APEX is a fitness app. To build you a training program it has to know things about your body, and to track your progress it has to remember what you lifted. This policy explains exactly what is collected, why, who else sees it, and how to get it back or get rid of it.
- APEX runs no advertising and no analytics SDK. Nothing you do in the app is sold, shared with data brokers, or used to track you across other apps and websites.
- Your health and fitness data is used to build your program and show your progress. That is all.
- Messages you send to the AI coach are processed by OpenAI — see section 5.
- You can export or delete everything, at any time, by emailing us.
1. Who we are
APEX (“APEX”, “we”, “us”) is the data controller for the information described in this policy. That means we decide what is collected and why, and we are accountable for it under the UK GDPR and the EU General Data Protection Regulation.
APEX is published at apexlifestyle.app. You can reach us at privacy@apexlifestyle.app.
2. What we collect
Everything below is data you type into the app, or a direct record of something you did in it. APEX does not read your contacts, your photos, your calendar or your location, and it asks for no permission to do so.
| What | Examples | Why | Lawful basis |
|---|---|---|---|
| Account | Email address, display name, password (stored only as a hash) | To create your account and sign you in | Contract |
| Profile | Age, gender, height, current and target weight, current and target physique, training experience, available equipment, training days and session length, preferred split | To build a program that fits you and to set your starting loads | Contract |
| Health & limitations | Injuries and problem areas you flag, including heart conditions and pregnancy, and anything you write in the free-text notes field | To avoid or substitute exercises that are unsafe for you | Explicit consent — see section 3 |
| Workout data | Sessions, exercises, sets, weights, reps, session duration, personal records, streaks | To track your training and progress your loads over time | Contract |
| Body measurements | Body weight you log over time | To show your weight trend against your target | Explicit consent — see section 3 |
| Coach conversations | The questions you ask the AI coach and its replies | To answer you, and to keep your conversation history | Contract |
| Subscription | Trial start date, plan, status, renewal date, and an anonymous purchase identifier | To know what you are entitled to use | Contract |
| Notifications | A device push token, plus your reminder preferences | To send the training reminders you switched on | Consent — you turn them on, and can turn them off |
| Technical | Server logs kept by our hosting provider, which include IP address and timestamps | Security, abuse prevention and debugging | Legitimate interests |
We do not collect payment details. If you subscribe, Apple or Google takes the payment and we never see your card number, billing address or any part of it. We are told only that a valid subscription exists and when it ends.
3. Health data, specifically
Some of what APEX holds is special category data under Article 9 of the GDPR — data concerning health. That includes any injury or condition you flag, anything you write in the limitations notes, your body weight history, and, taken together, your training records.
We process it on the basis of your explicit consent, which you give during onboarding when you accept the health notice. It is used for one purpose: adapting what the app recommends so that it does not tell you to do something that is unsafe for you.
Every health field in APEX is optional. You can skip the limitations step entirely, pick “prefer not to say” for gender, and never log your body weight. The app works with less information; it simply cannot adapt around a problem it does not know about. Withdrawing consent later means deleting that data — see section 9 — and the app will stop adjusting for it from that point on.
4. How we use it
- To generate and adjust your training program.
- To show your history, charts, streaks and personal records.
- To give the AI coach enough context to answer you specifically rather than generically.
- To send the reminders you asked for.
- To know whether your trial or subscription is active.
- To keep the service secure and to investigate abuse.
We never use your data to make automated decisions with legal or similarly significant effects, and we do not profile you for advertising. Program generation is automated, but it only produces exercise suggestions you are free to ignore.
5. The AI coach and OpenAI
The AI coach is not a feature that runs on your phone. When you send it a message, the following is transmitted to OpenAI, which operates the language model that writes the reply:
- the message you typed;
- recent messages in that conversation, so the reply makes sense in context;
- a summary of your profile — your goal, experience level, equipment, training schedule, units, height and weight, and any limitations you have flagged.
Your name, email address and account identifier are not sent. OpenAI receives the training context and nothing that identifies you to them as a person.
OpenAI acts as our processor and is contractually prohibited from using this content to train its models. Their handling is governed by OpenAI's privacy policy and their API data-usage terms.
Simply do not use the coach. Every other part of APEX — programs, workout logging, progress, the exercise library — works without it and sends nothing to OpenAI. You can also clear your conversation history at any time from the coach screen.
6. Who else processes your data
We use a small number of service providers. Each is a processor acting on our instructions, each is bound by a data processing agreement, and none of them is permitted to use your data for their own purposes.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication and hosting | Everything in section 2 — this is where your account lives |
| OpenAI | Powers the AI coach | Coach messages and training context, as described in section 5 |
| RevenueCat | Manages subscription entitlements | An anonymous purchase identifier and your subscription status. No payment details |
| Apple / Google | Take the payment if you subscribe | Your payment details, under their own privacy policies. We never see them |
| Expo | Delivers push notifications | A device push token and the text of the reminder |
| Bunny.net | Serves exercise demonstration videos | Standard CDN request logs. The videos are the same for everyone and are not personalised |
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We will disclose data if we are legally required to, and we will tell you when we are permitted to.
7. International transfers
Some of the providers above are based in the United States, so your data may be transferred outside the UK and the European Economic Area. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, as applicable.
8. How long we keep it
- While your account exists — your profile, training history and coach conversations are kept, because losing your history is the opposite of what a training log is for.
- If you delete your account — everything listed in section 2 is deleted within 30 days.
- Backups — deleted data may persist in encrypted backups for up to a further 30 days before those backups roll off.
- Records we must keep — a minimal record of a purchase may be retained where tax or accounting law requires it. It contains no health data.
9. Your rights
If you are in the UK, the EU or the EEA, you have the right to:
- Access a copy of the data we hold about you;
- Correct anything inaccurate — most of it you can edit in the app directly;
- Delete your data (“the right to be forgotten”);
- Export your data in a portable, machine-readable format;
- Restrict or object to how we process it;
- Withdraw consent at any time, for anything based on consent — including the health data in section 3 and notifications. Withdrawing does not undo processing that already happened lawfully.
To exercise any of these, email privacy@apexlifestyle.app from the address on your account. We will respond within one month. There is no charge.
If you think we have handled your data badly, please tell us first — but you also have the right to complain to your data protection authority. In the UK that is the Information Commissioner's Office; in the EU it is the supervisory authority in your country.
10. Children
APEX is not intended for children under 13, and accounts may not be created by anyone younger. Where local law sets a higher age for consenting to online services — which in parts of the EU is 16 — a user below that age needs the consent of a parent or guardian.
If you believe a child has given us personal data without that consent, email privacy@apexlifestyle.app and we will delete the account.
11. Security
All traffic between the app and our servers is encrypted in transit with TLS. Data is encrypted at rest by our hosting provider. Access to your rows is enforced at the database level: the rules are written so that one account cannot read another's data even if the app itself were modified. Your session token is held in the operating system's secure keychain, not in ordinary app storage.
No system is perfectly secure. If a breach affects your data and poses a risk to you, we will notify you and the relevant authority without undue delay, as the GDPR requires.
12. Changes to this policy
If we change this policy we will update the date at the top. For any change that materially affects your rights or how your data is used, we will tell you in the app before it takes effect.
13. Contact
Privacy questions, data requests and complaints:
privacy@apexlifestyle.app
Everything else: support@apexlifestyle.app