Trust centre
Last checked 10 November 2026
How Liftsmith keeps your training and health data safe, in plain words. The details are in our privacy policy, and how to delete your data is on Delete your account.
Privacy
No ads, ever
We never sell or share your data with advertisers or data brokers.
Your training stays on your phone
The app works offline. Nothing leaves it unless you sign in to sync.
Accounts are optional
Sign in only if you want a backup and your other devices.
Usage stats you control
No advertising id. Off by default in the EU and UK, off anytime in Settings.
No cookies on this website
Visits are counted without cookies, and Global Privacy Control turns it off.
Delete anytime
Your account and everything synced to it, in a few taps.
Where synced data lives
In our own Turso database. Never with ad networks or data brokers.
Health data
Only what you allow
Health Connect and Apple Health readings, each with your permission.
Never in stats or ads
Health readings, weights and reps are never part of usage stats.
Limited Use
Follows Health Connect's Limited Use rules. Never read by people.
The camera stays on your phone
Rep counting is worked out on the device. Nothing is recorded.
Kept out of phone backups
App data skips cloud and computer backups. Sign-in or a backup file moves it.
Accounts
No passwords to leak
Sign in with Google, Apple, or a code we email you.
Secure sessions
Random tokens. The server keeps only a hash of each one.
Sign-in limits
Five tries per email code, and repeated sign-ins are slowed down.
Yours alone
Synced data only comes back to your devices. Progress photos never upload.
Payments
Store checkout
Google Play or the App Store take payment. We never see your card.
Receipts checked for us
RevenueCat verifies them and never gets your name, email or workouts.
Verified subscription events
Store events are checked with a shared secret before we act.
Infrastructure
HTTPS everywhere
With HSTS, so connections are always encrypted.
Security headers
No framing, no sniffing. Only the camera and Bluetooth are allowed.
Strict script policy
Each website page runs only the scripts it lists.
Our own code, not a CDN
Libraries and models are served by us. No trackers or ad scripts.
Rate limits on every public route
Kept in the database, so bursts can't get around them.
Uptime monitoring
The site and its database are checked from outside, around the clock.
Email and AI
SPF, DKIM and DMARC
Mail from getliftsmith.com is signed, and fakes are sent to spam.
Nothing until you confirm
Reminder emails need a confirmed address, with one-click unsubscribe.
AI drafts, human replies
A person reads and sends every reply to your email.
Operations
Locked-down admin access
Named staff accounts, two-step sign-in, every change logged.
No workouts for staff
The admin panel shows counts, never your workouts or health readings.
Tested on every change
Automated tests, accessibility checks and a dependency audit.
Security review
November 2026, with fixes for what it found.
Report a security problem
Email hello@getliftsmith.com. A person reads every report. See also our security.txt.