Your training data is yours.

Who runs Tonnage

Tonnage is run by Jai Kakkar (“we”, “us”), who is responsible for the personal data this policy describes. Write to [email protected] with any question or request about it.

This policy covers the hosted service: the apps for iPhone, iPad and Apple Watch and the web app at tonnage.cloudnativesolutions.ai. Tonnage is free software, so anyone can run their own server. If you sign in to a server somebody else runs (Profile → Server in the app), that server’s operator decides what happens to your data there, and this policy does not apply.

What we keep

Your account

• Your e-mail address and display name.
• Your password, stored only as a salted scrypt hash: nobody can read it back, us included. For a passkey, only its public key; the private key never leaves your device.
• Your sign-in sessions (a signed token in a cookie on the web, in the Keychain on iPhone and iPad) and your settings: units, language, appearance, reminders.

Your training log

• Programs, program days, sessions, sets, reps, weights, rest times, notes, personal records and estimated one-rep maxes.
• Your weight, body measurements (such as waist, chest or body fat) and your goals.
• Custom exercises, the photos and videos you choose to attach to exercises or sessions, and any history you import from another app.

Health and wearable data

• What Apple Health shares with the app, only after you turn it on: see Apple Health.
• Where the service offers it and you connect an account such as Fitbit, Oura, WHOOP or Strava: an access token, stored encrypted, and the workouts, heart rate, sleep and steps that provider sends us. Disconnecting revokes the token and stops new data at once.

Teams, crews and Buddy

• The teams and crews you create or join, your role in each, the stats you share with a crew, the challenges you join, your reactions in a crew’s feed, and the announcements a coach posts to a team.
• The reports you send about something in a team or crew (what you reported as it was then, your reason and your note) and the members you block there: see Reporting and blocking.
• Your conversations with Buddy: see Buddy, the AI assistant.

Notifications

• On iPhone and iPad: a push token for your device, held by OneSignal and tied to your Tonnage account id, so a notification reaches your devices and no one else’s.
• On the web: the push subscription your browser hands us (an address at your browser maker’s push service, and its keys).

Security records

• An activity log of security events (sign-ins and failed sign-ins; password, e-mail and passkey changes; changes to teams; reports, blocks and what moderators did about them), kept for up to 90 days. It does not hold your full IP address.
• Short-lived technical logs our servers need to run the service and keep it safe.

What we do not collect: no advertising identifier, no location, no contacts, no browsing history, no microphone. The camera and your photo library are used only when you choose to attach a picture or a clip.

Apple Health

Tonnage works with Apple Health only after you turn it on (during onboarding, or in Profile → Connected devices), and only for the types you allow on Apple’s permission screen.

• What we read, with your permission: workouts (with their heart rate, active energy and distance), heart rate, heart rate variability, resting heart rate, respiratory rate, blood oxygen, steps, active energy, sleep, body weight and body fat.
• What we write, only with “Save workouts to Health” on: your finished strength sessions, as workouts with their active energy. The Apple Watch app saves the sessions you record on it, with their heart rate and energy.
• What it is for: showing you your own data. The recovery card on Today, the heart rate of each session, your weigh-ins in your log. It is uploaded to our server over an encrypted connection so that it is in your account on every device you use.
• What we never do: sell Health data; use it for advertising, marketing or data mining; share it with any third party; use it for anything you do not see in the app. A coach’s view of your training contains no Health or wearable data. The one thing from it another person can ever see is your step count, in a crew, if you switch steps on for that crew.
• Your controls: switch data types off in Profile → Connected devices; take permissions back at any time in the Health app (Sharing → Apps → Tonnage); remove the Apple Health source in Profile → Connected devices on the web to delete what it uploaded from our server. Deleting your account deletes all of it.

Who can see your data

• You, on every device you sign in on.
• A team’s coaches, admins and owners, once you join their team with an invite: your training history (programs, sessions, weight and records), read-only, for as long as you stay. The join screen says so before you join. They never see your e-mail address or any Health or wearable data. Other members see only your display name and your role. Leave the team, and the access ends.
• A crew: only what you switch on for that crew (sessions, volume, streak, PRs, minutes, steps, a change in weight, or your weight as a number only if you choose it), plus your display name, your reactions and the challenges you join. Each stat is off until you turn it on.
• The open leaderboards, only if you switch on “Show me on the open leaderboard”: your first name and the initial of your last name, and your score for the week or the month (sessions, volume, minutes, steps, walking distance or streak). Never your e-mail address, weight or Health data. A crew appears there only if its owner lists it, by its name and member count. Switch it off and your row is gone at the next refresh, within 15 minutes.
• Us, the operator, only to run the service: to answer a request you send, to investigate abuse or a security problem, to act on reports (below), to keep backups, and to review Buddy conversations as described below. Only the operator’s admin accounts have this access.
• Nobody else. We do not sell, rent or trade personal data, and we share none of it with advertisers or data brokers. We disclose data only when the law requires it, and only what it requires.

Reporting and blocking

• Report: in a team or a crew you can report an announcement, a member, a shared program day or the team itself (Report, in its menu), with a reason and, if you like, a note. The report keeps a copy of what you reported as it was then, so it can still be judged if it is changed or deleted.
• Who reads a report: the team’s or crew’s admins and owners see what was reported and why, never who reported it (reports about them, or about the team itself, go only to us). We, the operator, see every report with who sent it, and act on it: we leave it, remove the content, remove the member from the team, or switch the account or the team off. We look at every report, usually within a day.
• Block: you can block another member inside a team or crew. From then on you no longer see their announcements, activity, reactions or place in the standings there, and they no longer see your activity in that crew’s feed. They are not told, and you can unblock them at any time. Blocking does not change what a team’s coaches can see of your training: leave the team for that.
• How long: a report is kept with its team while both the account that sent it and the account it is about exist; deleting either account deletes it. Blocks go with either account too.

Buddy, the AI assistant

• Buddy is off until you agree on its consent screen, and you can turn it off again in Profile → AI buddy.
• A question sends the model your question, the last messages of that conversation and a short summary of your training: your program, recent sessions, strongest lifts, recovery summary, your rank in your crews (no other member named) and the screen you asked from. Never your name, e-mail address or account id.
• The model runs on the operator’s own server. Your questions and your data are not sent to a third-party AI provider. If that ever changes, we update this policy first, and the consent screen names the provider.
• Your conversations are kept in your account until you delete them (one, or all, in Profile → AI buddy), and are deleted on their own after 30 days without use.
• To prevent abuse, the operator can review conversations with Buddy. A copy of each question and answer, with its time, the screen, the app and your network (never your full IP address), is kept for 180 days, even after you delete the chat. Questions that look like abuse are flagged for review. Only the operator’s admins can read these copies, every time they open one is logged, and deleting your account deletes them at once.
• Buddy’s answers can be wrong and are not medical advice.

Service providers

A few providers help run the service. Each gets only what its job needs and may not use it for anything else.

• OneSignal delivers push notifications to iPhone and iPad. It receives your device’s push token, your Tonnage account id and the text of each notification (such as “Rest is over” or “Sam passed you in this week’s challenge”), and its software counts deliveries and opens. No training or Health data goes to OneSignal. Its policy: onesignal.com/privacy_policy.
• Apple’s push service (through OneSignal) and your browser maker’s push service (Apple, Google or Mozilla, for web notifications) carry notifications to your device. Web notifications are encrypted for your browser.
• Cloudflare carries the connection between your device and our server and shields it from attacks. It processes your IP address and the requests in transit. Its policy: cloudflare.com/privacypolicy.
• Our e-mail delivery provider sends the mails you ask for (a password reset, a change of address, a team invite), so it processes your address and that message.
• Wearable providers you connect send us your data at your request, under their own policies.

The server, its database and its backups are run by the operator. Your data may be processed in countries other than yours, including the United States, where these providers operate.

Cookies and analytics

• The web app sets one cookie of its own: your sign-in session (first-party, HttpOnly, secure). It keeps a copy of your log in your browser’s storage so it works offline. Cloudflare may set a strictly necessary security cookie that tells people from bots.
• No analytics, no advertising cookies, no tracking pixels and no fingerprinting, in the apps or on these pages. We do not track you across other companies’ apps or websites, and the iPhone app never asks to.

How long we keep it

• Your account and your log: for as long as you have the account.
• Health and wearable data: until you remove its source or delete your account.
• Buddy conversations: until you delete them, or 30 days without use. The abuse-review copy: 180 days.
• Reports and blocks: while both accounts exist (see Reporting and blocking).
• The activity log: up to 90 days.
• Backups: they rotate, so data you delete leaves them within 30 days.

Your choices and rights

• See and correct: everything you log is in the app; edit or delete any session, program day or weigh-in. Change your e-mail address in Profile → Account; for anything you cannot change yourself, write to us.
• Take it with you: Profile → Data & backup exports your whole log as JSON (and on the web, as a ZIP with your photos and videos).
• Stop sharing: switch a crew’s stats off, leave a team or a crew, turn off Buddy, Apple Health or notifications. Each takes effect at once.
• Delete: see Deleting your account.

Depending on where you live (for example the EU, the UK or California), the law gives you rights to access, correct, delete and port your data, to restrict or object to its use, and to withdraw consent. Write to [email protected] to use any of them; we answer within 30 days and never charge for it. You can also complain to your data protection authority. We process your data to provide the service you signed up for (contract), with your consent for Apple Health, wearables, Buddy, notifications and crew sharing, and in our legitimate interest in keeping the service secure and free of abuse. We do not sell or share personal information as California law defines those words.

Deleting your account

Delete it yourself, in the app: Profile → Account → Delete account, on iPhone, iPad and the web. Confirm with your passkey or your password, and the account is deleted at once. There is no waiting period, and it cannot be undone, so export your log first if you want a copy (Profile → Data & backup). You are signed out on every device.

What goes, all together: your log (programs, sessions, weigh-ins, photos and videos), your passkeys, password and e-mail address, Health and wearable data (connected accounts such as Fitbit are disconnected at the provider), Buddy conversations and their review copies, AI Coach data, notification registrations (including your OneSignal user), your team and crew memberships, the announcements you posted, your crew activity, reactions and challenge scores, the invites you made, and the reports and blocks you made or that are about you. A team or crew you own passes to its next admin, coach or member, or is deleted when you were its last member. Program days you shared with a team stay in its library, without your name. The activity log keeps its security entries for up to 90 days, under an anonymous label instead of your name and account id. Backups age out within 30 days.

Cannot sign in any more? E-mail [email protected] from the address on your account and we delete it for you within 30 days.

To stop Tonnage reading Apple Health without deleting anything, take its permissions back in the Health app (Sharing → Apps → Tonnage).

Children

Tonnage is not directed at children under 13 (or the minimum age for consenting to online services where they live), and we do not knowingly collect their data. If you believe a child has an account, write to [email protected] and we delete it.

Security

Every connection is encrypted (HTTPS). Passwords are stored as scrypt hashes, wearable tokens are encrypted at rest, and only the operator’s admin accounts can reach personal data. No system is perfect: if a breach affects your data, we tell you without undue delay, and what we are doing about it.

Changes and contact

When this policy changes, the new text appears here with a new effective date. If a change matters to how your data is used, we tell you in the app before it applies. Questions, requests and complaints: [email protected]. For help with the app, see Support.