Privacy Policy
Your data, explained plainly.
Last updated 8 October 2026
In short: we keep what you put into IronForm so the app can coach you. We don't sell your data. Free members and visitors may see ads from Google; Pro members don't. You can download everything or delete your account at any time in Profile → Account & privacy.
Who we are
IronForm is a training, nutrition and community app. Questions about this policy or your data: contact us through the support email shown in the app.
What we collect
Your account
- Name, username, email address and country.
- Your WhatsApp number, only if you give it, and whether you agreed to WhatsApp messages.
- Your password, stored only as a salted one-way hash. Nobody at IronForm can read it.
- Whether your email is confirmed, your plan (Free or Pro) and when you joined and were last active.
What you log and create
- Your body and goal answers: sex, age, height, weight, target weight, training days, activity, and any health conditions or notes you choose to give. These help build your plan; you can leave the health fields empty.
- Workouts, sets, reps and loads, programs, bodyweight, progress goals and form-review notes.
- Your nutrition diary, custom foods, recipes, meal plans and grocery lists.
- Posts, photos, videos and comments you share in the community, and your Iron AI conversations.
- Messages you send to other members, kept so both of you can read them; the members you follow and block; and reports you send.
When you use certain features
- Food photo scan (Pro): the photo is sent to our AI provider to identify the food. We save the foods you add to your diary, not the photo.
- Barcode scan (Pro): only the barcode number is looked up in the Open Food Facts database.
- Push notifications: if you turn them on, we store your device's push address so we can send them.
- Payments: card and mobile-money details go straight to our payment provider. We keep the order reference, amount, currency and status.
Technical information
- A sign-in cookie that keeps you logged in for up to 7 days.
- Network addresses, hashed and kept for 15 minutes, to limit repeated wrong passwords.
- A daily count of visits to the app, without cookies or anything that identifies you.
- Error reports when the app crashes: the error, the page, your browser type and, if signed in, your account email. These help us fix problems.
Why we use it
- To run your account and the features you use: plans, tracking, coaching, community and courses.
- To keep IronForm safe: checking community photos and videos for adult content, limiting password guessing, and acting on reports.
- To process payments and give you what you paid for.
- To send account emails (password reset, email confirmation), notifications you turned on, and occasional emails about offers and news. Every offer email has a one-click unsubscribe link, and you can turn them off in Profile → Account & privacy.
- To send tips, offers and news on WhatsApp, only if you gave your number and agreed. Turn it off any time in Profile → Account & privacy.
- To find and fix errors.
We use your data because you asked for the service (your account and its features), because you gave consent (for example push notifications or optional health details), because it's needed to keep the service secure, or because the law requires it (for example payment records).
Who processes it for us
| Service | What for |
|---|---|
| Vercel | Hosting the app and its servers |
| Upstash | The database that stores accounts and app data |
| Vercel Blob | Storing the photos and videos you upload |
| OpenAI | Iron AI answers, food photo recognition, and screening community photos and videos for adult content |
| Paystack | Taking payments |
| Resend | Sending account emails |
| Open Food Facts and USDA FoodData Central | Food and barcode lookups (only the search words or barcode are sent) |
| Meta (WhatsApp) | Sending WhatsApp messages to members who gave their number and agreed to them |
| Google AdSense | Showing ads to free members and visitors (see Ads) |
| Google, Apple, Mozilla or Microsoft push services | Delivering notifications to your device. The message content is encrypted so only your device can read it. |
These providers may process data in other countries, including the United States. They act on our instructions and protect it under their own security and data-protection terms. We don't sell your personal data, and we never give advertisers your workouts, food, body measurements, health details or messages.
Who can see what
- Other members see your public profile (name, username, photo, bio, location if you add it) and what you post in the community. A private profile limits this to approved followers.
- Messages are shown only to you and the member you're talking to. If either of you reports a message, the IronForm team reads it to review the report.
- Members you block can't see your posts or message you.
- The IronForm owner and admins can see account details and app data to provide support, handle payments and keep the community safe. Every admin change is recorded.
How long we keep it
- Your account and data: until you delete your account. Daily backups are kept for 7 days, so deleted data fully disappears within about a week.
- Payment records: kept for accounting and tax, without your name or email once you delete your account.
- Error reports: the most recent 200 are kept.
Your choices and rights
- Download your data as a file: Profile → Account & privacy → Download.
- Delete your account and everything in it: Profile → Account & privacy → Delete.
- Correct your details in Profile → Edit profile, or ask us.
- Turn off notifications in Profile, or in your phone's settings.
- Depending on where you live, you may also have the right to object to or restrict some uses, and to complain to your data-protection authority.
Security
Connections are encrypted (HTTPS), passwords are hashed, sign-in attempts are limited, sessions expire, and pages are protected against common web attacks. No system is perfect: use a strong, unique password and tell us if you notice anything wrong.
Children
IronForm is for people aged 16 and over. If you believe a younger person has an account, contact us and we'll remove it.
Ads
Free members and visitors may see ads from Google AdSense on browsing pages and on the public exercise and recipe pages. There are no ads during workouts, in messages, in settings or on payment pages, and Pro members don't see ads.
- Google and its partners use cookies and similar technology to show ads and measure them, and may choose ads based on your visits to this and other websites. See how Google uses information from sites that use its services.
- You can turn off personalised ads in Google's My Ad Center.
- In the European Economic Area, the UK and Switzerland, we ask for your consent before ads use cookies.
- Ads never use your workouts, food, body measurements, health details or messages; we don't send these to Google or any advertiser.
Health information
IronForm gives general fitness and nutrition guidance, not medical advice. Any health details you give are used only to shape your plan and are never shared for marketing.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it applies. The date at the top shows the latest version.