Privacy Policy
Your data, explained plainly.
Last updated 7 October 2026
In short: we keep what you put into IronForm so the app can coach you. We don't sell your data or show you third-party ads. You can download everything or delete your account at any time in Profile → Account & privacy.
Who we are
IronForm is a training, nutrition and community app. Questions about this policy or your data: contact us through the support email shown in the app.
What we collect
Your account
- Name, username, email address and country.
- Your password, stored only as a salted one-way hash. Nobody at IronForm can read it.
- Whether your email is confirmed, your plan (Free or Pro) and when you joined and were last active.
What you log and create
- Your body and goal answers: sex, age, height, weight, target weight, training days, activity, and any health conditions or notes you choose to give. These help build your plan; you can leave the health fields empty.
- Workouts, sets, reps and loads, programs, bodyweight, progress goals and form-review notes.
- Your nutrition diary, custom foods, recipes, meal plans and grocery lists.
- Posts, photos, videos and comments you share in the community, and your Iron AI conversations.
- Messages you send to other members, kept so both of you can read them; the members you follow and block; and reports you send.
When you use certain features
- Food photo scan (Pro): the photo is sent to our AI provider to identify the food. We save the foods you add to your diary, not the photo.
- Barcode scan (Pro): only the barcode number is looked up in the Open Food Facts database.
- Push notifications: if you turn them on, we store your device's push address so we can send them.
- Payments: card and mobile-money details go straight to our payment provider. We keep the order reference, amount, currency and status.
Technical information
- A sign-in cookie that keeps you logged in for up to 7 days.
- Network addresses, hashed and kept for 15 minutes, to limit repeated wrong passwords.
- A daily count of visits to the app, without cookies or anything that identifies you.
- Error reports when the app crashes: the error, the page, your browser type and, if signed in, your account email. These help us fix problems.
Why we use it
- To run your account and the features you use: plans, tracking, coaching, community and courses.
- To keep IronForm safe: checking community photos and videos for adult content, limiting password guessing, and acting on reports.
- To process payments and give you what you paid for.
- To send account emails (password reset, email confirmation) and notifications you turned on.
- To find and fix errors.
We use your data because you asked for the service (your account and its features), because you gave consent (for example push notifications or optional health details), because it's needed to keep the service secure, or because the law requires it (for example payment records).
Who processes it for us
| Service | What for |
|---|---|
| Vercel | Hosting the app and its servers |
| Upstash | The database that stores accounts and app data |
| Vercel Blob | Storing the photos and videos you upload |
| OpenAI | Iron AI answers, food photo recognition, and screening community photos and videos for adult content |
| Paystack | Taking payments |
| Resend | Sending account emails |
| Open Food Facts and USDA FoodData Central | Food and barcode lookups (only the search words or barcode are sent) |
| Google, Apple, Mozilla or Microsoft push services | Delivering notifications to your device. The message content is encrypted so only your device can read it. |
These providers may process data in other countries, including the United States. They act on our instructions and protect it under their own security and data-protection terms. We don't sell your personal data and we don't share it for advertising.
Who can see what
- Other members see your public profile (name, username, photo, bio, location if you add it) and what you post in the community. A private profile limits this to approved followers.
- Messages are shown only to you and the member you're talking to. If either of you reports a message, the IronForm team reads it to review the report.
- Members you block can't see your posts or message you.
- The IronForm owner and admins can see account details and app data to provide support, handle payments and keep the community safe. Every admin change is recorded.
How long we keep it
- Your account and data: until you delete your account. Daily backups are kept for 7 days, so deleted data fully disappears within about a week.
- Demo accounts are removed automatically, usually after a week.
- Payment records: kept for accounting and tax, without your name or email once you delete your account.
- Error reports: the most recent 200 are kept.
Your choices and rights
- Download your data as a file: Profile → Account & privacy → Download.
- Delete your account and everything in it: Profile → Account & privacy → Delete.
- Correct your details in Profile → Edit profile, or ask us.
- Turn off notifications in Profile, or in your phone's settings.
- Depending on where you live, you may also have the right to object to or restrict some uses, and to complain to your data-protection authority.
Security
Connections are encrypted (HTTPS), passwords are hashed, sign-in attempts are limited, sessions expire, and pages are protected against common web attacks. No system is perfect: use a strong, unique password and tell us if you notice anything wrong.
Children
IronForm is for people aged 16 and over. If you believe a younger person has an account, contact us and we'll remove it.
Health information
IronForm gives general fitness and nutrition guidance, not medical advice. Any health details you give are used only to shape your plan and are never shared for marketing.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it applies. The date at the top shows the latest version.