Privacy notice

Who is responsible for your information?

Iron Atlas is provided by Insomnia I.T. Systems. We decide how personal information is used to operate the app and its account services. Mark Evans is the contact for questions and requests about your information.

Email mark@insomnia-it.co.uk.

Information used by the app

Your account

Your email address, account identifier, sign-in credentials and any display name you provide. These support account access, recovery and linking your records to your account.

Training records

Exercises, workout dates, sets, repetitions, weights lifted, personal records and plans or notes you save. The app uses these to display progress and suggest training.

Your preferences

Your training goal, experience, equipment, planned training days, selected figure, units and reminder or voice settings. These help personalise the app.

Measurements and photos

Body measurements and progress photos you choose to record. These let you keep and compare your own progress over time.

Purchases

Purchase history, subscription status, relevant store transaction information and app or account identifiers. These support paid access, purchase restoration and subscription analytics.

Backup choices

Your account identifier, the version of the backup notice, and the dates you enable backup, withdraw permission and complete cloud removal. These records help us apply and demonstrate your choice.

Photo removal

Technical file references used to complete interrupted cloud-photo removals and prevent a removed file being uploaded again accidentally during the same backup period.

Support and service requests

The email address and information you send to support. Our service providers also process connection and request information when delivering the app's online services and these pages.

Why we use personal information

We use account details to provide the sign-in, recovery and account services you request, and purchase information to provide and restore paid access. We rely on our legitimate interests in delivering and supporting those requested services, under Article 6(1)(f) of the UK GDPR. Where processing is necessary to perform a binding purchase contract with you, Article 6(1)(b) applies.

Optional cloud backup relies on your consent, under Article 6(1)(a). Where the backed-up information reveals your health, we rely on your explicit consent under Article 9(2)(a). Connecting to a trainer and publishing a plan have separate sharing choices using these consent bases where applicable. You can withdraw backup permission through Account or disconnect from the trainer in Plans.

We use necessary technical information to protect accounts, prevent misuse and keep services working. We also use purchase information to understand subscription performance and investigate purchase problems. These are our legitimate interests under Article 6(1)(f). You can object to this use.

We use information needed to respond to data-protection requests and keep evidence of your backup choices to meet our legal obligations under Article 6(1)(c). Support information is used to resolve the service enquiry you send us. Any further retention for a specific legal requirement or dispute is limited to information needed for that purpose.

People aged 16 or 17 can contact us directly about their information and exercise their privacy rights. When assessing our legitimate interests, we give particular weight to younger users' privacy and wellbeing.

On your device and in your account

You can use the workout features as a guest. Guest records are held on that device. You can also sign in while keeping your training records on your device.

An email address is needed to create and recover an email account. Cloud training backup and the device permissions described below are optional.

Cloud backup is optional. We ask you to give separate consent through a choice that starts unticked before uploading and synchronising your workouts, measurements and progress photos. Enabling backup also synchronises your training preferences and saved plans. You can withdraw this permission through Account while keeping your sign-in and a copy on your device.

Your device also holds local records, sign-in state and synchronisation history. Sync history can include copies used to preserve changes or resolve differences between devices. The app uses the information you record and the preferences you select to generate workout suggestions.

Supabase provides the account, database and private photo-storage services. Its systems process the information needed to authenticate you, store your account records and provide the online features you use.

Trainer connections and sharing

When cloud backup is enabled and you agree to connect to a trainer using their code, Iron Atlas shares the name you provide and a training summary with that trainer. The summary includes your training goal, weekly target and streak, workout dates, exercise set counts, best weights and repetitions, recent personal records and weekly muscle balance. The connection screen asks for your separate agreement to this sharing. Progress photos and body measurements are outside that trainer summary.

You can disconnect through the trainer section in Plans. This removes the server-side connection and shared summary. Information a trainer has already seen or copied can remain with them.

Sharing a plan asks you to confirm publication of its author name, exercises, sets, repetitions and free-text notes before creating a code. Anyone with that code can access the included content. If you export or share an image or file, the destination you choose receives that content.

Device permissions and health export

You choose whether to capture a progress photo or select an image. Notification permission allows the app to schedule local reminders. Spoken exercise cues use your device's text-to-speech facility.

If you enable weight export on a compatible device, Iron Atlas asks for permission to write body weight you enter to Apple Health or Health Connect. The integration is designed to write your entered weight. You can turn the feature off in Iron Atlas and manage its permission in your device's health settings.

Records already exported to a health service can be managed through that service's own controls.

Store purchases and service providers

Apple or Google processes purchases made through its store. RevenueCat processes purchase history, entitlement status and app user identifiers to validate paid access, restore purchases and provide subscription analytics. Signing in links the relevant subscription identifier to your Iron Atlas account.

Supabase, RevenueCat, website hosting and email services process information needed for their respective functions. Resend delivers account-verification and password-recovery emails. A trainer or another recipient you choose also receives the information you share through the relevant feature.

Processing locations and safeguards

The core Supabase account database and photo storage are hosted in London. Supabase also uses services outside the UK for support, service metadata and content delivery. Resend sends our account emails from Ireland and stores its service data in the United States. RevenueCat processes purchase-service information in the United States.

Supabase, Resend and RevenueCat provide data-processing terms that include standard contractual clauses and provisions for UK transfers. These contracts set requirements for protecting personal information when it is processed internationally. You can contact Mark Evans for information about the safeguards relevant to your data.

Our customer pages are hosted through OpenAI Sites using Cloudflare-backed delivery. Hosting and email services process the connection information needed to deliver pages and messages, using their service infrastructure.

Keeping and deleting your records

Your live training records are held to provide the backup and sharing features you enable until you remove them, complete cloud-backup removal or delete the account. Local records and recovery copies can also remain on a device until cleared there.

Turning off cloud backup first stops new uploads and removes your personal trainer connection, shared training summary, waiting plans sent to you and plan codes you published. The app then preserves a device copy and removes the cloud photos and training records. If removal is interrupted, the remaining cloud copy stays available only to your account for recovery and removal. Reopen Account to finish the process.

Your sign-in, purchase identity and backup-choice records remain when you turn off backup. If you use Coach as a trainer, your trainer profile and work with other connected clients remain available. Copies another person already saved remain with that person.

Technical references to removed photo files are cleared when cloud-backup removal is completed or the account is deleted.

You can request account deletion from the app or use account tools in your browser. The deletion process removes the live Supabase account and its associated workout records, measurements, private photos, hosted plan codes and trainer relationships.

Removal of a linked purchase-service profile is processed separately in the background. The deletion request keeps the account identifier needed to complete that removal. Once the provider confirms completion, that identifier is cleared from the request, leaving a minimal record of its status and timing.

Copies on other devices, files already exported or shared, and records in Apple Health or Health Connect can remain at their destination. Store transaction records and information in other service systems are handled separately from the app's live account record.

For help with deletion, including information in our support or subscription systems, email mark@insomnia-it.co.uk. To stop future subscription renewals, cancel through the Apple or Google account that made the purchase.

How retention is decided

We keep account information while providing your account. Cloud training data follows your backup and removal choices. A restricted copy during interrupted removal is held to complete the device-copy and erasure process you requested. Contact us if you want help finishing removal or want the cloud copy erased without further recovery.

Backup-choice records remain with your account to apply and demonstrate your choices. Photo-removal references remain until completed cloud removal or account deletion. Device records and exported copies remain under the controls of that device or destination.

Purchase information is retained while needed to provide eligible access or restoration, resolve a purchase issue, or meet a specific legal requirement. Support correspondence is retained while the enquiry and necessary follow-up remain open, with any longer retention limited to an identified legal or dispute-handling need.

Service providers apply their own operational retention windows. On the current Supabase plan, its published API and database log-retention window is one day. Resend's standard email-content and delivery-log window is 30 days, with a seven-day backup window. These provider records are handled separately from deletion of the live Iron Atlas account.

Your rights and requests

You can ask for access to your personal information, correction of inaccurate information and deletion. Depending on the circumstances, you may also have rights to restrict processing and receive information in a reusable format. Where processing relies on consent, you can withdraw that consent.

Your right to object. You can object to processing based on our legitimate interests. We will consider your circumstances and stop that processing unless an applicable legal ground allows it to continue. Contact Mark Evans at mark@insomnia-it.co.uk to make a request or discuss your choices.

We may need to verify your identity before responding to a request. You can also raise a concern with the UK's Information Commissioner's Office. Contact the ICO.

If the law where you live gives you additional privacy rights, contact us to exercise them.