Anvil CoachPrivacy policy
This policy explains what data the Anvil Coach app ("Anvil", "we") collects, why, and what you can do about it. In short: we collect what we need to build and run your training plan. We don't sell your data, we don't show ads, and we don't track you across other apps or websites.
Who we are
Anvil Coach is operated by Mohamed Hesham Ahmed, an individual based in Italy, who is the data controller for the app and this website. Contact: [email protected].
What we collect
Your account
When you create an account with Apple, Google or email, we receive your email address and, if you share it, your name. If you use "Hide My Email" with Apple, we only see Apple's relay address.
Your answers and plan
The questions at the start build your plan: first name, sex, age, height, weight and target weight, goal and motivation, training experience, daily activity, typical sleep, where and when you train, equipment, focus areas, any pain or injury areas you choose to tell us about, cardio preference and your best lifts. We use them only to create and adjust your plan.
Your workouts
The sets, weights, reps and times you log, the exercises you swap or add, your progress and ranks. Photos you take of gym machines for your own exercises stay on your phone.
Apple Health and Health Connect (optional)
Only if you turn it on, Anvil:
- writes your finished workouts (as strength training, with duration and estimated calories) and your body weight;
- reads your body weight, steps, sleep and resting heart rate.
We use these only inside the app: to show them to you and to keep your plan's body weight current. Sleep is shown only; your plan never changes because of it. Health data is never used for advertising or marketing, never sold, and never shared with anyone else. Apart from your body weight (which is part of your profile), it isn't stored on our servers. You can turn this off at any time in Anvil (Profile) and in Apple Health or Health Connect.
Subscriptions
Payments are handled by Apple (App Store) or Google (Google Play); we never see your card details. We receive the status of your subscription (for example: trial, active, cancelled) to unlock the app.
Messages to us
If you email us, we keep your message and our reply so we can help you.
What we don't collect
No advertising identifiers, no tracking across other apps, no precise location, no contacts. The camera is only used when you choose to photograph a machine.
Why we use it (legal bases)
- To provide the app you signed up for (contract): your account, plan, workouts, progress and subscription.
- Your explicit consent for health-related information: pain or injury areas you choose to share, and Apple Health or Health Connect data. You can withdraw consent at any time; the rest of the app keeps working.
- Legitimate interests: keeping the service secure and answering your questions.
- Legal obligations: for example, keeping records we are required to keep.
Who processes it for us
We use a few trusted providers to run Anvil. They process data only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts and database | EU (Frankfurt) |
| Apple, Google | Sign-in, app stores, payments, Apple Health / Health Connect | Their own policies apply |
| RevenueCat | Subscription status | USA |
| Resend | Sending sign-in and support emails | EU (Ireland) |
| Cloudflare | This website and email routing | Global network |
| Google (Gmail) | Our support inbox | Global |
When data leaves the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or an adequacy decision (such as the EU–US Data Privacy Framework).
How long we keep it
- Account, answers, plan and workouts: while your account exists. When you delete your account, we delete them within 30 days (backups roll off within a further 30 days).
- Support emails: up to 2 years, or sooner if you ask.
- Purchase records are kept by Apple or Google under their own rules.
Your rights
You can ask us to access, correct, export or delete your data, to restrict or object to its use, and you can withdraw consent at any time. Email [email protected] and we'll reply within 30 days at the latest. You can also complain to your data protection authority; in Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
To delete your account and data, see Delete your account.
Security
Data is encrypted in transit (HTTPS) and stored with providers that encrypt it at rest. Access is limited to what's needed to run and support Anvil.
Children
Anvil is meant for people aged 16 and over. We don't knowingly collect data from younger children. If you believe a child has given us data, contact us and we'll delete it.
Not medical advice
Anvil gives training guidance, not medical advice. See our Terms of use.
Changes
If we change this policy, we'll update the date at the top and, for important changes, tell you in the app before they apply.