym ends all of this.
- Friends you accept. Your name, goal, session count, last active date, current streak and heaviest lift. Nobody sees these until you accept their request.
- Anyone with a share link you create. The shared exercise, its sets and date, and your first name. Deleting your account removes your share links.
Services that process your information
- Cloudflare hosts the app, the database, the exercise images and form-check videos.
- Anthropic provides the AI features. If your account has the AI coach, your recent history for an exercise (dates, weights and reps) is sent to generate a note. If you use equipment photo identification, the photo is sent to identify the equipment. We keep the result and a fingerprint of the photo, not the photo itself. Under Anthropic's commercial terms, this data isn't used to train its models.
- Stripe handles gym subscription payments. If you pay for a gym, your card details go straight to Stripe — IronLog never sees or stores them. We keep only Stripe's customer and subscription references and whether the subscription is active.
- Resend sends IronLog's emails — password reset links, "your password was changed" notices, and, if you train with a gym, an email when your trainer replies on a clip or assigns a programme (at most one every half hour; turn these off in Profile or from the link in any of them) — so it receives your email address and the message. We don't use it for marketing, and links in our emails aren't tracked.
- Google Fonts serves the app's typefaces, so your browser contacts Google when the app loads.
Form-check videos
A form check is a short video you record of a set. It is stored privately: it is never listed publicly, never indexed, and can only be opened through a link that this app generates and that stops working after a few hours. Nobody can watch it except you and, if you're in a gym, that gym's owner and your assigned trainer.
- Clips are kept until you delete them. Deleting a clip, or your account, removes the video file.
- Each account can store up to 1 GB, and up to 20 clips a day.
- Film only yourself. Other people in a gym haven't agreed to be recorded, and many gyms don't allow filming on the floor — check before you record.
Your choices
- Export: Profile → Export My Data downloads your workouts, journal, meals and settings as a file.
- Delete items: deleting a workout, journal entry, meal or form-check clip removes it from our servers too.
- Delete your account: Profile → Delete my account permanently removes your account and everything linked to it. Database backups age out within 30 days.
- Leave a gym or remove a friend at any time.
Security
Connections are encrypted (HTTPS). Passwords are hashed with PBKDF2, and repeated failed sign-ins are locked out. No system is perfectly secure, so use a password you don't use anywhere else.
Children
IronLog isn't meant for children under 13, and we don't knowingly collect their information.
Changes
If this policy changes in a way that matters, we'll update the date above and tell you in the app.
Contact
For privacy questions, or to ask for a copy or deletion of your data, email support@danielbuilds.org. If you train with a gym, you can also ask your gym.