Privacy policy

Last updated 16 October 2026

prform is a workout tracker, built and run by one person in Australia. This policy covers the iPhone and Android apps and prform.co. Questions go to hello@prform.co.

The short version

  • I don’t sell your data or show ads.
  • Usage data goes to PostHog. You can turn it off in Settings.
  • Your lift videos and progress photos stay on your phone.
  • Your workouts, profile and any health data you sync live on prform’s servers, so they work across devices, with friends and with the coach.
  • You can delete your account in the app at any time.

What prform collects

Your account

Your name, email and username, plus your profile picture if you sign in with Google or Apple. While you’re signed in, prform keeps a session record that can include your IP address and device or browser type.

Your training

Workouts, notes, programs, routines and custom exercises. Your gyms, equipment, goals, injuries and limitations. Body measurements, date of birth, sex, units and time zone.

Health data (optional)

If you connect Apple Health or Health Connect:

  • prform saves your weight, body fat and lean body mass, up to a year back, to your account. On iPhone, also your waist, date of birth and biological sex.
  • It saves your daily HRV, resting heart rate, sleep (with bedtime, wake time and sleep stages), steps, active energy, VO2 max and minutes in each heart rate zone, up to 60 days back on iPhone and 30 on Android. Only the coach uses HRV, sleep and resting heart rate, and only if you allow it.
  • With cycle context on, it reads your period dates. They stay on your phone, out of its backups.
  • During a workout it reads your live heart rate, and on iPhone checks for workouts your watch already recorded. Neither is uploaded.
  • It writes your strength workouts, calories burned and body weight back.

Health data is never sold or used for ads. Your body weight goes to an AI assistant only if you connect one.

Location (optional)

When you start a workout and have a friend on prform, the app takes one location reading to see whether a friend is training at the same place. Friends see that you’re training nearby, never where. The reading is deleted when your workout ends.

Videos and photos

Set videos, progress photos and your profile photo stay on your phone. The camera and microphone are only used while you’re recording.

Friends

prform stores your friends, requests, blocks, reports, likes and invites. Friends see the workouts you share (exercises, sets, reps and weights, not notes), whether you’re training right now, and your name, username, profile picture and sex. Anyone with your invite link sees your name and profile picture.

Notifications

prform stores a push token for your device. Notifications go through Expo and Apple or Google, and can include a friend’s name or a message from your coach.

AI coach (optional)

The coach sends nothing until you say yes. The app names the AI provider first, and the coach checks your answer before every reply, check-in and weekly review. It sends:

  • Your goal, experience, units, time zone, gym and equipment
  • Your program, schedule, and limitations with their notes
  • Recent and upcoming workouts with their sets, and session notes
  • Your conversation and the coach’s notes about you
  • Recent HRV, sleep and resting heart rate, if you connected Apple Health or Health Connect
  • Your Health Age, your VO2 max, and how your resting heart rate and body fat compare with people your age
  • Your GLP-1 medication and current cycle phase and day, if you add them. The app asks again before sending either for the first time.

It never gets your name, email, date of birth, location, photos or videos.

You can add a GLP-1 medication, with its name and start date, in the coach’s notes, or tell the coach in a chat and it asks before saving. Deleting it stops it going to the coach, but your chats and the coach’s notes and summaries keep what you said until you delete those too.

Cycle context works out your cycle phase and day on your phone, or in your browser, from Apple Health, Health Connect, or your last period and usual cycle length. prform saves only the phase, the day and when it was worked out, replacing them each time, so your account holds no cycle history. Period dates stay on that device, out of iCloud and Google backups, and are removed when you turn cycle context off or sign out.

By default the coach uses Anthropic’s Claude models through Cloudflare’s AI Gateway. Anthropic’s commercial terms cover what it keeps, and it doesn’t train on these requests. Cloudflare logs requests, with what was sent, for debugging, except those carrying your recovery data, GLP-1 medication or cycle phase and those that summarise or title your chats. If you connect your own model in the web dashboard, the coach sends this data to that provider instead, asks your permission again, and stores your key encrypted. The coach sends nothing until you allow it, and deleting your account stops it.

Dictation on iPhone stays on your device.

Coach conversations are kept until you delete them. On iPhone, Apple Intelligence may write some text, like workout titles, on your device; only the result is saved.

Claude, ChatGPT and other assistants (optional)

To connect an assistant, you sign in to prform and approve what it can do. When you ask it about your training, prform sends your workouts and sets, personal records, program, body weight (including from Apple Health or Health Connect) and custom exercises. If it asks, it also gets your name and email. It never gets your GLP-1 medication or cycle details. When you ask, it can save a program to your account, replacing your current one.

The assistant runs under your account with its provider, and their privacy policy covers what it keeps. prform stores which assistants you’ve connected and their access tokens. Disconnect one in Settings on prform.co and its access ends straight away.

Strava (optional)

prform stores Strava’s access tokens and posts your finished workouts: title, description, start time, duration, and each working set’s exercise, reps and weight. Strava’s privacy policy covers it from there.

Imports and API keys

Imports from other workout apps are read on your phone and saved as workouts. For API keys, prform stores a hashed copy, its name and how often it’s used.

Usage data

prform sends PostHog an event when you install, update, open or leave the app, sign up, or finish a workout. Events are linked to your account, with your name and email, and include your phone model, operating system, app version, language and time zone, never your workouts, notes, health data or messages. PostHog doesn’t keep your IP address or location.

Server logs

prform’s servers log each request’s time, address, device or browser type, and network details such as your IP address. Logs are used to fix problems and prevent abuse, and expire automatically.

Who else handles your data

  • Cloudflare: hosting, the database, sign-in emails, the AI Gateway and server logs.
  • Anthropic: the coach’s default model.
  • Expo: app updates and notifications.
  • PostHog: usage data, stored in the EU.
  • Apple and Google: sign-in, notifications, Apple Health and Health Connect.
  • Strava and AI assistants, if you connect them.

prform doesn’t sell your data or share it with advertisers or data brokers, but may disclose it when the law requires. Data may be stored outside your country and is encrypted in transit.

Keeping and deleting your data

prform keeps your data while you have an account. Delete it in Settings → Delete account. Delete your account lists what goes, what stays, and how to ask by email instead.

Your choices

  • Health, location, camera, microphone and notifications each ask first, and you can turn them off in your phone’s settings.
  • Turn off usage data in Settings → Share usage data.
  • See and edit your data in the app, or download your training data with an API key.
  • Depending on where you live, you may have the right to access, correct, delete or move your data, or object to how it’s handled. Email hello@prform.co. In Australia, if you’re unhappy with my response, you can complain to the Office of the Australian Information Commissioner.

Children

prform isn’t for anyone under 16. If a child under 16 has an account, email hello@prform.co and I’ll delete it.

Changes

When this policy changes, I’ll update this page and the date at the top, and tell you in the app or by email if it’s significant.