Privacy Policy

IndexFit ("IndexFit", "we", "us" or "our") makes a training app for iPhone and Apple Watch with an AI coach called Indy and leagues you play with friends. This policy explains what information we collect, how we use it, who we share it with, and the choices you have.

1. Information we collect

Account

When you sign in with Apple, we receive a unique identifier and, if you choose to share them, your name and email address (or Apple's private relay address). You can also add a profile name, bio and photo.

Training

The workouts, exercises, sets, reps, weights, runs, distances, splits, programs and personal records you log, plus the Apple Health data you choose to share (see Apple Health).

Food

The foods you log, the meal photos you take or choose, and your calorie and protein targets.

Indy, the AI coach

If you use Indy: your messages (including dictated text, which Apple's speech recognition turns into text before it reaches us), the photos and videos you attach, your goals, the coaching notes Indy keeps about your preferences, and your onboarding answers, such as age, sex, height, weight, training experience, injuries and anything else you tell it. We also keep a record of how much AI each account uses, so we can apply the monthly AI allowance that comes with Pro.

Leagues, groups and messages

League, group and competition memberships, the messages you send in group chats and direct messages, badges, points and standings, and any reports you make about other users.

Location

When you record a run, the app uses your precise location during that run to map your route, distance and pace. The route stays on your device and in Apple Health. We don't send your location to our servers, and we don't track your location at other times.

Invite links

If you install IndexFit from a league invite link, the app checks your clipboard once on first launch for that invite, so it can take you straight to the league. It only looks further if the clipboard seems to hold a web link, and it uses nothing from the clipboard except an IndexFit invite code.

Imported workouts

The links, text, images, spreadsheets or social posts (for example from TikTok or Instagram) you submit so we can turn them into a routine you can track.

Purchases

Your subscription status, trial status and purchases such as extended use. Apple processes all payments, so we never receive your card details. If you verify student pricing, we receive the school email address you enter and send a one-time code to it.

Device and usage

Basic technical information such as app version, device model, iOS version, crash and diagnostic logs, your push notification token, and how features are used, so we can keep the app working and improve it.

2. Apple Health

IndexFit reads data from Apple Health only after you give permission. Depending on what you allow, this can include workouts, heart rate, heart rate variability, resting heart rate, cardio fitness (VO2 max), active energy, exercise minutes, steps, distance and sleep. IndexFit can also save the workouts and runs you record to Apple Health.

• We use Health data to show your stats, score your leagues, and coach you through the features you choose to use.
• We never use Health data for advertising or marketing, and we never sell it.
• AI coaching: only if you allow it, the Health data you choose is sent to our AI providers so Indy can coach you (see Indy and other AI features). You can pick which Health categories Indy may use, or turn sharing off, under AI coaching in Settings.
• Apart from that, Health data is shared only with the service providers that store your account and run the app, and never for advertising.
• You can change or remove IndexFit's access to Apple Health anytime in iOS Settings, under Privacy & Security, then Health.

Our use of information received from HealthKit follows the App Store Review Guidelines and the Apple Developer Program License Agreement, including the HealthKit rules.

3. How we use information

• To run the app: logging workouts, runs and food, scoring, leagues, competitions, groups and messages.
• To work out points, spot personal records and keep standings.
• To sync your data across your devices and back it up.
• To run the AI features you choose to use, with your permission (see below).
• To manage subscriptions, free trials, student pricing and AI allowances.
• To send you service messages and, if you allow them, push notifications.
• To contact you about a prize if you win a competition.
• To review reports, prevent abuse, fix problems and improve the app.

4. Indy and other AI features

IndexFit's AI features are Indy, our AI coach (chat, plan building, goal check-ins, check-ins after workouts and runs, morning and evening briefings, and suggestions on the Home tab), calorie estimates from meal photos and descriptions, the routine builder, and importing workouts from text, images, spreadsheets and social posts.

We ask first

The app asks for your permission before any of your data is first sent to an AI provider, and explains what is sent. You can turn this off anytime in Settings under AI coaching, with Share with AI. While it is off, no new data is sent to AI providers and daily coaching stops.

What is sent

To answer you and coach you, the AI may receive:

• What you write or say to Indy, and the photos and videos you attach, including meal photos.
• Your workouts, runs, programs, plans, goals and food logs.
• The Apple Health data you allow, such as sleep, steps, heart rate and cardio fitness.
• Your onboarding answers, such as age, sex, height, weight, experience and injuries, and the coaching notes Indy keeps.

Who processes it

We send AI requests through OpenRouter, Inc., which passes them to the companies whose models we use. Today these are Google (Gemini), Anthropic (Claude), Meta (Muse Spark), Z.ai (GLM), Typesafe (Jev), and OpenAI, which turns Indy's coaching notes into a search index so Indy can find them, and transcribes the audio of social posts you import. We may change models over time and will keep this list current.

How it is used

• Only to answer your requests, build and adjust your plans, estimate calories and coach you.
• We send AI requests only to providers that do not train their models on your data. Providers may keep requests for a short time for security and abuse monitoring, under their own terms.
• AI requests are never used for advertising, and we never sell this data.
• Your chats with Indy, your goals and Indy's coaching notes are stored in your IndexFit account so they sync across your devices. You can delete chats and coaching notes in the app, or everything by deleting your account.

AI can make mistakes. Indy's coaching and calorie estimates are general fitness information, not medical advice. Talk to a doctor before starting a new training or diet plan, especially if you have an injury or a medical condition.

5. How information is shared

• With other people in the app: other IndexFit users can find your profile name, photo and bio. Your badges, points and standings are visible to members of the leagues, groups and competitions you join, and messages are visible to the people you send them to.
• With Strava, if you connect it: when you choose to share a workout, or turn on auto-share, the app posts a summary to your Strava account straight from your phone: its name, type, start time, duration, distance and description. It never sends your route. You can disconnect Strava in Settings.
• With service providers: companies that run parts of IndexFit for us (see below).
• With AI providers: only when you allow it, as described in Indy and other AI features.
• For legal reasons: when required by law or legal process, or to protect the rights, safety and property of IndexFit, our users or others.
• If the business changes hands: as part of a merger, acquisition or sale of assets, under this policy.

We do not sell your personal information.

6. Service providers

• Supabase stores your account and app data and handles sign-in.
• Heroku (Salesforce) runs the servers that handle AI features, imports and account requests.
• RevenueCat manages in-app purchases and subscription status. Apple handles payments.
• OpenRouter and the AI companies listed in Indy and other AI features, only with your permission.
• Meta receives app install and launch events so we can tell which ads bring people to IndexFit. Where iOS requires it, this happens only if you allow tracking when the app asks.
• Resend sends emails such as student verification codes, and Apple delivers push notifications.
• Strava, only if you connect it, as described above.

These providers may use your data only to provide their services to us.

7. Keeping and deleting data

We keep your information while your account is active or as needed to run the app. You can delete your account anytime in Settings, or by emailing us. Deleting your account deletes your data from our systems, including your AI chats, goals, coaching notes and food logs, and removes IndexFit's Sign in with Apple access. Copies in backups are removed within a reasonable time, except where we must keep information to meet legal obligations or resolve disputes.

8. Your choices and rights

• Access and portability: ask us for a copy of your personal data.
• Correction: edit your profile in the app.
• Deletion: delete your account and its data in Settings, or ask us to.
• Apple Health: change or remove access in iOS Settings at any time.
• AI sharing: turn off Share with AI under AI coaching in Settings, and choose which Health categories Indy may use.
• Strava: disconnect it in Settings.
• Tracking: allow or deny tracking for IndexFit in iOS Settings, under Privacy & Security, then Tracking.
• Notifications: turn push notifications off in iOS Settings.
• Blocking and reporting: block or report anyone from their profile or a message.

Depending on where you live, laws such as the GDPR or the CCPA may give you more rights. To use any of them, email contact@indexfit.app.

9. Security

We protect your information with encryption in transit, access controls and authenticated APIs. No way of sending or storing data is completely secure, so we can't guarantee absolute security.

10. Children

IndexFit is not meant for children under 13 (or the minimum age where you live), and we don't knowingly collect personal information from them. If you think a child has given us information, contact us and we'll remove it.

11. Changes to this policy

We may update this policy from time to time. When we make important changes, we'll update the date at the top and, where appropriate, tell you in the app.

12. Contact us

Questions about this policy or your data? Email contact@indexfit.app or visit Support.