Privacy Policy

Effective date: 7 July 2026 · Contact: support@ironpack.io

IronPack is a workout tracker and card-collecting game made in New Zealand. This policy explains exactly what data the app handles, where it lives, and what control you have over it. The short version: your training data is yours, it stays on your device unless you create an account, we run no ads, no trackers, and we never sell data.

1. Data the app stores on your device

IronPack works fully without an account. Everything you do is stored locally on your device:

• Workouts, exercises, sets, reps and weights you log
• Personal records and strength-standard milestones
• Your card collection, pack points, XP, streaks and quest progress
• App settings (units, training preferences, and optionally your bodyweight and sex if you enable pound-for-pound (DOTS) scoring)
• Workout history you import yourself from CSV exports of other apps

This local data is not transmitted anywhere unless you sign in.

2. Data we store if you create an account (optional)

Accounts exist for one reason: backing up your data and playing with friends. If you sign up we store, on our backend (hosted by Supabase):

• Your email address and a password (passwords are hashed; we never see them), or your Google account identity if you choose Google sign-in
• Your username and a friend code derived from your account
• A backup snapshot of your training data (the local data described above)
• Leaderboard entries: your best lifts on standardized exercises, and if you enable DOTS scoring, the computed score only - your bodyweight and sex are never shared with other users and never leave your backup
• Your friend connections and small activity events (for example "beat your bench record") shown only to your accepted friends

3. What other people can see

• Friends you accept see your username, leaderboard lifts, league standing and activity events. Nobody else does.
• Discovery is opt-in. You only appear in "people you may know" or username search if you switch Discoverable on (it is off by default).
• Nothing you log is ever public. There are no public profiles or feeds.

4. What we do NOT do

• No advertising, and no advertising SDKs
• No tracking across other apps or websites
• No analytics resale, no data brokers, no selling or renting data - ever
• No reading of your device contacts, photos, camera, or location

5. Service providers

• Supabase hosts our database and authentication. They process data solely to provide the service.
• Apple processes any future in-app purchases; we never see your payment details.
• Google handles sign-in only if you choose "Sign in with Google".

6. Your controls

Both of these are inside the app under Settings, no email required:

• Erase all data - wipes your training data locally and from your account backup (the login itself remains usable).
• Delete account - permanently deletes your account: login, username, friends, leaderboard entries and cloud backup. This is immediate and cannot be undone.

You can also export your complete data at any time (Settings → Export).

7. Data retention

Local data lives on your device until you erase it or remove the app. Account data is kept while your account exists and is deleted immediately when you delete your account.

8. Children

IronPack is a resistance-training app and is not directed at children under 13. We do not knowingly collect data from children under 13; if you believe a child has created an account, contact us and we will delete it.

9. Where we operate

IronPack is operated from New Zealand and handles personal information in line with the New Zealand Privacy Act 2020. If you are in the EU/UK, the rights described above (access via export, correction in-app, deletion in-app) satisfy the equivalent GDPR rights; the lawful basis for processing account data is performance of the service you signed up for.

10. Changes

If this policy changes materially we will note it in the app's release notes and update the effective date above.