Privacy Policy

Effective date: 15 July 2026 · Contact: support@ironpack.io

IronPack is a workout tracker and card-collecting game made in New Zealand. This policy explains exactly what data the app handles, where it lives, and what control you have over it. The short version: your training data is yours, it stays on your device unless you create an account, and we never sell data. Section 4 below lists exactly what we don't do.

1. Data the app stores on your device

IronPack works fully without an account. Everything you do is stored locally on your device:

• Workouts, exercises, sets, reps and weights you log
• Personal records and strength-standard milestones
• Your card collection, pack points, XP, streaks and quest progress
• App settings (units, training preferences, and optionally your bodyweight and sex if you enable pound-for-pound (DOTS) scoring)
• Workout history you import yourself from CSV exports of other apps

This local data is not transmitted anywhere unless you sign in.

2. Data we store if you create an account (optional)

Accounts exist for one reason: backing up your data and playing with friends. If you sign up we store, on our backend (hosted by Supabase):

• Your email address and a password (passwords are hashed; we never see them), or your Google account identity if you choose Google sign-in
• Your username and a friend code derived from your account
• A backup snapshot of your training data (the local data described above)
• Leaderboard entries: your best lifts on standardized exercises, and if you enable DOTS scoring, the computed score only - your bodyweight and sex are never shared with other users and never leave your backup
• Your friend connections and small activity events (for example "beat your bench record") shown only to your accepted friends

3. What other people can see

• Friends you accept see your username, leaderboard lifts, league standing and activity events. Nobody else does.
• Discovery is a switch you control. You appear in "people you may know" and username search only while Discoverable is on. New accounts start on, and you can turn it off any time in Friends. Only your username is ever shown - never your lifts, body weight or email. Accounts created before this default changed were not switched on; they are asked once, in the app.
• Nothing you log is ever public. There are no public profiles or feeds.

4. What we do NOT do

• No advertising, and no advertising SDKs
• No tracking across other apps or websites
• No analytics resale, no data brokers, no selling or renting data - ever
• No behavioural or usage analytics. We do not record what you tap, how long you stay, or which screens you visit
• No reading of your device contacts, photos, camera, or location

4a. Crash reports

If IronPack crashes, it sends us a report so we can fix it. A report contains the error message, the technical stack trace, your app version, and our own log of what the app's storage was doing at the time.

It does not contain your name, email, username, account ID, IP address, or anything you have logged - no workouts, no weights, no body weight. We do not use it to recognise you or your device, and it is never used for advertising.

This is the only thing IronPack sends automatically that is not your own data being backed up.

5. IronPack Pro purchases

IronPack Pro is an optional subscription (or one-time lifetime purchase). If you buy it:

• Apple handles the payment. We never see your card or payment details.
• RevenueCat manages the purchase on our behalf. It receives your subscription status (active, expired, trial) and an anonymous app user id, so your Pro access follows you across your devices. It does not receive your training data.
• Your Pro status is tied to your Apple ID, not to your IronPack account backup - so it is never shared with friends and never leaves as part of your data export.

6. Service providers

• Supabase hosts our database and authentication. They process data solely to provide the service.
• Apple processes in-app purchases; we never see your payment details.
• RevenueCat manages subscription entitlements (see above).
• Google handles sign-in only if you choose "Sign in with Google".
• Sentry receives crash reports (see section 4a). Configured with personal data collection switched off: no IP address, no cookies, no session recording, and your account is never attached to a report.

7. Your controls

Both of these are inside the app under Settings, no email required:

• Erase all data - wipes your training data locally and from your account backup (the login itself remains usable).
• Delete account - permanently deletes your account: login, username, friends, leaderboard entries and cloud backup. This is immediate and cannot be undone.

You can also export your complete data at any time (Settings → Export).

8. Data retention

Local data lives on your device until you erase it or remove the app. Account data is kept while your account exists and is deleted immediately when you delete your account.

9. Children

IronPack is a resistance-training app and is not directed at children under 13. We do not knowingly collect data from children under 13; if you believe a child has created an account, contact us and we will delete it.

10. Where we operate

IronPack is operated from New Zealand and handles personal information in line with the New Zealand Privacy Act 2020. If you are in the EU/UK, the rights described above (access via export, correction in-app, deletion in-app) satisfy the equivalent GDPR rights; the lawful basis for processing account data is performance of the service you signed up for.

11. Changes

If this policy changes materially we will note it in the app's release notes and update the effective date above.