PRIVACY

Your training data should remain yours.

Beta policy · effective 21 October 2026

Feature availability and controls vary by app version and platform. Some local tracking controls described here are available in updated Android versions and may not yet appear in the hosted web app.

Information LiftNext handles

Optional energy review adds separate local choices for a seven-day average comparison and target previews. The chosen direction, opt-ins and an affirmation snapshot/time of the current energy body inputs are stored in the existing local adaptive record and included in private backups and local reset. Restoring a backup pauses both choices and clears that affirmation. Comparisons and previews are calculated on the device, are not separately saved or sent as analytics, and never automatically change a Food goal. Any Food goal remains a separate manual choice.

• Saved training settings and workout templates are named local snapshots for reuse. Settings retain selected training preferences; templates retain exercise order and reference set counts/methods, not past performance. Saving a template does not freeze prescribed loads or automatically start a workout: using it requires your choice and the current workout checks. These libraries are included in private backups and removed by local reset. They are not automatically synced or sent as coaching analytics.
• Optional saved meals retain local snapshots of food names, portions and nutrition values for reuse. Saving, renaming or removing a saved meal does not log consumption or rewrite past food entries. Reviewing one creates a separate draft that you must confirm to log. These snapshots are included in private backups, removed by local reset and not automatically sent to LiftNext.
• Where adaptive-energy observations are available, an optional local opt-in stores your suitability/context declarations and explicit confirmations of closed food-log days. A confirmation includes its date, time zone, recorded day bounds and a snapshot of the food facts you reviewed, so changing contributing food can require a new review. These records stay on the device, are not automatically synced or sent as analytics, and are included in your private backup and local reset. Disabling the feature retains the records; restoring a backup pauses adaptive opt-in and marks saved confirmations for review. When enough suitable observations are available, the app can calculate an assumption-based average expenditure estimate locally from confirmed food logs and recorded weight. This derived result is not separately saved or sent to LiftNext and does not feed training recommendations or rewards. This flow does not set an eating target.
• Your local profile, equipment, goals, workouts, set logs, readiness answers and active session.
• Health Connect steps are read only after your explicit tap and optional Android permission. Without local-history consent, the current count stays in memory for that interaction. If you separately choose to save step history, daily manual totals and successful explicit Health Connect reads are stored on this device and included in user-requested backups, not automatically synced to LiftNext. Manual and Health Connect totals are alternative sources, never added together. If you review a starting step goal, full-day confirmations and the seven-day source/count references you accept are also stored locally; they are not automatically sent to LiftNext.
• Optional daily goals, water entries, cardio entries, food entries and barcode lookups are local app data. Food entries can include calories, protein, carbohydrate and fat you confirm; missing values are unknown, not zero. Protein ranges and calorie targets are optional user choices. Hide-calories and protein-only settings hide values without deleting older entries. This data may be included in a user-requested backup and is removed by a local reset; it is not automatically sent to LiftNext.
• Optional burned-calorie estimates are separate from food and training recommendations. After your explicit tap and optional Android active-energy permission, LiftNext can read a Health Connect active-calorie aggregate. No raw records or provider identifiers are retained. Without separate history consent the result stays in memory; consenting stores only the daily aggregate, captured window and observation time locally for a weekly view. These observations remain partial, not complete days. Optional weight/height overrides and user-confirmed active workout durations also stay local, participate in private backups, and are not automatically synced. Steps and activity estimates never adjust food or protein targets or training progression.
• In versions with Energy estimates settings (0.7.2 and later), optional equation inputs are confirmed separately: age, the sex coefficient used by the equation, height, weight and optional body-fat percentage. These inputs, their confirmation time, source/revision and display/explanation choices stay on this device, separate from the training profile, account sync and coaching analytics. User-requested private backups include them. Restoring preserves valid inputs but pauses energy estimates until you review and enable them; invalid energy records are rejected before replacing app data. The master switch pauses estimates without deleting inputs; a local reset removes them. Food's hide-calories or protein-only choice also hides these estimates. Exported backup copies remain until you delete them.
• When connected: an opaque guest identifier, synced profile and workout events, configuration version and delivery status.
• If you protect an account: your normalized email address, hashed single-use login tokens and revocable sessions. Raw login tokens are not stored.
• If you join the Google Play tester queue: your normalized Google Play email, consent time, pending/invited status and beta-tester eligibility. Google receives the address when it is added to the Play testing allowlist.
• Feedback you deliberately submit. Technical context is included only when you select that option and is limited to platform, app version and screen.
• Only if you explicitly enable coaching analytics: a server-day bucket plus aggregate training days, session kind, exercise/main-set/rest-pause counts and plan lifecycle. The analytics records exclude identity, workout/exercise IDs, device/IP, health/recovery/profile data, notes and client timestamps. Network requests may use an IP address transiently for abuse protection; it is not included in those analytics records.

Why it is used

To generate and adjust workouts, restore data you choose to synchronize, operate account recovery, manage opted-in beta access and tester benefits, review aggregate coaching quality, investigate failures, respond to feedback and protect the service from abuse.

External lookups and handoffs

Barcode lookup is user-initiated: the web app uses the self-hosted proxy to request product data from Open Food Facts, while Android requests Open Food Facts directly. LiftNext does not upload photos or run a LiftNext photo-based food estimator. If you separately choose a user-directed handoff to Google Gemini in your browser, that is an external Google action governed by Google’s terms and privacy policy; LiftNext does not automatically send it.

Android barcode scanning uses Google Play services Code Scanner. ML Kit processes images, video and text on device; Google’s ML Kit terms say inputs and results are not sent to Google by ML Kit. Google’s Code Scanner data disclosure separately lists diagnostics and usage analytics collected by Google Play services: device and app information, device or other identifiers (including per-install identifiers), performance metrics, API configuration, input and output size, feature events and error codes.

With auto-zoom enabled, Google also collects a generated scan-session identifier, zoom-level changes and predicted barcode bounding-box coordinates.

Storage and sharing

The beta service and PostgreSQL database are self-hosted by the developer. We do not use behavioral advertising. Apart from the Google Play services diagnostics and usage analytics disclosed above, LiftNext does not use an additional third-party user-behavior analytics or crash-reporting SDK. We disclose data only when required by law, needed to provide an opted-in service such as Google Play testing, or necessary to protect users and the service.

Retention and control

Local data remains until you remove the relevant entries, reset the app, clear its storage or uninstall it. In Manual steps, pausing history saving stops future saves but keeps existing totals; Delete step history removes saved manual and Health Connect totals, their full-day confirmations and history-derived goal references, and turns history saving off. Your chosen goal number, Android permissions, water and training remain unchanged. Copies already exported in backups remain until you delete those backups. Connected account and tester-interest data remains until you request deletion. Turn coaching analytics off in Profile & Settings to stop future sends and clear unsent analytics. Already aggregated non-linkable analytics cannot be selectively deleted. Feedback remains until manually reviewed and deleted; a fixed deletion schedule is not yet operational. The web app can export or delete online data separately from local phone data. Request account and data deletion if that control is unavailable. Backups already made may persist until their normal replacement cycle.

Sensitive choices

Recovery context, chronic limitations, pain reports and body measurements are used only for their chosen training, safety or local tracking features. Optional protein ranges, calorie targets, water, steps and burned-calorie estimates do not change training progression or automatically adjust food targets. Food's hide-calories or protein-only choice also hides the calorie summary on Today; the earlier Today calorie-summary opt-in still applies. Burned-calorie visibility is a separate optional setting, off by default. Do not enter medical details into free-text feedback.

In Activity estimates, pausing device-history saving retains earlier observations until you choose Delete device-energy history. That deletion clears device-energy aggregates and turns their saving off. Delete all local energy observations also removes optional body overrides and confirmed durations and resets their display settings; it does not delete workout history, food, steps or your training profile. Deletion invalidates pending reads so late results cannot restore deleted observations. Android permission revocation is separate, and copies already exported in backups remain until you delete them.

Contact

Questions, export or deletion help: liftnext@proton.me.