Privacy Policy

1. Data controller

The controller is Federico Mengascini (Italy). For any privacy question or to exercise your rights, write to [email protected].

2. Data we process

We only process the data needed to run the service:

• Account: email, name (optional), password stored only as a hash, sign-up date, preferred language, role.
• Sign in with Apple or Google: the account identifier and the email the provider shares with us. We never receive your Apple or Google password.
• Training profile: goal, experience level, days per week, equipment, weight unit and any injuries or limitations.
• Training data: plans, days, exercises, sets, reps, weights, durations, notes, sports activities, feedback and the history of plan changes.
• Sessions and devices: access tokens, last-used date and user agent (device and browser type), to show where you're signed in and let you sign out.
• Push notifications: the device token and your notification preferences (reminders, time, time zone).
• Connected AI assistants: client name, granted permissions, connection and last-used dates.
• Messages you send us: name, email and text from the contact form on the website, or of the emails you send to Liftful addresses.
• Activity log: a list of operations on your account (for example plan changes, sign-ins, connections), visible to you in the Account section.
• Technical data: server logs and application errors, which may include IP address, request date and time and device information.
• iOS app update checks (App Control): a random installation identifier, generated by the app and not linked to your account or device, together with the app version, iOS version and distribution channel (App Store or TestFlight).

3. Health-related data

Injuries, limitations and some training data may reveal information about your health. You enter them yourself, they are always optional and are used only to tailor plans and exercises. We process them on the basis of your explicit consent, which you give by entering them and can withdraw at any time by deleting them from your profile or deleting your account.

4. Why we process data and on what basis

• Providing the service (account, plans, workout logging, progress, sync between app and web): performance of a contract.
• Sending necessary emails (sign-in links, codes, email verification): performance of a contract.
• Answering the messages you send us (contact form or email): your request and legitimate interest.
• Sending push notifications you turned on: consent, which you can withdraw in the app or iOS settings.
• Sharing your data with an AI assistant you connected: your request and consent, which you can withdraw by disconnecting the assistant.
• Security, abuse prevention and fixing errors: legitimate interest.
• Checking whether an iOS app update is available or required, rolling out new versions gradually and counting the versions in use in aggregate (App Control): legitimate interest.
• Complying with legal obligations: legal obligation.

5. AI assistants

If you connect an AI assistant (for example Claude, ChatGPT, Codex or Cursor), it can read and, if you allow it, change your account data within the permissions you approve. Data the assistant receives is also processed by the assistant's provider under its own privacy policy, which we don't control. You can view and revoke connections at any time in the AI assistants section.

6. Who we share data with

We don't sell your data or use it for advertising. We only share it with providers that help us run the service, acting as data processors:

• Hosting and database providers, which host the server and the data.
• Resend, the email service we use to send sign-in and service emails and to receive contact form messages and emails to Liftful addresses.
• Google Firebase Cloud Messaging and Apple Push Notification service, to deliver push notifications.
• Apple and Google, only if you choose to sign in with their account.
• Sentry, to collect application errors so we can fix them.
• App Control, the service the iOS app uses to check for updates, run by the controller at federicomengascini.com and hosted by a hosting provider. It only receives the technical data described in section 2, never your email, name or training data.

7. Transfers outside the European Union

Some providers (for example Google, Apple, Resend and Sentry) may process data in the United States or other countries outside the European Economic Area. In these cases the transfer relies on a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or on standard contractual clauses.

8. How long we keep data

We keep account and training data for as long as your account exists. When you delete your account we permanently delete plans, workouts, feedback, sessions and connections. Expired or revoked access tokens, sign-in links and codes are deleted automatically within a few days. Technical logs and errors are kept only as long as needed for security and troubleshooting, and any backups are overwritten periodically.

9. Cookies and local storage

The web dashboard only uses technical cookies: session cookies to keep you signed in and one cookie to remember your language. We don't use profiling cookies or third-party analytics or advertising tools, so no consent banner is needed. The iOS app stores access tokens on the device (in the iOS Keychain), your preferences, a copy of your data for offline use and the random installation identifier used by App Control, which is removed when you delete the app.

10. Your rights

Under Regulation (EU) 2016/679 (GDPR) you can request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. You can withdraw consent at any time, without affecting earlier processing. You can do many of these things yourself in the app or the dashboard (editing your profile, disconnecting assistants, signing out devices, deleting your account); for anything else write to [email protected]. You also have the right to lodge a complaint with a supervisory authority, such as the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or the authority where you live.

11. Minimum age

Liftful is not intended for anyone under 14 (or the minimum age required in your country). If we learn an account belongs to someone younger, we delete it.

12. Security

Communications are encrypted (HTTPS), passwords are stored as hashes and access tokens have a limited lifetime and can be revoked. No system is 100% secure: if a breach affecting you occurs, we will notify you as required by law.

13. Changes

We may update this policy. If there are significant changes we will let you know by email or in the app. The date of the last update is shown at the top.