Privacy Policy

Privacy Policy

Effective Date: August 7, 2026 Last Updated: August 7, 2026

Scope

This Privacy Policy explains how Iron Ladder collects, uses, stores, transmits, shares, and protects information when you use the Iron Ladder iPhone application, Apple Watch application, widgets, website, profiles, social features, leaderboards, classes, subscriptions, artificial-intelligence features, and related services collectively referred to as the “Service.”

Who Operates Iron Ladder

Iron Ladder is currently owned and operated by Frank Messana in his individual capacity.

For purposes of applicable privacy law, the person responsible for Iron Ladder’s processing of personal information is:

Frank Messana Iron Ladder Email: support@ironladderapp.com

If a limited liability company or other entity later becomes the operator of Iron Ladder, this Privacy Policy will be updated as required.

Information We Collect

Depending on the features you use, Iron Ladder may collect information described below.

Account Information

Account information may include:

* Email address. * Username. * Display name. * Profile photograph. * Biography and profile information. * Referral information. * Verification information. * Account preferences. * Notification preferences. * Subscription status. * Password-reset information.

Passwords are not stored in plaintext.

Passwords stored by Iron Ladder are stored as bcrypt password hashes.

Fitness, Health, And Wellness Information

You may choose to provide fitness, health, and wellness information including:

* Workouts. * Exercises. * Sets. * Repetitions. * Weight lifted. * Training volume. * Workout duration. * Personal records. * Bodyweight. * Starting weight. * Goal weight. * Height. * Fitness goals. * Experience level. * Focus muscles. * Weekly workout targets. * Progress information. * Body-composition information. * Progress photographs. * Nutrition information. * Meals. * Calories. * Macronutrients. * Water tracking. * Fasting information. * Creatine or supplement tracking. * Dietary preferences and restrictions. * Recovery information. * Cycle day and cycle phase if you choose to use Cycle-Aware Training. * Class participation. * Other fitness information you choose to enter.

Some of this information may be considered health information, consumer health data, sensitive data, or special-category data under applicable law.

Social And Community Information

When you use Iron Ladder’s social features, we may process:

* Posts. * Photographs. * Videos. * Captions. * Comments. * Likes and reactions. * Follows and followers. * Leaderboard participation. * Rankings. * Class participation. * Reports. * Blocks. * Moderation information.

Information you choose to make public can be seen by other users according to applicable privacy settings.

Photos And Videos

Photos and videos you upload may be stored so Iron Ladder can provide:

* Social posts. * Profile photographs. * Verification. * Progress-photo features. * Body-analysis references. * Form Check. * AI Food Scanner. * Other media-based features you choose to use.

Body progress photos are encrypted on your device before upload and stored as encrypted blobs.

The decryption key is held in your device keychain and may sync through your iCloud Keychain so your other authorized devices can access the encrypted content.

A photo or video is sent to Anthropic only when the applicable AI-processing or moderation activity described in this Policy occurs.

Contacts

If you grant Iron Ladder permission to access contacts for account-discovery functionality, phone numbers from your contacts may be transmitted to Iron Ladder’s server so the server can look for existing Iron Ladder accounts.

Those contact phone numbers are not written to Iron Ladder’s database as part of that lookup process.

This matching process is therefore not entirely on-device.

You can revoke contact access through the permissions for Iron Ladder in iOS Settings.

Technical And Device Information

Iron Ladder may process technical information reasonably necessary to operate and secure the Service, including:

* Device type. * Operating-system version. * App version. * Device or push-notification token. * Login activity. * Network information. * IP address. * Error information. * Security information. * Feature usage necessary to operate and troubleshoot the Service.

Iron Ladder does not use:

* Advertising SDKs. * IDFA for advertising. * Cross-app tracking.

Iron Ladder does not collect precise location for the purposes described in this Policy.

Subscription Information

Apple processes purchases made through the App Store.

Iron Ladder may receive information necessary to verify and provide a subscription, including:

* Subscription product. * Subscription status. * Purchase status. * Renewal status. * Transaction or receipt information. * Trial status. * Expiration information. * Refund or cancellation status.

Iron Ladder does not receive your complete payment-card details from Apple.

How We Use Information

We use information to:

* Operate your account and authenticate you. * Save and display your training and nutrition history. * Calculate stats and estimates. * Run leaderboards. * Provide social features. * Provide classes and challenges. * Generate results from AI features you invoke. * Send notifications and emails you have enabled. * Send necessary account and transactional communications. * Process and validate subscriptions. * Provide support. * Review reports. * Moderate User Content. * Prevent fraud and abuse. * Investigate safety issues. * Secure the Service. * Meet legal obligations. * Establish, exercise, or defend legal rights. * Maintain and improve the Service.

Third-Party AI Processing — Anthropic PBC

Iron Ladder’s AI features are not processed on your device.

When you use an AI feature, the app sends applicable inputs to Iron Ladder’s server, which forwards them to Anthropic PBC through the Claude API to generate the result.

Iron Ladder asks for your explicit permission in the app before this happens for the first time.

You can withdraw that permission at any time at:

Settings > Privacy > AI & Your Data

If you do not grant permission, nothing is sent to Anthropic for those user-invoked AI features and the applicable AI features remain off.

If you later withdraw permission, new user-invoked AI requests are not sent to Anthropic.

What Is Sent To Anthropic

Depending on the AI feature you choose to invoke, Iron Ladder may send:

* A meal photo you select for AI Food Scanner. * A progress photo you select for Body Composition Analysis. * Lift-video frames selected for Form Check. * Age range. * Sex. * Height. * Bodyweight. * Starting weight. * Goal weight. * Experience level. * Fitness goal. * Focus muscles. * Weekly workout target. * Recent workouts and exercises. * Weekly training volume. * Workout count. * Personal records. * Food or meal descriptions you enter. * Restaurant or brand names you enter. * Dietary preferences. * Dietary restrictions. * Calorie targets. * Macro targets. * Cycle day and cycle phase when you use Cycle-Aware Training. * Free text you enter on an AI screen, including applicable music-genre or goal preferences.

Workouts imported from Apple Health become ordinary Iron Ladder workouts and may therefore contribute to recent-workout information, workout counts, personal records, and training-volume totals supplied to Anthropic for an AI feature you invoke.

Raw Apple Health samples, including individual heart-rate, calorie, and distance readings, are not sent to Anthropic.

What Is Not Sent To Anthropic

Iron Ladder does not send the following to Anthropic as part of the AI processing described above:

* Your name. * Username. * Email address. * Password. * Payment details. * Precise location. * Social posts, except for the separate moderation use described below. * Comments. * Follow graph. * Raw Apple Health samples.

Health and fitness data is never shared with Anthropic or anyone else for advertising, marketing, or data mining.

How Anthropic Handles AI Requests

Anthropic processes the applicable request and returns a generated result.

Under Anthropic’s commercial terms for its API, API inputs and outputs are not used to train Anthropic’s models unless a separate agreement provides otherwise.

Anthropic’s privacy and commercial terms are available through Anthropic’s legal and privacy resources.

Iron Ladder does not provide the information described in this AI section to Anthropic for:

* Advertising. * Cross-app tracking. * Marketing. * Data brokerage. * Unrelated profiling. * General-purpose model training.

Anthropic PBC provides the same or equal protection of your data as described in this Privacy Policy and required by the App Store Review Guidelines.

The same confirmation applies to every other service provider listed under “Sharing.”

Moderation-Related Anthropic Processing

Separately from user-invoked AI features, when a post is deleted and preserved in Iron Ladder’s restricted moderation archive, its image may be sent to Anthropic to generate a text description that helps administrators search and investigate archived moderation records.

This use is for safety, moderation, and abuse investigation.

It is not used for advertising or marketing.

Health And Nutrition Calculations

Calorie, macronutrient, hydration, recovery, and body-composition figures shown in Iron Ladder are estimates derived from published formulas and public-health guidance applied to information you provide.

The formulas and citations are identified in the app under:

Settings > Privacy > Health & Nutrition Sources

Applicable citations may also be displayed near screens containing the applicable estimates.

Iron Ladder is a fitness tracking application.

Iron Ladder is not a medical device and does not provide medical advice, diagnosis, or treatment.

Apple Health And HealthKit

If you grant permission, Iron Ladder reads only the following Apple Health data types for importing training history and displaying workout metrics:

* Workouts. * Active energy burned. * Heart rate. * Walking and running distance. * Cycling distance. * Swimming distance.

The Iron Ladder iPhone application does not write data to Apple Health.

The Iron Ladder Apple Watch application writes only workouts recorded through the Apple Watch application so those workouts can appear in applicable Activity and Health history.

Iron Ladder does not store Apple Health data in iCloud.

Iron Ladder does not use Apple Health information for:

* Advertising. * Marketing. * Data mining.

Workouts imported from Apple Health become ordinary Iron Ladder workout records.

Because of this, imported workouts may contribute to workout counts, training volume, recent workouts, and other derived training information supplied to Anthropic when you voluntarily invoke an applicable AI feature.

Raw Apple Health samples such as individual heart-rate, active-energy, and distance readings are not sent to Anthropic.

You can revoke Iron Ladder’s Health permissions through Apple’s applicable Health privacy settings.

Sharing

Iron Ladder does not sell personal information.

Iron Ladder does not share personal information with third parties for their own marketing.

We share information with service providers that help operate Iron Ladder, limited to what each provider needs for its applicable function:

* Anthropic PBC — AI processing for applicable AI and moderation features described in this Policy. * Render — application and database hosting. * Cloudflare R2 — media storage. * Resend — transactional and product email. * Twilio — text messages where enabled. * Apple — subscription purchasing and validation, Apple platform services, and push-notification delivery.

Each of these providers is contractually required to provide the same or equal protection of your data as described in this Privacy Policy.

We may also disclose information where reasonably necessary to:

* Comply with applicable law. * Respond to valid legal process. * Enforce the Terms of Service. * Prevent fraud or abuse. * Protect users. * Protect the public. * Protect Iron Ladder. * Respond to serious safety risks. * Establish, exercise, or defend legal claims.

Information Shared With Other Users

Other users may see information you choose to make visible, including:

* Your profile. * Profile photograph. * Public posts. * Comments. * Applicable social activity. * Rankings and associated statistics if you leave leaderboard participation enabled.

Your privacy settings determine applicable visibility within Iron Ladder.

Iron Ladder cannot prevent another person from taking a screenshot or otherwise preserving information that was legitimately displayed to them.

Deleted Content And Moderation

Deleted posts may be preserved in a restricted moderation archive.

A moderation archive may include:

* Captions. * Media references. * Metadata. * User reports. * Moderation information. * AI-generated image descriptions.

This preservation is intended to help:

* Investigate illegal conduct. * Investigate abuse. * Enforce community standards. * Investigate inappropriate content. * Prevent repeat abuse. * Protect users. * Meet legal obligations. * Preserve evidence.

Access to the moderation archive is restricted to administrators and service providers with an appropriate operational need.

Automated Content Filtering

Iron Ladder uses automated systems to assist with content moderation.

Automated systems may:

* Detect potentially objectionable content. * Flag content. * Assist administrators. * Create moderation-related descriptions.

Automated systems can make mistakes.

Human administrative review may be used where appropriate.

Reports And Blocking

Iron Ladder provides functionality for users to:

* Report objectionable User Content. * Block other users.

Moderation reports may include information reasonably necessary for administrators to review the reported account, content, and surrounding circumstances.

Communications

Iron Ladder sends certain communications necessary to operate your account, including:

* Password resets. * Security notices. * Policy updates. * Moderation outcomes. * Subscription-related communications.

These Service communications may be sent regardless of promotional preferences when reasonably necessary to operate your account or comply with applicable law.

Product News And Promotional Communications

Product news and offers by email or text: these are off unless you turn them on. Manage them at Settings > Notifications > Product News, or unsubscribe from any marketing email we send. Two things this setting does not cover: service messages — password resets, policy updates, moderation outcomes, and subscription receipts — which are necessary to operate your account; and occasional announcements shown inside the app itself, which you can dismiss.

Your Choices

You can:

* Update profile information. * Adjust notification settings. * Delete eligible individual entries. * Manage public profile information. * Block other users. * Report User Content.

You can also revoke specific permissions.

Revoking AI Consent

Turn off “Allow AI features” at:

Settings > Privacy > AI & Your Data

After it is turned off, new user-invoked requests are not sent to Anthropic.

Revoking HealthKit Access

You can revoke Apple Health permissions through the applicable Health privacy controls provided by Apple.

Revoking HealthKit permission does not necessarily remove an Iron Ladder workout that was previously imported and became an ordinary Iron Ladder workout record.

Revoking Device Permissions

Camera, photo-library, microphone, and contact permissions can be managed through the applicable iOS permission settings for Iron Ladder.

Notifications

Push-notification and reminder categories can be managed through Iron Ladder’s notification settings and applicable iOS notification settings.

Leaderboards

You can disable leaderboard visibility using:

Settings > Privacy > Show me on leaderboards

Account Deletion

You can delete your Iron Ladder account through:

Settings > Delete Account

Account deletion permanently removes your account and associated personal information from Iron Ladder’s active production systems, subject to the limited exceptions described below.

Deleted account information may include:

* Workouts. * Personal records. * Nutrition entries. * Fasting entries. * Profile information. * Photos. * Posts. * Comments. * Device tokens. * Other account-associated information.

Account deletion cannot be undone.

Limited information may be retained where reasonably necessary or legally required for:

* Legal compliance. * Fraud prevention. * Security. * Abuse prevention. * Safety investigations. * Moderation records. * Dispute resolution. * Evidence preservation. * Establishing, exercising, or defending legal claims.

Deleting your Iron Ladder account does not automatically cancel an Apple subscription.

Privacy And Data Requests

You may contact support@ironladderapp.comor account or personal-data assistance.

Iron Ladder will respond to privacy and data requests within 30 days.

We may reasonably verify your identity before providing, correcting, exporting, or deleting personal information.

Where applicable law permits additional time for a particular request, we may use an extension only to the extent legally permitted and will provide applicable notice.

Your Privacy Rights

Depending on where you live, you may have rights concerning your personal information.

These may include the right to:

* Confirm whether personal information is processed. * Access personal information. * Correct inaccurate information. * Delete eligible personal information. * Obtain a portable copy of eligible information. * Withdraw consent. * Object to certain processing. * Restrict certain processing. * Appeal certain privacy-request decisions. * Complain to an applicable privacy regulator.

Iron Ladder will not unlawfully discriminate against you for exercising a privacy right.

Privacy rights may be subject to exceptions allowed by applicable law.

Consumer Health And Sensitive Data

Some information processed by Iron Ladder may qualify as consumer health data or sensitive personal information under applicable privacy laws.

Iron Ladder processes such information only for purposes connected with operating the fitness, health, social, safety, and AI features described in this Policy and as otherwise permitted by applicable law.

Where applicable law requires separate or additional consent to collect, process, or share sensitive information, Iron Ladder will obtain that consent.

Iron Ladder does not sell consumer health information.

Iron Ladder does not use consumer health information for targeted advertising.

International Users

Iron Ladder is operated from the United States.

Information may be processed in the United States and other countries where Iron Ladder’s service providers maintain systems or personnel.

Privacy laws in those locations may differ from the laws where you live.

Where applicable law requires safeguards for international transfers, Iron Ladder will use an available lawful transfer mechanism or other legally permitted safeguard.

Legal Bases Where Required

Where applicable law requires Iron Ladder to identify a lawful basis for processing, processing may rely on:

* Performance of the contract with you when information is necessary to provide Iron Ladder. * Consent where you choose optional processing and applicable law requires consent. * Legitimate interests in operating, securing, moderating, supporting, and improving Iron Ladder where those interests are not overridden by applicable rights. * Compliance with legal obligations. * Protection of vital interests in qualifying emergencies. * Establishment, exercise, or defense of legal claims.

Where special-category or sensitive information requires an additional legal condition, Iron Ladder relies on an appropriate condition available under applicable law.

Withdrawal of consent does not make processing that occurred before withdrawal unlawful.

Security

Iron Ladder uses reasonable safeguards appropriate to the size and nature of the Service.

Safeguards include measures such as:

* Encrypted network connections. * Hashed passwords. * bcrypt password hashing. * Encryption for designated body-progress photographs. * Administrative access controls. * Restricted moderation access. * Other technical and organizational measures.

No online service can guarantee perfect security.

You are responsible for maintaining security over:

* Your password. * Your email account. * Your devices. * Your authentication methods.

Data Retention

Iron Ladder generally keeps account information for as long as the account remains active and the information is reasonably necessary to provide the Service.

When an account is deleted, personal information is removed from active production systems except where limited retention is reasonably necessary or legally required for:

* Legal compliance. * Fraud prevention. * Abuse prevention. * Safety records. * Moderation. * Security. * Financial or transaction records. * Evidence preservation. * Dispute resolution. * Legal claims.

Information processed by a service provider may also remain for the limited period permitted under the applicable provider agreement and applicable law.

Iron Ladder does not retain personal information longer merely because it may someday be useful.

Security Incidents

If Iron Ladder discovers a security incident involving personal information, we will investigate it and provide notices to users, regulators, or other parties when required by applicable law.

Because Iron Ladder processes fitness and health information, some incidents may be subject to specialized consumer-health-data breach-notification requirements even where HIPAA does not apply.

No Advertising Or Cross-App Tracking

Iron Ladder currently does not:

* Display third-party behavioral advertising. * Use advertising SDKs. * Use IDFA for advertising. * Sell personal information. * Share personal information for third parties’ own marketing. * Perform cross-app behavioral tracking.

If these practices materially change, this Privacy Policy and applicable consent or opt-out systems will be updated before the new processing occurs where required by law.

Children

Iron Ladder is not directed to children under 13.

We do not knowingly collect personal information from children under 13.

If we learn that a child under 13 has created an account or provided personal information without legally sufficient authorization, we will take appropriate steps to remove the account and information, subject to applicable legal and safety retention requirements.

A parent or guardian who believes a child under 13 has provided information to Iron Ladder may contact:

support@ironladderapp.com

Users between 13 and the age of legal majority may be subject to additional protections under applicable law.

Changes To This Privacy Policy

We may update this Privacy Policy as Iron Ladder changes.

When a material change is made:

* The date at the top of this Policy will be updated. * Users will be provided applicable notice. * Users will be asked to review or accept an updated policy in the app when required or when Iron Ladder determines renewed acceptance is appropriate.

Where a new use of information legally requires consent, Iron Ladder will obtain the required consent before beginning that use.

Contact

Privacy questions, data requests, account-deletion questions, and privacy complaints may be sent through the Iron Ladder contact system or to:

Frank Messana Iron Ladder Email: support@ironladderapp.com