Iron & Anvil — Privacy Policy

Effective October 1, 2026

1. What this covers

This Privacy Policy explains what information Iron & Anvil ("the App," "we," "us") collects when you use it, why, and who it's shared with. It applies to the iOS, Android, Windows, and Mac versions of the App.

2. Information we collect

Account information

The email address and password you sign up with, or your Google/Apple account identifier if you sign in that way. Passwords are never stored in plain text.

Profile information

Name, sex, birth date, and (if you provide it) phone number.
Training experience level, discipline/goal, gym type, gym name/location, and available equipment.

Workout data

Routines you select or build, workout sessions, individual set logs (exercise, weight, reps, RPE), personal records, and bodyweight entries.

Coach Steele data

If you use AI Coach Check-In (Coach Steele), your recent training history and any custom routine details are sent to our AI provider (Anthropic) to generate a suggestion. See Section 3.

Technical information

Standard server log data (IP address, request timestamps) used for security, rate-limiting, and abuse prevention — not used to build an advertising profile.

We do not collect location data beyond what you manually type as your gym's name/location, and we do not access your device's health data (no HealthKit/Health Connect integration).

3. Who we share it with

We don't sell your data, and we don't share it with advertisers. We do use a small number of service providers to run the App, each only for the specific job listed:

Provider	What they receive	Why
Anthropic (Claude)	Your training history/routine details, only when you use AI Coach Check-In	Generates the coaching suggestion
Resend	Your email address	Sends account verification and password-reset emails
Google	Nothing from us — you authorize Google to share your email/profile with us, if you choose "Continue with Google"	Sign-in
Apple	Nothing from us — you authorize Apple to share your identity with us, if you choose "Continue with Apple"	Sign-in
Mapbox	Map tile requests (no account data)	Displays maps if you look up a gym location
Railway	Everything above, as our hosting provider	Runs the app's server and database

Each of these providers has its own privacy policy governing how they handle what they receive from us.

4. How we use your information

To create and maintain your account.
To sync your routines, workout history, and profile across your devices.
To generate AI Coach suggestions, when you ask for one.
To send you account-related email (verification, password reset) — never marketing email.
To keep the service secure (rate-limiting, fraud/abuse prevention).

We do not use your data for advertising, and we do not build a profile of you for any purpose beyond running the App itself.

5. Data security

Passwords are hashed, never stored or logged in plain text.
All traffic between the App and our servers is encrypted (HTTPS/TLS).
Sessions use expiring, revocable tokens — signing out or deleting your account immediately invalidates them.

No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, industry-standard measures to protect your information.

6. Data retention and deletion

We keep your information for as long as your account exists. You can permanently delete your account and all associated data — profile, routines, workout history, personal records, bodyweight log, and your login credential — at any time, from Settings, without contacting us. Deletion is immediate and cannot be undone.

7. Children's privacy

The App is not directed at children under 16, and account creation requires confirming you're at least 16. We do not knowingly collect information from anyone younger.

8. Your choices

Access and correction: you can view and edit your profile information directly in the App at any time.
Deletion: see Section 6.
Sign-in method: you can use email/password, Google, or Apple — switching providers doesn't create a second account tied to the same email.

9. International users

The App's servers are hosted on Railway, in the EU (Amsterdam). If you use the App from outside that region, your information is transferred there to be processed as described in this policy.

10. Changes to this policy

If we make a material change to how we handle your information, we'll make a reasonable effort to notify you in-app before it takes effect.

11. Contact

Questions about this policy, or to exercise any of the choices above: support@ironcladforgeworks.com.