Privacy Policy

1. The essentials

Steely is a workout diary. Your workout records are stored locally on your device. You do not need to create a Steely account, and we do not operate a server that stores or synchronises your workout diary.

Local storage does not mean that no information leaves your device. The app uses service providers for subscriptions, product analytics, crash reporting and app updates. Those services receive the limited information described below, including a randomly generated Steely ID. This information is pseudonymous, not necessarily anonymous. If you choose to connect another app, the workouts you log in Steely are also sent to that app (section 2).

We do not sell your personal information or share it for cross-context behavioural advertising. Steely does not show ads, use advertising identifiers, record your screen or use session replay.

2. Your workout diary and Apple Health

Workouts and activities you log in Steely, including exercises, sets, repetitions, weights, times, notes, templates and preferences, are stored in the app's local database. Steely does not upload a copy of that database to our servers. You can export your diary as CSV files and choose where to save or share them. Any recipient or storage service you choose then handles that copy under its own terms.

If you connect another app to Steely, Steely sends the workouts you log in Steely directly from your device to that app's server. These are gym workouts, with their names, exercises and sets, and activities you add by hand, with their notes. This happens only after you open that app's own connection link and allow it in Steely. When you connect, Steely also sends the workouts you logged earlier, and then keeps sending as you add or edit workouts until you disconnect the app in Profile, which you can do at any time. Workouts imported from Apple Health are never sent. We do not receive or store a copy of what is sent. The receiving app's handling of the data is governed by that app's own privacy policy. Disconnecting stops further sending; it does not remove what that app has already received, and deleting a workout in Steely does not delete it there.

After you finish a workout, Steely may show a short recap of it on the Summary screen. The recap is generated on your iPhone by Apple Intelligence from a small set of facts taken from your diary. It is held in memory only: it is not stored, not sent to us or to any service provider, and not included in analytics. It is available only on devices with Apple Intelligence enabled and when the app language is English.

If you choose to connect Apple Health, Steely requests permission to read workout information. This can include workout type, start and end times, duration, distance, source application and the identifiers needed to recognise workouts. Steely reads the ranges it needs and keeps a temporary copy only in memory to show your activities in one calendar and avoid duplicates. Health workouts are not stored in Steely's database or a file cache. The integration is read-only: Steely does not write to Apple Health. When you explicitly export your diary, Steely reads Health history again and includes it in the export. The temporary export file is removed after the share sheet closes; a copy left by an interrupted export is cleaned up on the next app launch.

You can refuse or revoke Health access in your device's Health or privacy settings. Steely refreshes the Health information it has loaded when you return to the app. If a read fails, it may temporarily show the last results held in memory with a notice. Erasing data in Steely clears this memory cache but does not delete the original records in Apple Health. If Health remains connected, those records are read again when you next open Steely.

We do not send Health workout records, Health identifiers, routes or notes to product analytics or crash-reporting services. Product analytics does not record Health connection choices or import results. Technical error reports may identify a failed app operation, without its Health data. Health data is not used for advertising, marketing or unrelated data mining.

Device backup and restore are controlled by your device settings and Apple. Workouts logged in Steely and app preferences may be included in an Apple device backup; Health workouts held only in memory are not part of Steely's database backup. Apple Health manages its own storage and backups. This is separate from a Steely-operated sync service. Removing local data does not remove previously created backups or exported files. See Apple's Privacy Policy for information about Apple's services.

3. Your Steely ID

The app generates a random identifier, called your Steely ID, and stores it on your device. We use the same ID with PostHog, Firebase Analytics, Sentry and Adapty to associate app events, diagnostics and subscription status with the same local installation and to help with support.

This ID is not an account, password, advertising ID or proof of identity. It does not automatically transfer your diary or subscription profile to another device. It is retained when you use Erase all data; a clean installation creates a new ID, while restoring the app's database from a backup can restore the previous ID.

You can find and copy the ID in Profile or on the subscription screen. If you contact support, include it when relevant so we can locate associated service records. Please do not send passwords, payment-card details or unnecessary health information.

4. Information sent to service providers

• Product usage. PostHog and Google Analytics for Firebase receive app-open, selected onboarding and subscription-flow events: neutral onboarding steps, paywall state, plan selection, purchase or restore outcome, rating-prompt exposure and subscription lapse. These events are associated with your Steely ID, an event timestamp and app version. They do not include Health information, diary contents, sports, activities, workout or set details, durations, template or record identifiers, or free-text notes. PostHog is configured to discard client IP addresses from events and without GeoIP enrichment or automatic device, language or screen properties for these product events. Firebase Analytics may independently process technical app-instance, device, operating-system, language and approximate-region information as part of its service.
• Diagnostics. Sentry receives errors and crash reports, app and operating-system versions, technical device details, stack traces and your Steely ID when available. We restrict the content sent with JavaScript errors; native crash reports also contain technical information produced by the operating system and native SDK. In our Sentry configuration, screenshots, session replay and automatic interaction breadcrumbs are disabled. Versions that include Firebase Crashlytics also send crash traces, technical app and device information, and installation identifiers to Google for crash diagnosis.
• Subscriptions. Apple processes App Store payments. Adapty helps us validate purchases, restore access and provide subscription offers. It processes your Steely ID, technical installation information, product and transaction identifiers, purchase and renewal status, trial eligibility, expiry, refunds and related subscription information. We do not receive your full payment-card details. Production subscription events may also be forwarded from Adapty to PostHog for subscription analytics; non-production forwarding is filtered before storage.
• Updates and network requests. Expo delivers app updates and related technical services. When your device contacts Expo or another provider, the provider receives network information such as your IP address and request details. Google Analytics may derive an approximate region from network information. Steely does not request GPS location permission or collect a precise location through this feature.
• Support. If you email us, we receive your email address, your message, the diagnostic details you choose to send and any attachments. The app's support message can include your Steely ID and technical app information. We use this to respond to your request.

5. Why we process information

We process information to provide the diary and optional Health import, manage paid access and restores, answer support requests, understand which features work, diagnose failures, prevent misuse and meet legal obligations. We do not use your diary to make automated decisions that have legal or similarly significant effects on you.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you for requested services; legitimate interests, where permitted, in maintaining and improving a reliable and secure app; compliance with legal obligations; and consent where required, including for optional access to Apple Health. Where a separate consent is legally required for a particular processing activity, this policy does not replace that consent.

We do not collect your email during onboarding or operate a marketing mailing list through this app or this website.

6. Providers and international transfers

We use the following providers for the purposes described above. Their privacy information explains their own processing:

• PostHog — product and subscription analytics; our project uses its EU cloud.
• Google Analytics for Firebase — app analytics and Firebase Crashlytics crash reporting in versions that include it.
• Sentry — error and native crash reporting; our organisation uses its EU data-storage region.
• Adapty — subscription management and purchase validation.
• Expo — delivery of app updates and associated technical infrastructure.
• Apple — App Store purchases, Apple Health permissions and device services you use.

EU project storage does not mean every processing operation takes place only in the EU. We are based in Serbia, and providers and their subprocessors may process information in other countries, including the United States. Where applicable law requires safeguards, transfers must be covered by an applicable adequacy decision, approved contractual safeguards or another lawful mechanism. Contact us for information about safeguards relevant to your data.

We may also disclose information where legally required or reasonably necessary to protect rights, investigate fraud or address security incidents. We limit such disclosures to information relevant to the request or purpose.

7. This website and cookies

The current steelyapp.com website is a static information site. It contains no advertising scripts, analytics SDKs, tracking pixels, forms or non-essential cookies. Fonts and visual assets are served with the site rather than requested from an external font service.

The service hosting the website necessarily processes connection information, such as IP address, requested URL, time and browser information, to deliver pages and protect the service. Following an external link takes you to a service with its own privacy practices. A mail link opens your chosen email application; it does not send a message until you choose to send it.

8. Retention and deletion

Your local diary remains on your device until you remove it, erase app data or uninstall the app. Within the app, some deletions are logical deletions used to preserve related records; deleting an item is not a secure overwrite of device storage. Backups and exported copies remain under your and the relevant provider's control.

Server-side records are retained for as long as necessary for their stated purposes. The criteria include whether a subscription is active, whether a transaction, refund or dispute still needs to be resolved, the age and usefulness of analytics or diagnostic records, provider retention settings, and any legal requirement to keep records. Support correspondence is retained as needed to handle the request and related follow-up or disputes. Retention can differ between providers and data categories; contact us for information about records associated with your Steely ID.

Erase all data is not a subscription cancellation or a request to delete provider records. It removes the app's training data but preserves certain settings and your Steely ID. It also disconnects any connected apps, without removing what they already received. Uninstalling stops future collection by that installation, but Apple and Adapty may continue to process subscription transactions, renewals or refunds. It does not automatically delete information already sent to providers or cancel a subscription.

To request deletion of information we or our processors hold, email us. We may ask for proportionate information to verify your request and locate the relevant records. We will explain any information we must retain and why.

9. Your choices and privacy rights

Depending on the law that applies to you, you may have rights to access, correct or delete personal data, receive a portable copy, restrict processing, object to processing based on legitimate interests, withdraw consent where processing relies on it, and complain to a competent data-protection authority. Withdrawal does not affect the lawfulness of earlier processing. In Serbia, the supervisory authority is the Commissioner for Information of Public Importance and Personal Data Protection; residents of other countries may contact their local authority.

You can manage Health permissions in iOS, export local diary records from Profile and contact us at support@steelyapp.com about server-side information. Steely currently does not provide an in-app analytics opt-out switch. A request to delete past data does not by itself disable future collection from an app you continue to use.

For California residents, where the CCPA/CPRA applies, these rights can include knowing, accessing, correcting and deleting information, opting out of sale or sharing, limiting certain uses of sensitive personal information, and non-discrimination for exercising your rights. We do not sell or share personal information for cross-context behavioural advertising. You or an authorised agent can contact us using the address above.

10. Children

Steely is intended for people aged 16 or older, or any higher minimum age required by local law. We do not knowingly collect personal information from children below that age. If you believe a child has provided information to us, contact us so we can investigate and take appropriate deletion steps.

11. Security and changes

We use reasonable technical and organisational measures appropriate to the information we process, but no device, storage system or network is completely secure. Protect your device and backups, and share exports only with recipients you trust. If a personal-data breach requires notification, we will notify affected individuals and authorities as required by law.

We may update this policy as the app or its providers change. We will post the revised policy with an updated date and provide additional notice or obtain consent where required. Previous versions can be requested by email.

12. Contact

Aleksandr Kovalchuk
Serbia
support@steelyapp.com

For the rules governing use of Steely, see our Terms & Conditions.