The short version
We collect what we need to run the app — your lifts, your macros, your rank. We do not sell your data. We do not run ads. We never train AI models on your personal data. You can export or delete everything, any time.
This document explains exactly what LiftMax collects, why, who we share it with, and how to make it disappear. If something here is unclear, email us — we will rewrite it.
What we collect
Account
- Email address — for login and account recovery
- Username — displayed on leaderboards and to friends
- Profile photo — optional, stored securely
- Custom profile colors and biography — optional
Training & Health Data
- Workout logs: exercise, sets, reps, weight, RPE
- Personal records and strength rank history
- Body stats: height, weight, age, gender — used for calorie and BMR estimates only
- Calorie and macro entries from manual input or AI analysis
- Step count — only if you explicitly grant permission
Social
- Friend connections, follows, likes, and comments
- Shared workouts and posts
Technical
- Device model and OS version
- Anonymous usage statistics and crash reports — no personal data attached
Health data note: Workout logs, calorie data, and body measurements are treated as sensitive personal data. This data is never shared with third parties for advertising or profiling, and is used solely to provide app functionality.
How we use it
- To run your account and keep you logged in
- To compute XP, promote ranks, and render your profile
- To calculate personalized metrics: BMR, TDEE, calorie targets, strength ranks
- To power friend feeds, leaderboards, and social features
- To run AI calorie estimates on meal descriptions and photos
- To process premium subscriptions and manage entitlements
- To detect and prevent fraud, abuse, and unauthorized access
- To diagnose crashes and ship fixes
- To comply with applicable legal obligations
We do not sell your data. We do not share it with advertisers. We do not use it to train third-party AI models.
Legal basis
for processing
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases under GDPR:
- Contract performance — To deliver the core features of the Service you signed up for
- Legitimate interests — App security, fraud prevention, crash diagnostics, and service improvement
- Consent — Analytics tracking and marketing communications. You may withdraw consent at any time with no effect on prior processing
- Legal obligation — To comply with applicable laws and regulations
Third parties
We do not sell your data. We share information only with the following processors, solely to operate the Service:
International transfers
Your data may be transferred to and processed in the United States, where our service providers (Firebase, RevenueCat, Anthropic) operate their infrastructure.
We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission, consistent with GDPR Chapter V. Firebase (Google) is additionally certified under the EU–U.S. Data Privacy Framework.
Data retention
- Your data is retained for as long as your account is active
- If you delete your account, all personal data is permanently deleted within 30 days
- Anonymized, aggregated analytics data may be retained indefinitely as it cannot identify you
- Certain records may be retained longer where required by applicable law or for fraud prevention
- Food photos submitted for AI analysis are deleted immediately after the response is returned — they are never stored
You can export all your data before deletion: Profile → Settings → Data → Export.
Security
- All traffic is encrypted in transit using TLS 1.3
- Data at rest is stored within Google Firebase with infrastructure-level encryption
- Passwords are hashed by Firebase Authentication — never stored in plain text
- Access to your data is controlled by Firestore security rules and role-based authorization
- Profile photos and media are stored in Firebase Storage with strict access controls
If you discover a security vulnerability, please report it to support@liftmaxapp.com. We respond within 24 hours.
Children's privacy
LiftMax is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a user is under 13, we will immediately delete their account and all associated data.
If you believe we have inadvertently collected information from a child under 13, contact us immediately at support@liftmaxapp.com.
For users between 13 and 17, parental or guardian consent may be required depending on your jurisdiction.
Compliant with COPPA (U.S.) and applicable child protection laws.
Your rights
All users
EEA / UK users — GDPR
- Restriction — Request that we restrict processing of your data in certain circumstances
- Objection — Object to processing based on legitimate interests
- Withdraw consent — Withdraw consent at any time without affecting prior lawfulness
- Lodge a complaint — Complain to your local data protection authority. EU residents: edpb.europa.eu
California users — CCPA
- Know — The right to know what personal data we collect and why
- Delete — The right to request deletion of your personal data
- Opt-out of sale — We do not sell your personal data to any third party
- Non-discrimination — We will never treat you differently for exercising your rights
Most controls live inside the app under Profile → Settings → Data. For anything else, email support@liftmaxapp.com. We respond within 30 days at no charge.
Our pledge
Contact
Questions, complaints, data requests — one inbox, real humans. We respond to all privacy requests within 30 days at no charge.
This policy may be updated periodically. Material changes will be communicated via in-app notification before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.