Privacy Policy

Effective: 2026-10-12

The short version

• You need a free account. We ask only for your email address, to sign you in with a one-time code and to keep your data in sync between your devices.
• Your workouts sync privately to your account so you can switch devices or get a new phone. They are stored encrypted on our server, used only to sync them back to you, and never sold or shared. Export or delete them anytime.
• Body & nutrition (Pack Plus) uses health data: your height, weight and similar details. We store it only with your explicit consent, and you can delete it anytime with Delete my body data.
• AI requests go through our server to Anthropic, which writes the answer. We send the request itself, never your email, name or device ID, and we do not store what you asked.
• No ads, no tracking SDKs, no selling or sharing of your personal information. Ever.
• You can export or delete your data in the app, on our website, or by emailing privacy@lobolift.com.

Who we are

Pack Workout is run by [LEGAL BUSINESS NAME]. We are the "controller" of the personal data described here: we decide how and why it is used.

• Privacy questions and requests, including requests under the GDPR, UK GDPR and Brazil's LGPD: privacy@lobolift.com. This is also our contact channel for data protection matters.
• Everything else: support@lobolift.com

This policy covers the Pack Workout app (the web app at https://lobolift.com/app/ and the Android app), our website https://lobolift.com, our emails and our server.

Your account

Everyone who uses Pack Workout signs in with an account. You need to be 16 or older.

• What we ask for: your email address. You sign in with a 6-digit code we email to you. There are no passwords.
• Why it is required: the account is where your workouts are kept in sync, so you can use the app on more than one device, keep your data when you get a new phone, and sign in again after clearing your browser. It also lets us keep the monthly AI count and your Pack Plus plan.
• What you agree to when you sign up: the sign-up form has separate, unticked boxes for the Terms and this Privacy Policy, for confirming you are 16 or older, and (optional) for product-update emails. We record each answer with the version of the document and the time.

Your workouts and how sync works

Once you are signed in, the app keeps your data in two places:

• On your device, as a local copy (in your browser's storage or the Android app's private storage), so the app works offline and opens quickly.
• On our server, in your account, so your other devices get the same data.

The app syncs when you sign in, when it starts or comes back to the screen, when your connection returns, a few seconds after you save something, and when you tap Sync now.

What syncs:

• your workout sessions: exercises, sets, weights, reps, times and distances, notes, ratings of effort (RPE/RIR), pain flags and whether a workout was completed, partial or abandoned
• your routines (including ones you add from a program) and custom exercises
• your settings: units, theme, rest timer, plates, weight steps, rest sound, help buttons, whether you finished the tour, and whether "Use my recent workouts" is on
• your body profile and weigh-ins, only if you use Body & nutrition (see below)

What stays on the device and never syncs: your cookie and storage choices (including the analytics choice), when you made them, and whether that device has shown the welcome screens. Your personal records, charts and statistics are calculated on your device from your data; we do not calculate or store them on our server. Files you import or export go straight between the app and your device's files; workouts you import become part of your synced data.

How we protect synced data. Our server stores the content of every synced item encrypted with AES-256-GCM, with a separate random value for each item and a key that is not stored in the database. Next to each encrypted item we keep what sync needs to work: your account, the item's type (for example "session"), its ID and when it last changed. This encryption protects your data if a copy of the database is ever exposed without the key. It is not end-to-end encryption: our server holds the key, because it has to send your data back to your devices.

How we use it. Only to store it and send it back to your devices, and in the AI features when you use them (described below). We do not read, analyse or profile your workouts, use them for advertising, or use them to train AI models.

If you change the same item on two devices, the most recent change wins.

When you delete something (a workout, a routine, your body data), the app tells our server at the next sync. We delete the content and keep only a deletion marker (the item's type, its ID and when it was deleted, with no content) for 90 days, so your other devices delete it too.

Your device ID. The app also makes a random device ID (a code like 3f2a…, not linked to your name or phone). It is sent to our server only with AI requests, and our server immediately turns it into a hash and stores only that, to count free AI requests per device as well as per account.

Body and nutrition (health data)

Body & nutrition is part of Pack Plus. It works out estimates such as your BMI, daily calories and protein, and your weight trend, and can give AI guidance. The information it uses is health data, so we treat it with extra care.

Only with your explicit consent. Before anything is saved, the app asks you to tick a separate, unticked box: "I agree that Pack Workout stores my body data (age, sex, height, weight, body fat) and syncs it to my account to calculate estimates. I can delete it anytime." It is not bundled with anything else. We record your answer on our server (yes or no, the policy version and the time).

What we store, synced and encrypted like your workouts:

• your birth year (not your date of birth), used to work out your age
• sex for the calorie formula: male, female, or "prefer not to say" (the app then averages both formulas)
• your height, your weigh-ins (date and weight) and, if you enter it, your body-fat percentage
• your activity level, goal (lose, maintain or gain) and pace
• when you gave consent, and to which version of this policy

Estimates (BMI, maintenance and target calories, protein range, 7-day average and weekly trend) are calculated from this data on your device. When you ask the AI coach, our server calculates them again from what the app sends, to check them; it does not store them.

What we never do with it: use it for advertising, sell or share it, use it to train AI models, or use it to infer anything about you beyond the estimates you asked for.

Withdrawing consent and deleting it. Delete my body data (in AI > Body & nutrition) deletes your body profile and all weigh-ins from that device and, at the next sync, from our server and your other devices, and records that you withdrew consent. Deleting your account deletes it too, or email privacy@lobolift.com. Withdrawing does not make earlier use unlawful. If you do not consent, you cannot use Body & nutrition, and everything else in the app works the same.

Under the law:

• EU and UK (GDPR): data about your health is a "special category" (Article 9). Our legal basis is your explicit consent (Article 9(2)(a)), which you can withdraw at any time.
• Brazil (LGPD): it is sensitive personal data (Article 11). We process it only with your specific, highlighted consent, for the purpose stated above.
• California (CCPA/CPRA): it is sensitive personal information. We use it only to provide the feature you asked for, never to infer characteristics about you, and never sell or share it, so there is no use for us to "limit".

The Android app

• One permission. The Android app asks for internet access only, which it uses for sign-in, sync, AI features and Pack Plus. It does not ask for storage, location, contacts, camera, microphone or notifications.
• No Android backups. The app switches off Android's backup for its data, so it is not copied to Google's cloud backup or moved by phone-to-phone transfer. To move to a new phone, sign in there: your data comes from your account.
• Exports go where you choose. When you export, the app saves the file in its own private cache and opens Android's share sheet. You pick where it goes (for example your files, a cloud drive or an email). Nothing is sent to us. The app deletes that temporary copy the next time it starts, before the next export, and when you delete all data on the device.
• Links open in your browser. Our website, these policies and Stripe's checkout open in your phone's browser (a "Custom Tab"), which uses that browser's own cookies and settings.
• Android System WebView, the part of Android that displays the app, is made by Google and updated with your phone. Whether it sends crash reports to Google depends on your phone's own diagnostics settings, not on us. The app itself contains no crash-reporting or analytics code.

What we keep on our servers

We do not store your name, phone number, date of birth, postal address, payment card number or password. Pack Workout has no passwords: you sign in with a code sent to your email.

Payment details are entered on Stripe's checkout page, not ours. Stripe handles your card and billing address and tells us only the subscription details above.

Anonymous usage counts, only if you allow "Analytics" in Cookie settings (off by default): the app or website sends our own server a count such as "export used" or "pricing page viewed". These counts contain no cookies, no device ID and no account link, and we do not store your IP address with them.

Technical data: like every website, when your browser or the app connects to our server, our hosting provider sees your IP address and basic request details (time, page, browser type). Our server uses a hashed form of your IP address or device ID only to limit requests (about 30 per minute) and forgets it within minutes. Our hosting provider keeps standard access logs for up to 30 days.

What we do not collect or do

• No ads and no ad networks.
• No tracking or analytics SDKs, no crash-reporting SDKs, no social-media pixels, no third-party fonts or scripts that track you.
• No selling or sharing of personal information, for money or anything else.
• No AI training on your data, by us or by Anthropic (see below).
• No precise location, no contacts, no photos, no microphone or camera. The Android app asks for one permission only: internet access.
• No profiling and no automated decisions that have legal or similar effects on you. The progression suggestions and body estimates are simple calculations shown only to you.

AI features

AI Search, AI Ideas and the Body & nutrition coach are the only features that send your input to another company. You need to be signed in to use them, and the coach is part of Pack Plus.

What we send to Anthropic (the company that runs the Claude AI model):

• AI Search and AI Ideas: the text you type (for example "back exercises with dumbbells" or an optional note), and the filters you choose: equipment, goal, minutes, experience level, muscles to focus on, and exercises to avoid (sent as the IDs of exercises from our library, for example ones you flagged for pain; the IDs of your custom exercises are never sent).
• Body & nutrition coach: your age, latest weight, 7-day average and weekly weight trend, activity level, goal and pace, the estimates our server calculates from your profile (BMI and its category, resting and maintenance calories, calorie target, protein range and which formula was used), and the question you type, if any. Your sex, height and body-fat percentage are used in that calculation on our server but are not sent to Anthropic.
• Your recent workout summary, only if you switched on "Use my recent workouts" (off by default), with AI Ideas and the coach. It is a short text about your recent training (such as which exercises you did and how much), and contains no names or IDs.

What we never send to Anthropic: your email address, your name, your device ID, your account details, or your full workout history.

How it flows: your app sends the request to our server. Our server checks that you are signed in (your account records that you confirmed you are 16 or older), your monthly count and, for the coach, your plan and your body-data consent. It passes the request to Anthropic, checks the answer (AI Search and AI Ideas may only return exercises from our library; the coach's answer is checked for format and length, and the numbers you see always come from our own calculation, not from the AI) and sends it back to you. Our server sees the request while it passes through, together with your account and hashed device ID for counting, but does not store or log what you asked or what the AI answered. We only add 1 to your monthly count.

Anthropic processes the request for us as a service provider (a "processor") under its commercial terms and data processing terms. Under those terms Anthropic does not use this data to train its models. It may keep it for a limited time for safety and abuse monitoring, as described in Anthropic's privacy policy.

Please don't type personal details such as your name or medical history into AI requests. The AI does not need them.

Why we use your data, and our legal bases

For people in the EU, UK and other places with similar laws, each use needs a legal basis.

Who processes data for us

We use a small number of service providers. They may use the data only to provide their service to us.

Stripe also acts as an independent controller for some things it is legally required to do, such as fraud prevention and financial regulation. See Stripe's privacy policy.

We may also disclose data if the law requires it (for example, a valid court order), and we will tell you unless the law forbids it. If our business is ever sold or merged, this policy will continue to apply to your data, and we will tell you before anything changes.

How long we keep data

International transfers

Some providers are in the United States or other countries outside the EU, UK or your country. When personal data from the EU or UK goes to a country without an "adequacy decision", we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or on the EU-US Data Privacy Framework where the provider is certified. For personal data from Brazil, we rely on the standard contractual clauses approved by the ANPD (LGPD Article 33). You can ask us for a copy of the relevant safeguards at privacy@lobolift.com.

How we protect data

• All connections use HTTPS (encrypted in transit).
• Your synced data, including body data, is encrypted on our server with AES-256-GCM (see how sync works).
• We keep little else: no passwords, no card numbers.
• Device IDs and session tokens are stored only as SHA-256 hashes, so a leaked database could not be used to sign in as you.
• Sign-in codes expire after 10 minutes and lock after 5 wrong tries.
• Requests are rate-limited to slow down abuse.
• Payment card data is handled only by Stripe, which is certified to PCI DSS.

The copy on your device is protected by your device: its screen lock and storage encryption. Anyone who can use your unlocked device or browser profile while you are signed in can open the app and see your data. On a shared device, sign out when you are done: signing out removes your data from it.

If a data breach affects your personal data, we will tell the relevant authority and, where required, you, as fast as the law requires (in the EU and UK, the authority within 72 hours).

Your rights

You can, free of charge:

• Access the personal data we hold about you and get a copy
• Correct it if it is wrong (you can edit your workouts and body data in the app)
• Delete it ("right to be forgotten")
• Export it in a portable format (your workouts are always exportable in the app as JSON or CSV; for everything else, email us)
• Object to uses based on our legitimate interests, or restrict how we use it
• Withdraw consent at any time (body data, product emails, analytics, the workout summary for AI), without affecting what happened before
• Complain to a data protection authority, for example where you live or work (in the UK: the ICO, ico.org.uk)

California and other US states (CCPA/CPRA and similar laws). You have the right to know what we collect, to delete it, to correct it, and not to be treated differently for using your rights. We do not sell or share personal information, and have not done so in the last 12 months. "Share" here means giving it out for cross-context behavioral advertising, which we never do. We use sensitive personal information (your body data, and your account login) only to provide the service you asked for, and never to infer characteristics about you. Because we do not sell or share, there is nothing for a "Do Not Sell or Share" link or a Global Privacy Control signal to stop, but we treat such a signal as a valid opt-out anyway. In the last 12 months we collected: identifiers (email, hashed device ID), commercial information (your plan and subscription), internet activity (IP addresses in access logs), the workout data you log, sensitive personal information (body data, only with your consent) and the AI request content you send. We collected them from you and, for payments, from Stripe, for the purposes in the table above, and disclosed them only to the service providers listed above. You may use an authorized agent; we will ask the agent for proof of your permission.

Brazil (LGPD). You have the rights in Article 18 of the LGPD, including confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share data with and about the consequences of not consenting, and withdrawal of consent. Write to privacy@lobolift.com, our contact channel for data protection matters. You can complain to the ANPD (Autoridade Nacional de Proteção de Dados).

Everywhere else. We give these same rights to everyone, wherever you live, including under Canadian, Swiss, Australian and other privacy laws.

How to use your rights

We reply within one month at most (within 15 days for LGPD access requests), and usually much sooner. To protect you, we confirm requests by sending a link or code to the account's email address. We do not ask for ID documents.

Deleting your data

• On one device: signing out removes your data and the device ID from that device. If some changes have not synced yet, the app warns you first and offers Sync now. More > Your data > Delete all data on this device does the same. Neither deletes your account or its synced copy.
• Your body data: Delete my body data removes it from your account and all your devices, and records that you withdrew consent.
• Your account: More > Account and plan > Delete account (or the website deletion form, which sends a confirmation link to your email) cancels any Pack Plus subscription and erases your account and everything in it: your synced workouts, routines, custom exercises, settings and body data, sessions, AI usage counts and consent records. We email you a confirmation. A copy cached on a device stays there until you sign out on it or delete the app's data there. If you were charged in the last 14 days, you can still get a refund: see the Refund Policy.
• What we cannot delete: Stripe must keep payment records for tax and accounting law. A hashed device ID is not linked to you once your account is gone and expires as described above.

Children

Pack Workout is only for people aged 16 or older. Everyone needs an account, and the sign-up form asks you to confirm your age. We do not knowingly collect personal data from anyone under 16. Read our Children's Privacy page for details.

Changes to this policy

When we change this policy, we update the effective date at the top. If a change matters (for example, a new kind of data or a new provider), we tell account holders by email at least 30 days before it takes effect, show the coming change on this page, and ask for consent again where the law requires it. Earlier versions are available on request.

Contact

[LEGAL BUSINESS NAME]

Privacy and data protection requests: privacy@lobolift.com · Support: support@lobolift.com · Website: https://lobolift.com