Privacy Policy

1. Scope

This Privacy Policy applies to the InMotus mobile app, InMotus website, and related features we make available. It does not apply to third-party services, websites, or apps that may be linked from the app or opened through system features.

2. Information We Handle

InMotus may handle the following categories of information:

• Profile information you choose to provide, such as name, profile photo, preferred gym, units, and app preferences.
• Workout and fitness information you create, including workouts, exercises, sets, notes, workout photos, body metrics, planned workouts, workout history, shared-workout payloads you choose to create or import, and analytics derived from that data.
• Nutrition and wellness information you create or save, including foods, brands, barcodes, serving sizes, meals, meal timing, calories, macronutrients, supported vitamins and minerals, ingredient information, caffeine amounts and preferences, hydration entries and goals, nutrition or diet targets, notes, saved and recent foods, nutrition history, and summaries or analytics derived from that data.
• Food-lookup request information when you use food search or barcode lookup, including the search term or barcode, pagination information, your device's country or region code when available, returned food records, and standard technical request information that may be processed by network and service providers, such as IP address, request time, device or app network information, and security or rate-limit information.
• Coach & Client information, if you use those features, including coach/client invites, relationship identifiers, display names, assigned workout snapshots, workout titles, exercise and set details, custom exercise and custom set-type definitions included in assigned workouts, coaching cues, scheduled dates, workout status, completion timing, ratings or skipped ratings, client comments, coach feedback, review status, and progress/metrics summaries derived from assigned workouts.
• Coach account information, if you activate Coach Tools, including Sign in with Apple identity information needed to verify the coach account, a hashed Apple user identifier, optional display name or email if Apple provides it and you choose to share it, a coach identifier, and hashed coach session tokens.
• Anonymous community contribution data, but only if you opt in. This may include aggregate workout metrics such as day bucket, workout duration, total volume, total sets, total reps, workout rating, set-type counts, superset count, drop-set count, and limited built-in exercise category information needed to produce community-wide statistics. It does not include account identifiers, exact workout timestamps, notes, photos, profile/body data, gym data, custom exercise names, or other personally identifying freeform content.
• Gym barcode information you choose to add, scan, save, or render for your own use.
• Device permissions and limited device data needed for app features, such as camera access for food or gym barcode scanning, profile photos, and workout photos, photo library access for selecting images, microphone and speech-recognition access for optional voice command or workout voice-capture features, notification settings, push notification device tokens, app version, install identifiers, App Attest keys or challenges, and similar security or delivery data.
• Purchase and entitlement information provided through Apple when you buy, restore, or manage premium or coach access, such as product identifiers, subscription status, signed transaction information, App Store notification information, and app account tokens used to associate coach entitlements with the correct coach identity.
• Diagnostic, audit, and abuse-prevention information, such as app logs you explicitly enable or export, API audit events, rate-limit records, request validation outcomes, and privacy-safe security reason codes used to protect the service and troubleshoot issues.

3. How Information Is Used

We use the information handled by InMotus to:

• provide workout logging, history, metrics, planning, barcode, profile, workout-photo, workout-sharing, and settings features;
• provide nutrition logging, food search and barcode lookup, saved-food, meal, calorie and nutrient, hydration, caffeine, nutrition-goal, history, summary, import, and export features;
• support optional voice-driven command and workout-entry features;
• store and display your local workout and nutrition data on your device;
• provide Coach & Client features, including coach invites, client connections, workout assignment, coach cues, assigned-workout completion, client comments, coach feedback, review workflows, and progress metrics;
• verify coach account identity through Sign in with Apple;
• determine whether Premium or Coach subscription features should be available based on Apple-managed purchase or subscription status;
• register push notification devices and prompt apps to refresh coach/client data after remote changes;
• generate summaries, analytics, and workout or nutrition insights inside the app;
• generate and display public community statistics if you choose to contribute anonymous aggregate workout metrics;
• protect the app and backend against abuse, fraud, unauthorized access, replay attacks, and excessive automated requests;
• support troubleshooting when you choose to export diagnostic data; and
• improve future versions of the app.

We do not sell your personal information.

4. Local-First Data Handling

InMotus is designed so that your personal workout workspace, workouts, profile, nutrition logs, saved foods, meals, diet goals, hydration entries, caffeine preferences, and related fitness or wellness data are stored locally on your device unless you take action to look up, export, share, contribute, or sync information through a feature that requires it. This means:

• your local data may be lost if your device is lost, damaged, reset, or erased;
• you are responsible for using the app's backup or export tools if you want an extra copy; and
• personal workout and nutrition data does not automatically become cloud-synced just because you use the app.

Some features require remote processing or storage. These include food search and barcode lookup, anonymous community contribution, Coach & Client sync, coach account activation, push notifications, StoreKit entitlement verification, App Store Server Notifications, App Attest request signing, audit logging, and rate limiting.

5. Nutrition and Consumer Health Data

Nutrition information may be sensitive health or wellness information. InMotus handles nutrition information as follows:

• Nutrition logs, meals, saved foods, serving selections, goals, hydration entries, caffeine preferences, notes, and derived summaries are stored in the app's local data store. The current food-lookup feature does not transmit your complete nutrition log, diet goals, hydration history, caffeine history, body metrics, workout history, profile, or Coach & Client information.
• When you search for food, the app sends the search term, page information, and your device's country or region code when available to the InMotus Nutrition API. When you scan or enter a food barcode for lookup, the app sends that barcode to the Nutrition API.
• The Nutrition API uses third-party food-data services to return search and barcode results. These services receive the search term or barcode information needed to return the requested result. They do not receive your complete local nutrition log or InMotus coach account information through the food-lookup feature.
• The Nutrition API does not maintain an app-level account or nutrition-history database. Food-lookup responses may be cached temporarily to improve availability and performance. Hosting, network, and security service providers may process standard technical request information for delivery, security, abuse prevention, rate limiting, and operational purposes.
• Selecting or saving a lookup result stores the resulting food information locally in InMotus. Nutrition information may also be included in an app-data export or import when you select the applicable backup scope. You control the destination and recipient when you export or otherwise share that file.
• Nutrition logs and lookup activity are not currently included in anonymous community contribution and are not currently shared with a coach through Coach & Client features. If we introduce nutrition sharing, coach visibility, community contribution, advertising use, or another materially different use, we will update this Policy and provide additional notice or consent where required before enabling that use.

We do not sell nutrition or other consumer health data, and we do not use it for targeted advertising.

Depending on where you live and subject to applicable exceptions, you may have rights to confirm whether we collect, share, or sell consumer health data; access or delete that data; withdraw consent from future collection or sharing; or appeal a decision concerning a request. Many local nutrition records can be edited or deleted directly in the app. You may submit other requests or appeals to privacy@inmotus.app with the subject "Consumer Health Data Request" or "Privacy Appeal." We may take reasonable steps to verify that a request concerns you before acting on it.

6. Coach & Client Data Handling

Coach & Client features are optional and use cloud-backed hosting, network, security, and data-storage services. Clients can receive coach workouts without creating an account. Coaches must activate Coach Tools with Sign in with Apple and an eligible Coach subscription.

When a coach and client connect:

• the coach can create an invite and the client can import and accept it;
• the coach can assign workouts, schedule workouts, include coaching cues, review completion status, view assigned-workout metrics, and send feedback;
• the client can receive assigned workouts, run assigned workouts, override-start scheduled workouts, complete workouts, provide ratings or skip ratings, add comments, and receive coach feedback; and
• related status and completion data may sync between the coach and client.

If a coach and client disconnect, active access to assigned workouts may be removed or hidden. Some coach-side history may be retained so the coach can review past assigned-workout activity, create a reconnect invite, or maintain continuity if the same client reconnects. The app may provide a permanent delete option for retained former-client history. Permanent deletion is intended to remove retained coach-side history for that former client and cannot be undone.

7. Coach Accounts and Apple Services

Coach account activation uses Sign in with Apple. Apple provides an identity token that we verify server-side. We store hashed account identifiers and, where provided and allowed by your Apple settings, limited display name or email information. We do not store your Apple ID password.

Purchases, subscriptions, renewals, cancellations, refunds, billing issues, and App Store account management are handled by Apple. We use StoreKit transaction data and App Store Server Notifications to determine whether Premium or Coach features should be available.

8. Anonymous Community Contribution

If you opt into anonymous community contribution:

• contribution is optional and off by default;
• contribution sends only limited aggregate workout metrics intended for community statistics;
• contribution is one-way and does not create a user account or profile on our servers;
• turning the setting off stops future contributions but does not retroactively remove previously aggregated statistics; and
• community statistics may remain visible to all users whether or not they contribute.

9. Sharing and Disclosure

We do not sell your personal information. We may share or disclose information in the following situations:

• when you explicitly export or share data, including sharing a workout file with another person or app;
• when you request food search or barcode lookup, in which case the search term, barcode, region information when available, and related technical request information may be processed by the InMotus Nutrition API and third-party food-data, hosting, network, and security service providers as described above;
• when you use Coach & Client features, in which case assigned workouts, cues, status, completion data, comments, ratings, feedback, and related metrics may be shared between the connected coach and client as part of the feature;
• when you opt into anonymous community contribution, in which case limited aggregate workout metrics are transmitted to our community statistics backend so we can produce public community-wide summaries;
• when Apple processes purchases, subscriptions, Sign in with Apple, push notifications, App Store Server Notifications, or other Apple-managed services;
• when hosting, network, security, and data-storage service providers process backend data for Coach & Client sync, community contribution, API security, rate limiting, audit logging, and related services;
• when you open iOS system features or third-party destinations from the app;
• when disclosure is required by law, legal process, or valid governmental request; or
• when disclosure is reasonably necessary to protect rights, safety, security, prevent abuse, or preserve the integrity of the app and backend services.

10. Permissions

InMotus may request access to:

• Camera: to scan food or gym barcodes or capture a profile photo.
• Photos: to let you choose barcode images, profile images, or workout photos.
• Microphone and Speech Recognition: to support optional voice command and workout voice-capture features. Depending on how Apple system services handle speech recognition on your device, audio or speech data may be processed by Apple to provide transcription or recognition results.
• Notifications: to support reminders, weekly summaries, coach/client remote-change alerts, assigned-workout updates, and similar app alerts.

You can control these permissions in iPhone Settings. If you deny a permission, some features may not work as intended.

11. Data Minimization and Privacy Defaults

Consistent with common mobile health app privacy practices, we aim to:

• limit data handling to what is reasonably needed for app functionality;
• use privacy-protective defaults where practical;
• avoid requesting permissions the app does not need;
• store hashed identifiers where practical for account, entitlement, audit, or security workflows; and
• keep sharing and disclosure limited and user-driven.

For anonymous community contribution specifically, we aim to:

• keep participation opt-in and off by default;
• avoid transmitting direct personal identifiers;
• avoid transmitting exact timestamps, freeform notes, photos, gym data, profile/body data, or custom exercise names; and
• use aggregate-safe buckets and built-in exercise/category metadata where practical instead of richer identifying content.

For Coach & Client specifically, remote storage is limited to data needed to operate coach/client connection, assignment, feedback, status, review, metrics, security, and entitlement workflows. Coach-assigned workout snapshots may include custom exercise names, custom set types, cues, and other assignment content needed for the client to run the assigned workout.

For Nutrition specifically, the current remote food-lookup service receives only the lookup request and technical information needed to return and protect that request. It does not receive the user's complete nutrition history, workout history, body metrics, profile, or Coach & Client records through food lookup.

12. Data Security

We use reasonable measures appropriate to the app design to help protect data handled by InMotus. These measures may include HTTPS, App Attest request signing, server-side Apple identity verification, StoreKit transaction verification, hashed account/session identifiers, request validation, rate limits, audit logs, and access checks for coach/client relationships and entitlements.

However, no system or device is completely secure, and we cannot guarantee absolute security. Your device security, passcode settings, iCloud/device backup practices, Apple ID security, and physical control of your device are important parts of protecting your data.

13. Children

InMotus is not intended for children under 13. If you believe a child under 13 has provided personal information through the app, contact us and we will take reasonable steps to address the issue.

14. Your Choices

Depending on the current app features, you may be able to:

• edit or delete workout, nutrition, profile, and fitness data within the app;
• export your data;
• import data you previously exported;
• opt into or out of anonymous community contribution;
• manage coach/client connections;
• disconnect from a coach or client;
• permanently delete retained former-client history where the app provides that option;
• control permissions in iOS settings;
• manage subscriptions through Apple; and
• delete the app or local app data from your device.

Some remote records may be retained for legitimate operational, security, legal, audit, anti-abuse, entitlement, or backup-integrity purposes where appropriate.

15. App Store Privacy Disclosures

We may provide privacy disclosures in the App Store, including Apple privacy nutrition label disclosures, based on the app's current data practices. If the app's data practices change, we may update those disclosures and this Privacy Policy.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice in the app or by other reasonable means. The updated version becomes effective on the date shown above.

17. Contact

For privacy questions, contact:
privacy@inmotus.app
InMotus