Privacy Policy
Last updated: 2026-10-14
1. Who we are
Lock That Fitness In is operated by LTFI Global LLC, a limited liability company in California, USA. This policy covers the Lock That Fitness In iOS app and this website.
Privacy questions and rights requests: privacy@ltfi.global. General support: support@ltfi.global.
2. The short version
- An account is required to use the app. Your training data is stored on your device first and synced to that account.
- We never sell your data, and we never use your health or fitness data for advertising or marketing.
- Health data never influences which products we show you anywhere in the app or on this site.
- You can delete your account and data from inside the app at any time.
3. What we collect, why, and how long we keep it
| Category | Source | Purpose | Recipients | Retention |
|---|---|---|---|---|
| Account — email address, user ID | You, or Sign in with Apple / Google | Authenticate you and sync your data across your devices | Supabase | Until you delete your account |
| Training — workouts, exercises, sets, reps, weights, RPE, personal records | You | Show your history and progress; generate and adjust future workouts | Supabase | Until you delete it or your account |
| Body metrics — body weight, measurements | You, or Apple Health | Progress charts and load calculations | Supabase | Until you delete it or your account |
| Nutrition — calories, protein, carbohydrates, fat, water, fiber | You, or Apple Health | Daily macro tracking against your targets | Supabase | Until you delete it or your account |
| Sleep and recovery — sleep duration, energy, soreness | You, or Apple Health | Adjust training volume when you are under-recovered | Supabase | Until you delete it or your account |
| Supplements — what you take and when | You | Daily checklist and reminders | Supabase | Until you delete it or your account |
| Public profile — handle, avatar image (optional, off by default) | You | Let other users find and follow you | Supabase; Sightengine for automated image moderation | Until you turn it off or delete your account |
4. Apple Health (HealthKit) — read only
If you grant permission, the app reads the following specific data types from Apple Health. It does not write anything back to Apple Health.
- Body mass (weight)
- Sleep analysis
- Dietary energy (calories)
- Dietary protein
- Dietary carbohydrates
- Dietary fat
- Dietary water
- Dietary fiber
- Workouts
- Step count
You can revoke this access at any time in the iOS Settings app under Privacy & Security → Health, or inside Lock That Fitness In. Revoking stops future reads; data already imported stays until you delete it.
We never use health or fitness data for advertising, marketing, or use-based data mining, and we never allow any third party to do so. Health data is never used to decide which products, supplements, or offers you are shown. We do not store your health information in iCloud.
5. Where your data is stored
Your data is stored on your device and, when you have an account, replicated to our database hosted by Supabase in Amazon Web Services'us-east-2 region (US East, Ohio, United States). Data in transit is encrypted with TLS, and access is restricted by row-level security so one account cannot read another's data.
6. Third parties who process your data
We use a small number of service providers. We do not sell your data to anyone.
- Supabase — database, authentication, and file storage (United States,
us-east-2). - Sightengine — automated moderation of avatar images, only if you upload one to a public profile. Your avatar image is sent to Sightengine for an automated check. No other data is sent.
- Apple — app distribution and, if you use it, Sign in with Apple.
- Resend — our email provider (United States). It holds the launch list described in section 7, and nothing from the app.
- Cloudflare — hosts this website and runs the bot check on its sign-up form (section 7). No app data.
We confirm that each third party listed above provides the same or equal protection of user data as stated in this privacy policy. We require this contractually before any user data is shared.
7. This website
This site uses no analytics, no trackers, and no advertising pixels. The only cookie the site itself sets is a pre-launch access cookie, set only if you enter a site password, which stores no personal information. We do not load webfonts.
Launch list. If you enter your email address on our home page to be told when the app launches, we store that address, which platform you ticked (iPhone, Android or both) and the time you signed up, as a contact record with Resend, our email provider (United States). We use it only to send you launch news for the platform you picked, and we do not share or sell it. Every email we send to the list carries an unsubscribe link, which marks your record unsubscribed; to have the record deleted outright, email support@ltfi.global.
Bot check. The sign-up form runs Cloudflare Turnstile, which loads a script from Cloudflare and processes only what it needs to tell a person from an automated program. It does not read what you type into the form. Cloudflare describes its handling in the Turnstile privacy addendum.
8. How long we keep data and how to delete it
We keep your data until you delete it. You can delete your account and all associated data from inside the app — see Delete Your Account for the exact steps and what gets removed. Backups are purged on a rolling basis within six months.
9. Your rights and choices
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop processing it, and you can withdraw a permission you previously granted. Email privacy@ltfi.global. We respond within 45 days and may extend once by a further 45 days where a request is complex. We do not charge for this, and we will not treat you differently for asking.
If you are unhappy with how we handled a request, you may complain to your local data protection or consumer protection authority.
Washington residents, and anyone whose consumer health data is collected in Washington, have additional rights described in our Consumer Health Data Privacy Policy.
10. Nevada residents
This section is provided for Nevada consumers under NRS 603A.
- Categories of health-related data we collect: training and workout records, body weight and measurements, nutrition macros, sleep and recovery inputs, supplement intake, and data you choose to import from Apple Health.
- Purpose: to provide the app's tracking, planning, progress, and workout-generation features to you.
- How we use it: to display your history, calculate progress and training load, and adjust generated workouts. We do not use it for advertising or marketing.
- Categories of sources: directly from you through the app, and from Apple Health if you grant permission.
- Categories of third parties with whom we share it: our cloud database and authentication provider, and an automated image moderation provider if you upload an avatar. See section 6.
- Manner of processing: data is stored on your device and replicated to our cloud database in the United States, where it is access-controlled per account and used only to operate the features above.
- Whether we collect health data from a third-party website or application: we do not collect your health data from any third-party website or application other than Apple Health, and only with your permission.
- How to exercise your rights: email privacy@ltfi.global to confirm, access, or delete your consumer health data, or to withdraw consent.
- Process for material changes: we will notify you by email or in the app before a material change takes effect, and update the date at the top of this policy.
- Effective date of this section: 2026-10-14.
11. Children's privacy
Lock That Fitness In is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has given us data, email privacy@ltfi.global and we will delete it.
12. Changes to this policy
If we make a material change we will notify you in the app or by email before it takes effect, and we will update the "Last updated" date at the top of this page.
13. Contact
LTFI Global LLC
California, USA
privacy@ltfi.global