Privacy Policy

Last updated: April 2026

1. Information We Collect

When you use Apex Coach, we collect the following information:

• Account data — your email address, used for authentication via Supabase.
• Profile data — your display name and, optionally, a profile picture you choose from your device's photo library.
• Training data — workouts, exercises, sets, reps, weight, RPE values, body measurements, and dates you log within the app.
• Workout plans — any session blueprints or templates you create.
• API keys you generate — if you choose to use the Connected Apps feature, we store a hashed version of the keys you create (we never store the plaintext key on our servers after it is first shown to you).
• App usage data — basic technical information needed for authentication and cloud sync (e.g. session tokens).

We do not collect location data, contacts, health data from Apple HealthKit, advertising identifiers, or any information beyond what is described above.

2. How We Use Your Information

• To provide and sync your training data across devices.
• To power the progressive overload engine and personal records tracking.
• To enable the Apex AI Coach feature (see Section 6).
• To display your profile picture and name within the app.
• To authenticate API requests made by third-party services you have explicitly authorized via the Connected Apps feature (see Section 5).
• To authenticate you and maintain your session securely.

3. Photo Library Access

Apex Coach requests access to your photo library only when you actively tap the avatar in the Profile tab to choose a profile picture. Access is not used for any other purpose. The selected photo is stored as part of your profile and is never shared with third parties, analytics providers, or advertisers. You can revoke photo library access at any time in iOS Settings.

4. Data Storage

Apex Coach uses a local-first architecture. Your data is stored in a SQLite database on your device and syncs to a cloud database (PostgreSQL via Supabase) when an internet connection is available. API keys you generate are stored locally in the iOS Keychain (via Expo SecureStore) so you can view them again, and only a SHA-256 hash of each key is kept on our servers.

Cloud data is stored on Supabase infrastructure. You can learn about Supabase's data practices at supabase.com/privacy.

5. Connected Apps & Third-Party Integrations

Apex Coach lets you generate personal API keys (Settings → Connected Apps) so you can connect third-party services you trust — for example, a productivity tracker that awards points for completed workouts. When a third-party service uses one of your API keys, it can read a limited subset of your training data (workout date, duration, and total volume).

• You explicitly create and copy each key yourself.
• You can revoke any key at any time from the Connected Apps screen; revoked keys immediately stop working.
• We do not know which external services you share your keys with, and we never initiate data transfers ourselves.

6. AI Coach & Third-Party AI Services

The Apex AI Coach feature is powered by Google Gemini. When you send a message to the AI coach, your training history (workouts, sets, RPE values) and your message are sent to the Gemini API to generate a response.

This data is processed by Google in accordance with their API terms of service and privacy policy. You can review Google's privacy practices at policies.google.com/privacy.

If you prefer not to share your training data with the AI service, you can choose not to use the AI Coach feature. All other app functionality remains fully available without it.

7. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. Your data is only shared with:

• Supabase — for authentication and cloud database hosting.
• Google (Gemini API) — only when you actively use the AI Coach feature.
• Third-party services you authorize via Connected Apps — only when you explicitly provide them with an API key you generated (see Section 5).

8. Data Retention & Deletion

Your data is retained as long as your account exists. You can request deletion of your account and all associated data at any time by contacting us at the email address below. Upon request, your data will be permanently deleted from our servers within 30 days. Revoking an API key immediately and permanently deletes the ability of any third-party service to access your data through that key.

9. Security

All data in transit is encrypted using HTTPS/TLS. Authentication is handled via Supabase Auth using secure JWT tokens. API keys are stored as SHA-256 hashes on our servers and only the prefix (e.g. apex_a1b2c3) is visible after creation on the server side; the plaintext is kept locally in the iOS Keychain on your device. We apply reasonable technical measures to protect your data from unauthorized access.

10. Children's Privacy

Apex Coach is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

12. Contact

If you have any questions or requests regarding this Privacy Policy, please contact us at:
alpgiray.dev@gmail.com

This privacy policy applies to the Apex Coach iOS application and its associated services.