Privacy Policy

This policy explains what Arclift does with your information. It covers the Arclift app for iPhone, and this website, arclift.app. Both are run by Yassine Zeriouh.

The short version

• Arclift has no account system. There is nothing to sign up for.
• Your workouts are stored on your device and synced through your own private iCloud account. We run no server of our own, and we cannot read your training data.
• Apple Health is optional and switched off until you turn it on.
• Usage analytics are on by default and can be turned off in Arclift’s settings. They never contain exercise names, notes, weights, reps or free text.
• Nothing is sold, and nothing is used for advertising or cross-app tracking.

Data you create in Arclift

Everything you log stays in a database on your device: workout names and notes, start and end times, exercises, sets, weight, reps, time, distance, RPE, rest durations, personal records, templates, custom exercises and any photos you attach to them, and your unit and progression preferences.

That database is mirrored to the private database of your own iCloud account, in a container named iCloud.io.zeriouh.arclift, so your training is available on every device signed in to the same Apple Account. This is Apple’s CloudKit service. Records in a private CloudKit database are accessible to you and not to us. We have no way to read, export or restore them.

Sync has no in-app switch. If you are not signed in to iCloud, or you turn iCloud off for Arclift in the iOS Settings app, Arclift falls back to storing everything locally and keeps working exactly the same way.

Apple Health

The Health integration is optional and off until you turn it on, and iOS asks for your permission separately on top of that. You can change or revoke it at any time in the Health app under Sharing, or in Arclift’s settings.

Arclift asks to write two kinds of data:

• Workouts, so a finished session counts toward your activity
• Estimated active energy burned for that session

Arclift asks to read five kinds of data:

• Body weight, to turn bodyweight exercises into real volume
• Heart rate, for a session’s average and peak
• Heart rate variability, resting heart rate and sleep analysis, to judge recovery

All of it is processed on your device. Health data is never used for advertising and is never included in analytics.

Recovery is scored on your device by comparing the last day against your own rolling baseline. The only thing that score is allowed to do to your training is hold a progression suggestion steady instead of increasing it. It never raises a target, never forces a deload, and missing Health data always resolves to normal training. Nothing about you is decided automatically in a way that produces legal effects or similarly significant effects, so Art. 22 GDPR does not apply, and every suggestion is a suggestion you are free to ignore.

One thing worth knowing: a few Health-derived values are saved alongside the workout they belong to, namely your body weight at the moment you finished, that session’s average and maximum heart rate, and a reference to the workout written to Health. Because they are part of the workout record, they sync to your private iCloud database with the rest of it.

Analytics

Arclift sends usage analytics through TelemetryDeck, a privacy-focused analytics provider based in the European Union. This is on by default. You can switch it off at any time in Arclift’s settings, under Privacy, Share anonymous analytics, and nothing further is sent once you do.

What is sent:

• Which parts of the app are used, such as starting a workout, completing a set, finishing a workout, opening the summary, exporting a share card, or viewing and dismissing the paywall
• Coarse numbers attached to those events, such as how many exercises or sets a session had, how long it lasted, how many personal records it produced, and which plan type was selected
• Your onboarding answers as fixed categories, such as goal, experience level, equipment and preferred session length
• Reliability events when an operation fails, reduced to a stage and an error code with the original message deliberately discarded
• Standard technical context collected by the analytics library: platform, operating system version, app version and build, device model, screen size, language, region, time zone, and whether the build came from the App Store or TestFlight
• An installation identifier derived from Apple’s vendor identifier, hashed on your device and salted again by the provider. It carries no identity and it changes if you delete and reinstall the app.

Because some of those counts describe a workout, Apple classes this as fitness data on the App Store privacy label. It means the shape of a session, never its contents: how many sets, how long, how many records, and never which exercise, which weight or how many reps.

What is never sent:

• Exercise names, workout or template names, and any note or free text you type
• Weights, reps, distances, times or any other value from a set
• Any Health data
• Identifiers for your workouts, templates, exercises or sets
• Prices, product identifiers, transaction identifiers or receipts
• Your name, email address, precise location, contacts, photos or file paths

Two independent filters enforce this before anything leaves the device: an allowlist of permitted property names, and a scrubber that strips anything matching a name, note, weight, rep count, identifier or path pattern.

The in-app toggle calls this anonymous, which is how it behaves in practice: we cannot tell who you are from it. To be precise about the legal term, though, the events carry a persistent installation identifier, so under the GDPR they count as pseudonymous rather than anonymous data. Arclift contains no advertising identifier, no App Tracking Transparency prompt and no cross-app or cross-site tracking of any kind.

Purchases

Arclift Pro is an in-app purchase. Apple processes the payment, and we never see or handle your card, billing address or Apple Account details.

Subscription state is managed for us by RevenueCat, so that a purchase you make on one device is recognised on another. RevenueCat receives the App Store transaction information, the product and offering identifiers, and standard app and device context such as app version, operating system version, device model, country and whether the purchase is a sandbox one. It generates an anonymous identifier for the installation. Arclift never gives it an email address, a name or any account identifier, because it has none to give.

Notifications

Rest alerts and the reminder about a workout you left running are local notifications, scheduled on your device by the app itself. Arclift has no push notification capability and no notification server, so nothing about them leaves your phone.

Camera and photos

If you make a share card, you can pick a photo from your library or take a new one. The card is composed entirely on your device and handed to the iOS share sheet or saved to your photo library when you ask for it. Your photos are never uploaded to us or to anyone else.

Exercise videos

Exercise demonstration videos ship with the app as on-demand resources and are downloaded from Apple’s servers the first time you need them. No third party is involved and no information about what you watched is collected.

This website

arclift.app is a set of static pages. It sets no cookies, runs no analytics, embeds nothing from another site and asks you for nothing. Like any web server, our hosting provider records a technical log of requests, which typically includes your IP address, the page requested, the time, the referring page and your browser’s user agent. Those logs exist to deliver the site and to detect abuse, and they are kept only for as long as the provider needs them for that purpose.

Why we are allowed to process this

The GDPR requires a legal basis for each purpose. Ours are:

• Running the app you asked for (Art. 6(1)(b) GDPR, performance of a contract): storing your workouts on your device, syncing them to your own iCloud account, and delivering Arclift Pro to you once you have bought it.
• Your consent (Art. 6(1)(a) and, for health data, Art. 9(2)(a) GDPR): reading from and writing to Apple Health, and sending usage analytics. You can withdraw either at any time, in Arclift’s settings or in the Health app, with effect for the future.
• Our legitimate interest (Art. 6(1)(f) GDPR): keeping the app reliable through the coarse failure reports described above, delivering this website, and defending against abuse of it. Our interest is in a working product; the data involved is minimal and carries no identity.
• Legal obligations (Art. 6(1)(c) GDPR): where tax or commercial law requires records of a purchase to be retained, that retention is Apple’s and RevenueCat’s, not ours.

Who else receives data

We use these processors, and no others:

• Apple, for iCloud sync, Health, the App Store and video delivery
• RevenueCat, for subscription and entitlement management
• TelemetryDeck, for usage analytics, unless you turn it off
• Our hosting provider, for serving this website

We do not sell your information, we do not share it with advertisers or data brokers, and we do not use it to build a profile of you. We may disclose information if a law or a valid legal request requires it, though in practice we hold almost nothing that could be disclosed.

How long anything is kept

Your workout data lives on your device and in your iCloud account for as long as you keep it. Deleting the app removes the local copy; deleting the app’s data from iCloud in the iOS Settings app removes the synced copy. Analytics events are kept only as long as they are useful for understanding how the app is used, and are deleted on the retention schedule of our TelemetryDeck plan; they carry no identity, so they cannot be traced back to you individually. Subscription records are retained by RevenueCat and Apple for as long as needed to service the purchase and to meet their legal obligations. Website request logs are kept for the short period our hosting provider needs them to operate and secure the service.

Your choices

• Stop analytics: in Arclift’s settings, under Privacy, Share anonymous analytics. Past events carry only an installation identifier and no identity, so we have no way to find yours in order to delete it.
• Stop Health access: turn the Health integration off in Arclift’s settings, or revoke it in the Health app.
• Stop iCloud sync: turn Arclift off under iCloud in the iOS Settings app, or sign out of iCloud.
• Delete everything: delete the app, and delete its iCloud data in the iOS Settings app under your Apple Account, iCloud, Manage Account Storage.
• Manage your subscription: the iOS Settings app, your Apple Account, Subscriptions, or from the Arclift settings screen.

Your rights

If you are in the EU or the EEA, the GDPR gives you the right to ask us for a copy of the personal data we hold about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to have its processing restricted (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on our legitimate interest (Art. 21). Where processing rests on your consent, you can withdraw that consent at any time with effect for the future (Art. 7(3)), without affecting what was lawful before you withdrew it.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, where you work, or where you think the problem happened.

In practice, the data most people care about is the training data, and that is the part we genuinely cannot reach: it sits on your device and in your own private iCloud database. Write to us anyway and we will do whatever we can, and tell you plainly where our reach ends.

Children

Arclift is not directed at children. Because Apple Health access and usage analytics rely on your consent, and Art. 8 GDPR sets the age for giving that consent at 16 in Germany, we ask that anyone under 16 use Arclift only with a parent’s or guardian’s involvement. We do not knowingly collect personal data from children.

International transfers

Apple processes iCloud, Health and App Store data in its own global infrastructure. TelemetryDeck is based in the European Union, so analytics stay in the EU. RevenueCat is based in the United States, so subscription data reaches the US. Where a transfer leaves the EEA, it is covered by the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, together with the relevant provider’s own supplementary measures. You can ask us for a copy of the mechanism that applies to a given transfer.

Changes to this policy

If this policy changes in a way that matters, the date at the top of the page changes with it, and material changes will be noted in the app’s release notes.

Contact

Questions about privacy go to support@arclift.app. The controller within the meaning of Art. 4(7) GDPR is Yassine Zeriouh.

We have not appointed a data protection officer. Arclift is run by one person, the training data never reaches us, and neither large-scale monitoring nor large-scale processing of special-category data is a core activity, so the thresholds in Art. 37(1) GDPR are not met.