Lupora Privacy Policy

Lupora is built on sensitive data — your training, your health signals, your progress photos. This policy explains exactly what we collect, why, who processes it, how long we keep it, and the controls you have.

If you only read one thing: we never sell your data, never show you ads, never share your data with advertisers or data brokers, and never use your Apple Health data for anything except the health and fitness features you asked for.

---

1. Who we are

Lupora is a personal training app for iPhone that builds workout plans around how recovered your body actually is. This policy covers the Lupora iOS app, the Lupora web companion you can sign in to from a browser, and the Lupora cloud services that power both. The companion reads and edits the same account data as the app, including weekly check-ins with progress photos; training and readiness measurement stay on your iPhone. It also covers Lupora's assistant connection service, which lets you connect an AI assistant you choose, such as ChatGPT or Claude, to your Lupora account (section 5).

Lupora LLC, a Virginia limited liability company, is the controller of the personal data described here. The provider of an AI assistant you connect is not our processor; it handles what it receives under its own privacy policy (section 7).

• Privacy questions and requests: privacy@lupora.com
• Everything else: support@lupora.com
• Postal address: Lupora LLC, 8401 Mayland Dr, Ste A, Richmond, VA 23294-4648, United States

2. The short version

3. What we collect

We collect only what the app's features need.

Account. You sign in with Apple or with Google. When you sign in with Apple, we receive your name and email address — or Apple's private relay address, if you choose to hide your real one — and a unique account identifier. When you sign in with Google, we receive your name, your email address, and a unique account identifier; Google also shares the address of your Google profile picture with our sign-in service (Firebase Authentication, run by Google), and Lupora does not show, store, or use it. We never see your Apple or Google password, and we record which sign-in provider you last used. If Apple and Google give us the same email address, they sign you in to the same Lupora account; otherwise you can link the other provider to your account in Settings → Sign-in methods, which keeps one account and one set of data.

Reviewer accounts. Lupora keeps a small number of internal test accounts so that app store and assistant directory reviewers can try the app. They are Lupora's accounts, not members' accounts: they sign in with an email address and password that Lupora issues, hold only synthetic data Lupora created, are enabled only while a review is open or while a directory listing that depends on them is live, and are never offered to members. No member account has a password, and Lupora never receives or stores a member's password.

Profile. What you enter: birthday, training goal, experience level, height, preferred units, and optionally your gender and a profile photo. Gender is used only to tailor starting-weight suggestions and check-in questions, and you can leave it unset.

Health signals from Apple Health. With your permission, Lupora reads: sleep analysis, heart-rate variability, heart rate, resting heart rate, steps, active energy, body weight, height, and completed workouts. These are used to compute your daily readiness and to personalize your plans. If you allow it, Lupora also writes workouts you completed in the app back to Apple Health, and can schedule planned workouts to your Apple Watch.

Workouts. The plans you create or generate and what you complete — exercises, sets, weights, reps, and durations.

Weekly check-ins. How you're feeling (chosen from a fixed list), an optional menstrual-cycle phase, an optional free-text note to your trainer, and optional progress photos.

Trainer conversation. The multiple-choice answers you give when building a plan, plus any optional note you add.

Usage analytics (optional). Anonymous behavior events — which screens you view, which features you use, and counts such as how many exercises a workout had. Analytics never include health values, photos, check-in answers, workout or exercise names, free text, names, or emails. This is enforced structurally in our code, not just by policy: every event is checked against an allowlist of fixed values, booleans, and bounded numbers, and a test fails the build if anything else appears. Analytics are on by default and you can turn them off at any time in Settings → Privacy.

Crash reports. If the app crashes, Firebase Crashlytics sends us the crash, your device model, and OS version so we can fix it.

Feedback you choose to send. If you use the in-app feedback form, we receive your description, a screenshot if you attach one, and a small diagnostic snapshot (app version, device model, OS version, locale). The diagnostic snapshot never includes health data, check-in content, workout content, your identity, or authentication tokens.

If you connect an AI assistant and check "Let it send feedback reports about Lupora" on the connection screen, the assistant can also send a report for you. Such a report contains only text the assistant writes: the type of report (a bug, a feature request, or other feedback), a description, and, optionally, the behavior you expected and a request to tag the report for Lupora's automated development tools, which Lupora accepts only from accounts it has designated. It has no screenshots and no diagnostic snapshot: Lupora adds only the assistant's name and the identifier of the request that sent the report. The report goes straight to the Lupora team as the assistant wrote it, with no review step on your phone, so you may not see what it says before it is sent. Lupora refuses a report in which it detects an email address or a credential, such as an access token. Otherwise it is handled like a report from the app: its description and expected behavior are encrypted at rest, it gets a reference, it counts toward the same limits, and it becomes an issue in our private GitHub repository.

Notifications. Lupora can remind you about workouts and check-ins. Some reminders are local notifications, scheduled and delivered entirely on your device. If you allow notifications, we can also send push notifications: Apple issues a device token that we store, along with your device's time zone so a reminder never arrives in the middle of your night, and use only to deliver those messages through Apple's Push Notification service. A push token identifies a device installation, not you personally, and we never put health data, check-in content, or workout content in a notification's payload. You can turn notifications off at any time in iOS Settings, and deleting your account deletes any stored token.

Device integrity. Before our servers accept a request, the client proves it is genuine. The iPhone app does this with Apple's App Attest, which proves it is an unmodified copy of Lupora. The web companion cannot attest a binary, so the browser is checked with Google reCAPTCHA Enterprise instead: it looks at how the page is being used and at ordinary request characteristics, and returns a score that says how likely the session is to be automated. Both produce a verdict about the client, not information about you, and neither is used to profile you or to track you across other sites.

AI assistant connections (optional). If you connect an AI assistant to Lupora, you sign in with Apple or Google in your browser and choose what the assistant may access. We keep a record of each connection: the assistant's web address (and its name, for assistants we have verified), the permissions you granted, the version of the connection screen you agreed to, when you connected it, when it was last used, and when and why it was disconnected. If you let the assistant suggest or make plan changes, we also store the workouts and plans it sends. If you let it send feedback reports, we store each report it sends as described under "Feedback you choose to send" above. Section 5 explains what an assistant can see, change, and send.

What we don't collect: we do not use advertising identifiers (no IDFA), we do not track you across other apps or websites, we do not collect your precise location, and we do not use tracking cookies.

4. How we use your data, and our legal bases

Your data is used to run Lupora's features for you — nothing else.

You can withdraw consent at any time — revoke Health access in the iOS Health app, switch analytics off in Settings, disconnect an AI assistant in Settings → Connected assistants, delete individual check-ins and photos, or delete your account entirely.

5. AI processing

Lupora's coaching intelligence runs on Google's Gemini models hosted on Google Cloud (Vertex AI). To build a plan or analyze a check-in, the relevant inputs — your answers, health signals, check-in details, a summary of your recent workout performance (such as the sets, reps, and weights you completed), and any photos you submitted — are processed by these models on our behalf.

• Google acts as our data processor. Under Google Cloud's terms, this data is not used to train Google's models.
• Progress photos are analyzed once, at upload, and are never re-sent to the model afterwards. Later coaching uses only the short structured insights derived from them.
• Photos are screened for safety before analysis; a photo that fails screening is rejected rather than analyzed.
• The model never receives your name, email, or account identifier.
• AI output can be wrong. It is guidance, not medical advice — see the Terms of Service.

Assistants you connect

Separately from Lupora's own AI, you can connect an AI assistant you choose, such as ChatGPT or Claude, to your Lupora account. Connecting is optional. It starts from the assistant and needs your approval on Lupora's connection screen, which shows the assistant's web address, marks assistants we have not verified as unverified, and lists what the assistant will receive. Requests from a connected assistant never use Lupora's own AI described above.

What an assistant can see. Every connection can see your synced schedule: planned workouts and whether each one was started or completed, exercises, sets, reps and loads, workout titles and exercise names (including ones you typed), and your program settings. Only if you check the matching box on the connection screen can it also see:

• your training log: the sets and exercises you completed, with reps, loads, effort ratings and completion times, and the totals calculated from them;
• your training goal and experience level.

The assistant knows you only by a connection identifier unique to that assistant. It never receives your name, email, or account identifier.

What never leaves. No connection ever receives your Apple Health signals, your readiness, your check-ins (feelings, cycle phase, notes, photos, or the insights drawn from them), your body weight or height, your birthday, gender, or profile photo, your notification tokens, your feedback reports, the Trainer's written explanations, or the health measurements recorded with a workout, such as heart rate, energy, or the device that recorded it.

Suggestions. If you check "Let it suggest plan changes", the assistant can send Lupora suggested workouts and plans. A suggestion waits in Lupora until you accept or discard it on your phone, the assistant withdraws it, or it expires after 7 days. Nothing in your schedule changes until you accept it.

Direct changes. If the connection screen you agreed to offered "Let it suggest and make plan changes" and you checked it, the assistant can also change your plan without a review step in Lupora: it can create planned workouts, apply plans, and edit, move, or remove planned workouts. It never changes a workout you started or completed, and it never changes your profile, check-ins, weight, or health data. Whether the assistant asks you before it applies a change depends on the assistant and on your settings in it; if you let it act without asking (for example by choosing "Always allow" for Lupora's tools), changes apply without any prompt. Lupora limits how many direct changes assistants can make each minute and each day. Every direct change shows in Lupora, and you can undo it from Suggestions for 24 hours if nothing has changed since.

Feedback reports. If you check "Let it send feedback reports about Lupora" on the connection screen, the assistant can send the Lupora team reports about Lupora, such as bugs it runs into. The box is unchecked unless you check it. This permission lets the assistant send, not read: it receives back only the reference and delivery status of each report it sends, never your other feedback reports. A report goes as the assistant writes it, with no review step on your phone, and Lupora adds only the assistant's name and a request identifier (section 3, "Feedback you choose to send"). Whether the assistant asks you before it sends a report depends on the assistant and on your settings in it. Reports from assistants count toward the same hourly and daily limits as reports you send from the app.

Who receives the data. The data goes to the provider of the assistant you connected, for example OpenAI or Anthropic. That provider is a third party you choose, not our processor: it acts under its own terms and privacy policy, which govern the data once we send it, including what it keeps in your conversation history. Lupora does not control what the provider does with the data and cannot delete it.

Disconnecting. You can disconnect an assistant, or all of them, at any time in Settings → Connected assistants, and it loses access immediately. A connection also ends on its own 30 days after you made it; the assistant then has to ask you to connect again. Once a connection ends, its pending suggestions can no longer be accepted. Disconnecting cannot take back what the assistant already received or what its provider keeps, and it does not reverse suggestions you already accepted or direct changes already made; you can still undo each direct change for 24 hours if nothing has changed since. Disconnecting also stops the assistant from sending feedback reports; reports it already sent stay with the Lupora team as ordinary feedback reports.

6. Apple Health

Health access is entirely optional and controlled by you.

• Lupora reads only the categories you approve, and asks for write access only to save workouts you completed in Lupora.
• Apple Health data stays on your device except where a specific feature needs it — readiness and plan generation send the relevant recent signals to our servers, encrypted.
• We never use Apple Health data for advertising, marketing, or data mining, and we never share it with third parties for those purposes, as Apple's rules require.
• An AI assistant you connect never receives your Apple Health signals, your readiness, or the health measurements recorded with a workout (section 5).
• You can review or revoke Lupora's Health access at any time in the iOS Health app under Sharing → Apps.

7. Who we share data with

We do not sell your personal data, and we do not share it for advertising. We use a small number of processors who handle data on our instructions:

Recipients you choose. If you connect an AI assistant (section 5), we send the training data you allowed to that assistant's provider whenever the assistant asks for it. The provider is a third party you choose, not one of the processors above: it receives the data because you directed us to send it, and its own terms and privacy policy govern what happens to it next. We keep a record of every assistant you have connected, including ones you have since disconnected, so we can tell you who received your data. You can see it in Settings → Connected assistants, or ask us for it at privacy@lupora.com.

We may also disclose data if we are legally required to, or to protect the rights, safety, or property of Lupora, our users, or the public. If we are ever part of a merger or acquisition, your data may transfer to the successor, and we will tell you before it becomes subject to a different privacy policy.

8. Storage and security

• All traffic between the app and our servers uses TLS (HTTPS).
• Sensitive content — health signals, workouts, check-in answers, cycle information, free-text notes, and progress photos — is additionally encrypted at rest with AES-256-GCM by our own application layer, on top of Google Cloud's storage encryption. Photos are stored as individually encrypted records.
• Your name and email remain readable so your account can be identified and supported.
• Every request from the iPhone app or the web companion requires both a valid sign-in and a passing client-integrity check — Apple App Attest from the iPhone app, Google reCAPTCHA Enterprise from the web companion; requests are rate-limited per account.
• A connected AI assistant cannot pass those checks, so it uses access tokens instead. Each token lasts 15 minutes and works only for that one connection and the permissions you granted, and a connection can renew its tokens for at most 30 days. Every assistant request is checked against the connection's current status, so disconnecting takes effect immediately, and assistant requests are rate-limited too.
• Suggestions and direct changes from an assistant are encrypted at rest like your other workout data.
• The description and expected behavior of every feedback report, including a report an assistant sends for you, are encrypted at rest the same way.
• Access to production systems is restricted and authenticated.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

9. Retention and deletion

• You can delete your account entirely from inside the app: Settings → Delete Account. This permanently erases your profile, workouts, check-ins, photos, readiness history, and feedback reports from our servers, deletes your login together with every sign-in provider linked to it, and wipes the data on your device. If Sign in with Apple is linked to your account, deletion also revokes Lupora's Sign in with Apple grant. Deletion does not remove Lupora from the list of apps connected to your Google Account; you can do that in your Google Account settings. The erased workouts and plans include the cached Trainer requests: each plan the Trainer generated together with the answers and profile snapshot it was built from. Deleting your account also ends every AI assistant connection and erases the connection records, suggestions, and direct-change records. Afterwards we keep only your former account identifier and when it was deleted, so that a delayed process cannot recreate the account's data.
• Deleting a single check-in also deletes its photos and insights.
• Readiness history is pruned automatically after 90 days.
• Feedback screenshots are deleted after 30 days; feedback report metadata is kept until you delete your account. Reports a connected assistant sends for you are kept the same way; they have no screenshots, and disconnecting the assistant does not delete them. A GitHub issue created from your feedback contains only the sanitized subset described above and follows our repository retention. Deleting your account does not delete it; to have one deleted, email privacy@lupora.com with the report's reference.
• AI assistant connections: the record of each connection is kept until you delete your account, including after you disconnect it, so we can tell you which assistants received your data. It contains no workout content.
• Suggestions from an assistant expire after 7 days. Their content is erased within 24 hours after you accept or discard them, the assistant withdraws them, they expire, or you disconnect the assistant. A suggestion you accept becomes part of your workouts.
• Direct changes: a change an assistant prepares is valid for 5 minutes, and its content is erased when it is applied or refused, or within 24 hours after it expires unused. Once a change is applied, its content, including the version it replaced, is kept for 24 hours so you can undo it, and is then erased within the next 24 hours.
• After a suggestion or direct change ends, a status record without its content stays for 30 days and is then deleted automatically. Receipts that let an assistant safely retry a request contain no workout content and are deleted after 30 days.
• Reviewer accounts hold only synthetic data that Lupora created. Lupora resets each one before a review and disables it when the review ends or the listing is withdrawn; nothing in them is a member's personal data.
• Disconnecting an assistant or deleting your account does not delete what the assistant's provider already received. To delete that, use the provider's own controls or contact it directly.
• Data you keep in Apple Health belongs to your device and Apple account — deleting your Lupora account does not touch it.
• Backups may persist for a short period after deletion before they age out.

10. Where your data is processed

Lupora's servers and databases run in the United States (Google Cloud, us-central1), and AI processing runs in Google Cloud's US multi-region. If you use Lupora from the European Economic Area, the United Kingdom, Switzerland, or Brazil, your data is transferred to the United States. These transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) in our agreements with Google, together with the technical measures described in section 8.

When you connect an AI assistant, its provider processes the data you allowed wherever it operates, under its own terms. The safeguards above cover Lupora and its processors, not that provider.

11. Your rights

Depending on where you live, you have some or all of these rights: to access your data, correct it, delete it, export it in a portable format, restrict or object to processing, withdraw consent, and not be discriminated against for exercising them.

Most of these controls are built into the app: your profile is editable, analytics are switchable, Health access is revocable, AI assistants can be disconnected, individual check-ins and photos are deletable, and account deletion is self-serve. For anything else — including a copy of your data — email privacy@lupora.com and we will respond within 30 days (or sooner where the law requires).

EEA, UK, and Switzerland (GDPR). Legal bases are listed in section 4. You have the right to lodge a complaint with your local supervisory authority.

Brazil (LGPD). You have the rights described above, including confirmation of processing, anonymization, and information about data sharing.

Virginia (VCDPA), California (CCPA/CPRA), and other US states. You may access, correct, delete, and obtain a copy of your personal data, and appeal a denied request by replying to our response. We do not sell personal information and we do not share it for cross-context behavioral advertising — including for consumers under 16. California residents may also designate an authorized agent.

Washington, Nevada, and Connecticut consumer health data. See our separate Consumer Health Data Privacy Notice, which Washington's My Health My Data Act requires us to publish separately.

12. Children

Lupora is for adults. You must be 18 or older to use it. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact privacy@lupora.com and we will delete it.

13. Changes to this policy

When we change this policy in a meaningful way, we will update the date at the top and, for significant changes, tell you in the app before they take effect. Continued use of Lupora after a change means the updated policy applies.

14. Contact

Questions, requests, or concerns about your privacy: privacy@lupora.com.

---

Lupora LLC · Virginia, USA