Privacy Policy

Lyfta AI · Effective May 5, 2026

This Privacy Policy describes how Lyfta AI ("we", "us", "the app") collects, uses, and protects your information when you use the Lyfta AI mobile application and related services.

1. Information We Collect

To provide the app's features, we collect and store the following:

• Account information: username, password (hashed, never stored in plain text), and optional email address.
• Profile information: age, sex, height, weight, activity level, training experience, fitness goals, and related preferences you enter during onboarding.
• Activity data: food log entries, workout logs (exercises, sets, reps, weights), weight history, water intake, and mood/energy check-ins you record in the app.
• Health data (optional): if you connect Apple Health, we read steps, active energy, heart rate, resting heart rate, sleep, blood oxygen, respiratory rate, and distance. This data stays on your device and is sent to our server only in aggregate form (e.g., "sleep hours last night") to power AI insights.
• Device data: push notification tokens (if you enable notifications), app version, and basic error logs.

2. How We Use Information

• To provide core app features (workout plans, calorie tracking, AI insights).
• To authenticate you and keep your sessions secure.
• To send push notifications if you enable them (meal reminders, workout reminders, water reminders).
• To generate AI-powered feedback (meal analysis, workout progressions, pre-workout briefs). For these features we send minimal, non-identifying summaries of your data to our AI provider (OpenAI) — never your name, email, or raw logs.
• To improve the app: anonymized error reports and aggregate usage metrics.

3. How We Share Information

We do not sell your data. We share data only with:

• Our service providers who process data on our behalf under confidentiality obligations: MongoDB Atlas (database), Railway (hosting), OpenAI (AI features), Apple (push notifications), RevenueCat (subscription management).
• Your trainer, if you are a client linked to a trainer in the app. Your trainer can view your food log, workout history, weight, and check-ins. You can unlink from a trainer at any time in Settings.
• Legal authorities, when required by law or to protect the safety of our users.

4. Data Retention and Deletion

We retain your account data for as long as your account is active. You can permanently delete your account at any time from Settings → Account → Delete Account. Deletion immediately removes your user record, profile, workout logs, food logs, weight entries, meal plans, push tokens, and subscription status from our active databases. Encrypted backups are purged on a rolling 7-day cycle. Fully anonymized, aggregated metrics (e.g., "users-per-day") may be retained for product analytics.

4a. AI-Generated Content Disclaimer

Lyfta AI uses AI to generate workout suggestions, meal plans, and coaching feedback. AI output may be inaccurate or inappropriate for your individual situation. The app is for general informational and educational purposes only and is not a substitute for professional medical, nutritional, or fitness advice. Consult a qualified healthcare provider before starting any new diet or exercise program, especially if you have a medical condition, are pregnant, or are taking medication.

5. Security

Passwords are hashed with bcrypt. All traffic between the app and our server is encrypted with TLS. Refresh tokens are stored in HTTP-only cookies. We follow industry best practices, but no online service is 100% secure; please use a strong unique password.

6. Children's Privacy

Lyfta AI is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe we have collected such data, contact us at the address below and we will delete it.

7. Your Rights

Depending on where you live, you may have the right to access, correct, or delete your personal data. You can export your food log and workout history from Settings → Export Data, and delete your account from Settings → Account → Delete Account. For other requests, contact us at the address below.

8. International Users

Our servers are in the United States. By using the app, you consent to the transfer of your data to the United States, which may have data protection laws different from your country of residence.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via in-app notification or email. The "Effective" date above reflects the last update.

10. Contact

Questions, requests, or concerns: lyfta.support@gmail.com