Privacy Policy

This Privacy Policy explains how Improva (“Improva”, “the App”, “we”, “us”, or “our”) handles information when you use the App. We have written it to be read and understood, not just to satisfy a legal requirement. If anything here is unclear, please contact us at the address at the end of this document.

The short version

Improva is built to keep your information on your device. We have no user accounts, and we do not run analytics, advertising, or third-party tracking of any kind. Your workouts, food logs, health figures, schedule, and the apps you choose to block never leave your phone unless you send them yourself - by adding your plan to a calendar, sending a Spare Key or sharing link, or making a backup file.

We do operate one small server, and it exists for exactly two things: making the free trial work once per device, and paying creators who share a discount code. It never receives your training or health data. In total, four kinds of request leave your device during ordinary use:

• a barcode you scan, sent to the Open Food Facts database to look up that product;
• a check that this device has not already used its free trial;
• a creator code you type, to see whether it is valid;
• a record of a purchase you make, so a creator’s code can be credited.

The last three carry a device identifier and no personal information. The trial check is deliberately designed to be remembered: that is the only way a one-per-device trial can survive reinstalling the app. Each is described in full below.

Who is responsible for your information

Improva is developed and provided by an independent developer based in Australia. Because the App stores your information locally on your device rather than on our systems, you remain in direct control of that information at all times. Where privacy law refers to a “data controller”, that role is limited to the narrow processing described in this policy.

Information stored on your device

The App stores the following on your device using Apple’s SwiftData framework and a private App Group container. We do not receive copies of any of it.

• Nutrition profile: sex, age, height, weight, body-fat percentage, activity level, dietary goal and diet type, optional supplementation status, and optional health-related flags you choose to enter.
• Training and running profiles: training experience, available equipment, days and time available, optional injury history, an optional current-pain rating, optional pregnancy or cardiovascular flags, and optional strength or race benchmarks.
• Workout, cardio, and set history: exercises, sets, reps, weights, durations, distances, pace, heart-rate summaries, and dates, and your body-weight log.
• Food and nutrition logs: what you logged, when, quantities, macros, and micronutrients.
• Plans and schedules: scheduled workouts, cardio, focus blocks, meal plans, and generated training programs.
• Gym locations: the name, coordinates, and radius you set for each gym, used for the optional “I’m at the gym” check.
• Cardio routes: for outdoor sessions you track live, the App records your GPS position continuously while the session runs and stores the resulting route - a series of coordinates with timestamps, altitude, and speed - as part of that session’s history. The route is kept on your device until you delete the session.
• Screen Time selection: the apps and categories you choose to block are stored only as an opaque token managed by Apple’s Family Controls framework. Improva cannot read this token and never learns which apps you selected.
• Preferences and app state: units, notification and reset-time settings, theme, streak and progress data, and your emergency code, which is stored only as a salted, irreversible cryptographic hash and never as the code itself.

Information that leaves your device

We want to be precise about this rather than claim more than is true.

• Open Food Facts barcode lookups. When you use the barcode scanner to add a packaged food, the App sends the scanned barcode number to the Open Food Facts API (world.openfoodfacts.org) to retrieve that product’s nutrition information. The request includes the barcode and a standard identification header containing the app name, version, and our contact email. It does not include your profile, logs, location, health data, or any identifier for you. As with any internet request, Open Food Facts and its network providers will see the originating IP address. Open Food Facts is an independent, open-source project with its own privacy practices; see https://world.openfoodfacts.org/privacy. If you never scan a barcode, this request never happens.
• Backup files you create. If you use the backup feature, the App writes a file containing your data, including health-related figures and the GPS routes of any outdoor cardio sessions you tracked, to the destination you choose (for example Files, iCloud Drive, or AirDrop). This file is created at your request and handed to you; we never receive it. Because it contains personal health information and is not encrypted by the App, store and share it with the same care you would any sensitive document.
• The free-trial check. Every install gets three hours of Premium, once per device. To make “once” mean something, the App asks our server whether this device has already used its trial. The request contains a DeviceCheck token - an identifier Apple issues that is specific to this device and this developer, and that cannot be used to identify you or followed into any other app - and an install identifier, a random ID the App generates for itself. It also sends the start time of this device’s trial, if it has one, and which of the three plan generators (running, strength, and meals) this device has already previewed, so the one free preview of each cannot be restarted by reinstalling either. The server stores a row keyed on an irreversible hash of the DeviceCheck token, together with the trial’s start time and that preview record. That row is kept indefinitely and deliberately survives deleting and reinstalling the App, and erasing the device. It contains no name, email, account, or any of your training, health, or nutrition data. Without it, the trial could be restarted forever by reinstalling.
• Creator-code validation. If you type a creator’s discount code on the Premium screen, the App sends that code, the install identifier, your App Store country, and your device’s language setting to our server to check that it is real and still active. The install identifier is used to rate-limit the check. Nothing about you or your data is sent. If you never type a code, this request never happens.
• Purchase attribution. If you buy Premium, the App sends Apple’s signed receipt for that purchase, the install identifier, the App’s version number, and, if you used a creator code, that code and the one-time token our server issued when the code was checked, so the sale can be credited to that creator. We store the purchase record - product, price, currency, storefront and date - to calculate what a creator is owed. This is a record of a transaction with Apple, not a profile of you, and it contains none of your training or health data.
• Apple system services. HealthKit, iCloud, notifications, and similar features are provided by Apple and governed by Apple’s own privacy policy. Any syncing they perform is between you and Apple, not us.
• Links you tap. Some screens contain links to external websites - health organisations shown after a screening answer, data-source attributions, and our legal documents. Opening one loads that site in a browser view, which, like any web page visit, discloses your IP address to that site. The App sends nothing else with it, and no link opens without your tap.
• Calendar events you add. If you choose to add your weekly plan to a calendar, the App writes one event per planned session into the calendar you pick, using Apple’s EventKit framework: the session’s title, its start and end time, and, for a workout, the name of its gym as the event’s location. If that calendar belongs to an iCloud, Google, Exchange, or other account, your calendar provider syncs those events off your device under its own privacy policy. We never receive them.
• Links you send. Spare Key and workout, program, or recipe sharing work by giving you a link to send through the app of your choice, such as Messages or email. The link itself carries data. A Spare Key pairing link carries the sender’s public key and the name they entered; a lock link carries the lock’s ID, the trusted person’s key fingerprint, the label you gave the lock, and when it was created; an unlock link carries the lock’s ID and a signature; a sharing link carries the workout, split, or recipe you shared, without the weights you lift. These links travel only through the app you choose and do not use any server operated by us.
• Things you choose to share. After a workout you can share a picture of its summary (the workout’s name, duration, sets, reps, volume and any records); from a fortnight overview you can share a picture of it (its dates, any headline, and the fortnight’s rings and numbers for each area shown, which can include sleep, steps and protein); from a meal plan you can share the shopping list as text; and from Settings you can export the diagnostics log described below. Each is handed to the iOS share sheet only when you tap Share, goes wherever you send it, and never passes through any server operated by us.

Aside from the above, no feature of the App transmits your information off your device. Our server never receives your workouts, food logs, health figures, schedule, location, or the apps you chose to block.

Apple frameworks we use

• Family Controls and Managed Settings. Used so you can select apps and categories to block during scheduled sessions or focus blocks. The selection is an opaque token only iOS can interpret; we never see it or transmit it.
• HealthKit. With your permission, the App may read data such as active energy, heart rate and heart-rate variability, resting heart rate, sleep duration, step count, body mass, body-fat percentage, walking, running, cycling and swimming distance, and workout history, to support the running coach, cardio trends and readiness, nutrition, and history features, and to check that a timed cardio session was spent moving before it counts toward unlocking your apps (heart rate or steps you typed into the Health app by hand are not used for that check). The App writes back to HealthKit only if you explicitly enable that in Settings, and only these: completed workouts and their active energy, the route of an outdoor cardio session you tracked live, the nutrition you log (energy, protein, carbohydrate and fat), and the body mass and body-fat percentage you enter in your nutrition profile. Separately, the Improva app on Apple Watch saves each session it records to Health under the Watch’s own Health permission, whatever that iPhone setting says; you can review or turn off that permission in Health’s app-access settings. HealthKit data is used on your device and is never sent to us. In line with Apple’s rules, HealthKit data is never used for advertising or shared with third parties.
• Core Location. The App uses your location for two things, and nothing else. The gym check: when you tap “I’m at the gym”, it takes a single, when-in-use reading to confirm whether you are within the radius you defined for that gym, uses the answer to gate the workout start screen, and does not store the reading. Live cardio: when you start an outdoor cardio session, it tracks your position continuously - including while the screen is locked or the App is in the background, which is what lets it measure distance and pace - and saves the route with that session. Routes stay on your device as session history until you delete the session; they are written to Apple Health if you turn on Health writing in Settings, and they are included in a backup file if you make one. We never receive your location or your routes.
• EventKit. Used only when you choose to add your weekly plan to a calendar. The App asks for calendar access at that moment, writes one event per planned session into the calendar you pick, and reads that calendar only to find and replace the events it wrote itself for the same week. It does not read or change your other events.
• Speech recognition and the microphone. Used only while you dictate a list of foods to log, or ingredients to add to a recipe, after you tap the microphone. Recognition runs on your device; dictation is turned off on devices that can’t recognise speech on the device. The audio is not recorded, stored, or sent anywhere, and only the resulting text is kept, as the foods or ingredients you confirm.
• Camera. Used only while the barcode scanner is open, to read a packaged food’s barcode. No photo or video is taken or stored. The barcode number is then looked up as described under Open Food Facts barcode lookups above.
• Core Bluetooth. Used only if you connect a Bluetooth heart-rate monitor during a live cardio session, to show your heart rate as you go. The session’s average and maximum heart rate are saved with it on your device, and are included in a backup file if you make one. We never receive them.
• ActivityKit and notifications. Workout and cardio timers appear on your Lock Screen, and the App schedules local reminders such as the weekly planning prompt. These run on your device; no data is sent to us.

Diagnostics

The App can record crash and performance diagnostics locally using Apple’s MetricKit, stored in a small on-device log. Nothing is transmitted automatically. This information is shared only if you choose to export it yourself from Settings, for example to help us investigate a problem you report.

What we do not do

• We do not sell or rent your information.
• We do not use analytics or usage telemetry.
• We do not serve advertising or use advertising or marketing identifiers.
• We do not embed third-party SDKs that collect data about you.
• We do not track you across apps or websites.
• We do not share your information with advertisers, data brokers, insurers, employers, or analytics providers.
• We do not send your training, health, or nutrition data to any server we operate.

Children

Improva is not directed to children under 13, and we do not knowingly collect information from them. Users under 18 should use the App with the involvement of a parent or guardian, and certain content, including supplement guidance, is presented only to users 18 and older. If you believe a child has used the App in a way that concerns you, contact us and we will help, though because the data resides on the child’s device, deletion is performed there.

Health information

Improva processes fitness and nutrition information you provide, and health data you permit it to read from HealthKit, solely to deliver the App’s features on your device. This information is not medical advice (see the Terms of Service), is not sold or shared, and is not used for any purpose other than operating the features you use.

Your rights

Depending on where you live, you may have rights under the Australian Privacy Principles, the EU/UK GDPR, the California Consumer Privacy Act, or similar laws, such as the right to access, correct, delete, or export your personal information. Because Improva keeps your training, health, and nutrition information on your device, you exercise these rights over that information directly: you can view, edit, export (via backup), and permanently delete it at any time within the App, without needing to ask us. We do not hold a separate copy of it to produce or erase. The two records we do hold on our server are described under Data retention and deletion below; to exercise your rights over those, contact us and we will do what the law requires and what is technically possible. If you have a question about your rights, contact us and we will help as far as we are able.

Data retention and deletion

Your information remains on your device until you remove it. You can erase it using Settings, then Reset Improva in the App, or by deleting the App from your device. Deletion of your on-device information is immediate and cannot be undone by us, since we hold no copy of it. Backup files you have created remain wherever you saved them until you delete them.

A few small items are kept in your device’s keychain, which iOS keeps even after the App is deleted, so they are still there if you reinstall it: when your free trial started and which plan previews you have used (so deleting the App does not restart them); the latest time the App has seen on your device’s clock (so setting the clock back cannot undo a lock or lengthen the trial); if you have paired a trusted person for Spare Key, their name and public key; and, if you hold someone’s spare key, a random signing key this device uses to release their lock. Reset Improva removes your trusted person’s name and key. It keeps the trial record and that time, and it keeps the signing key, which holds no information about you and which that person’s phone needs in order to accept your key. Erasing your device removes all of them.

Two records live on our server and are not removed by resetting or deleting the App: the hashed device identifier and start time behind the free-trial check, which is kept indefinitely so the one-per-device trial cannot be reset, and any purchase record needed to calculate creator payouts and handle refunds. Neither contains your name, contact details, or any of your training, health, or nutrition data. If you want either removed, contact us at the address below and we will do what the law requires and what is technically possible; note that removing the trial record would let the device claim another free trial.

Security

Your information is protected by your device’s own security, including its passcode and encryption. Sensitive values such as your emergency code are stored only as a salted, irreversible hash. Our server holds none of your training, health, or nutrition data - only the hashed device identifier behind the trial check and the purchase records behind creator payouts - so there is no central database of your personal information for an attacker to breach.

Changes to this policy

We may update this policy as the App evolves or as the law requires. When we make a material change, we will update the effective date above and surface the change within the App. Your continued use after an update means you accept the revised policy.

Contact

If you have questions or concerns about this Privacy Policy or your information, contact us at:

support@improva.fit

This policy is governed by the laws of Australia.