App Privacy Policy

IRON CLUB FITNESS — PRIVACY POLICY

Effective Date: April 29, 2026

This Privacy Policy explains how Iron Club Fitness, LLC ("Iron Club Fitness," "we," "our," or "us") collects, uses, shares, and protects information when you use the Iron Club Fitness mobile application and related services (the "Platform").

By using the Platform, you agree to the data practices described in this Policy. If you do not agree, do not use the Platform.

1. INFORMATION WE COLLECT

We collect the following categories of information:

Account Information
- Email address (required to create an account)
- Password (stored as a secure hash; we never see or store your password in readable form)
- Username, and optional display name
- Phone number, if you choose to verify or link one for account security and contact-based discovery (see Section 5)

Profile Information
- Profile photo, bio, goals, and any other information you choose to add to your profile

User Content
- Posts, workouts, comments, replies, and other content you submit
- Media files (photos, videos) you upload
- Saved posts and saved workouts
- Personal records ("PRs"), workout history, and fitness logs

Health and Fitness Data
- Workout logs, lift history, personal records, milestones, and achievements
- For Iron Club Premium subscribers who choose to use this feature: optional body measurements (such as weight and other physical measurements) entered manually by you
- This information is provided voluntarily and is not collected automatically or from any external source (such as Apple Health or connected fitness devices)

Gym Hub Data
- Your registered home gym and alternate gym (gym name, gym ID, and city), if you choose to register at a gym hub
- Your check-in history at gyms you are registered at (timestamps and gym identifiers)
- Gym tags you apply to posts and workouts (the gym name and ID associated with each tagged post or workout)
- This information is provided voluntarily and is not verified or confirmed by us

Direct Messages
- Messages you send and receive, including text, shared posts, shared workouts, and reactions
- Message metadata (timestamps, thread membership, read status)

Coaching Data (if you use the coaching feature)
- Workout logs, session notes, journal entries, documents, and other fitness data logged by a coach on behalf of a client
- See Section 6 for details

Contacts Information (if you opt in to Find Friends)
- When you enable contact-based discovery, the Platform reads phone numbers from your device's contacts on-device, converts each number into a one-way cryptographic hash (SHA-256), and uploads only the hashes — never the raw phone numbers, names, or any other contact detail
- See Section 5 for the full description of how this works

Daily Quote Widget Data (if you use this Premium feature)
- Your selected quote pack preference (stored on our servers and synced to your device so the widget reflects your current selection)
- Quotes from your selected pack are cached to your device the first time you open the app after choosing a pack, and the cache refreshes automatically in the background approximately every 24 hours or immediately when you switch packs
- No additional personal information is collected by the widget itself; the widget reads only the locally cached quote data on your device
- Quote pack preference is associated with your account and is deleted when you delete your account

Usage Data
- Feature interactions, session duration, screens viewed, taps, and general app activity
- Engagement signals (likes, saves, comments, follows)

Device and Technical Data
- Device identifiers, device model, operating system version, app version
- IP address and IP-derived general location (e.g., city, state)
- Crash reports and diagnostic logs (via Firebase Crashlytics) to help us fix bugs

Push Notification Data
- Device tokens (via Firebase Cloud Messaging and Apple Push Notification service) used to deliver notifications to your device

Subscription Data
- If you subscribe to Iron Club Premium, we receive subscription status, renewal date, and entitlement information from Apple and RevenueCat (our subscription management provider)
- We do NOT see or store your payment card details — all payment processing is handled by Apple

Safety and Trust Data
- Reports you submit (category, content context, timestamps)
- Blocks you initiate (who you've blocked, when)
- Enforcement actions taken on your account or content

Authenticity Data
- To protect against abuse and ensure traffic is coming from legitimate copies of our app, we use Firebase App Check with Apple's App Attest. This produces a short-lived cryptographic token that verifies your device is running a legitimate, unmodified copy of the app. We do not receive any personally identifiable information from this process.

2. HOW WE USE INFORMATION

We use information to:

- Provide and operate the Platform (accounts, feed, DMs, notifications, workout logging, discovery)
- Authenticate you and keep your account secure
- Deliver and manage Iron Club Premium subscriptions and premium features
- Enable contact-based discovery (if you opt in)
- Personalize your experience and show you relevant content and suggested connections
- Operate Gym Hubs — including displaying gym registrations and check-in counts on hub pages, populating hub feeds with tagged posts and workouts, and optionally displaying your gym on your profile if you choose to show it
- Support the coaching feature by storing and displaying fitness data logged by coaches on behalf of their clients
- Deliver the Daily Quote Widget feature by storing your quote pack preference and syncing quote content to your device
- Maintain safety, enforce our Terms of Service, prevent abuse and fraud, and investigate reports
- Apply rate limits and abuse protections on sensitive features (such as contact sync) to protect your account and the community
- Communicate with you about service updates, security notices, and support matters
- Improve performance, troubleshoot issues, and develop new features
- Comply with applicable laws and legal processes

3. LEGAL BASES FOR PROCESSING (FOR USERS IN APPLICABLE REGIONS)

Where required by law (such as in the EU, UK, or other jurisdictions with similar frameworks), we rely on the following legal bases to process your information:

- Performance of a contract: to provide you with the Platform and subscription services you request
- Legitimate interests: to operate, improve, and secure the Platform, and to prevent abuse
- Consent: for optional features such as contact sync and push notifications
- Legal obligations: to comply with laws, legal processes, and government requests

You may withdraw your consent for optional features at any time in the app.

4. ANALYTICS AND DIAGNOSTICS

We use the following third-party tools to understand how the Platform is used and to fix problems:

- Firebase Analytics — aggregated usage and engagement data
- Firebase Crashlytics — crash reports and diagnostic information when the app encounters errors

These tools may collect device information, usage information, and technical logs. We do not use analytics for cross-app or cross-site behavioral advertising, and we do not sell your personal information.

5. CONTACT-BASED DISCOVERY AND PHONE NUMBERS

Iron Club Fitness offers an optional feature that helps you find people you already know on the Platform by matching your phone contacts to other users' verified phone numbers. This feature is strictly opt-in and designed to protect the privacy of both you and your contacts.

How it works:

- If you choose to use this feature, the Platform reads phone numbers from your device's contacts on-device.
- Each phone number is converted into a one-way cryptographic hash (SHA-256) on your device. A hash cannot be reversed to recover the original phone number.
- Only hashes are uploaded to our servers — we never see, receive, or store the raw phone numbers of your contacts, nor any other contact information (names, emails, photos, etc.).
- Your hashes are stored and used solely to identify which of your contacts are already on Iron Club Fitness and to notify you when someone from your contacts later joins.
- If a phone number from your contacts matches a user who has verified their phone number on the Platform and has not opted out of phone discovery, that user may appear in your "Find Friends" suggestions.

Your own phone number:

- If you verify your phone number to your account, the number itself is stored on our servers (in hashed form) so that users who have you in their contacts can find you.
- You may opt out of phone-based discovery at any time in your settings. If you opt out, your phone hash will not be used to match you to other users' contacts.

Abuse protections:

- Contact sync is rate-limited to prevent bulk enumeration. You can only sync your contacts a limited number of times per hour.
- We do not allow bulk or automated lookups of phone numbers through any public interface.

Notifications from contact sync:

- If you enable push notifications, you may receive a notification when someone in your contacts joins Iron Club Fitness. You can disable this type of notification in your in-app settings at any time.

Deleting contact data:

- If you turn off contact sync, your uploaded contact hashes are deleted from our servers.
- If you delete your account, all uploaded contact hashes associated with your account — and any matches pointing to your account from other users' contact lists — are permanently removed.

6. COACHING DATA

The Platform's coaching feature allows one user (a "coach") to log workouts, record session notes, store documents, and track fitness data on behalf of other users ("clients"). Key points:

- A client's data entered through the coaching feature is stored under the coach's account and is visible only to that coach and, where applicable, the specific client.
- If you are a client, any data logged about you by your coach lives in the coach's coaching hub. This data is separate from any data you log on your own personal Iron Club account.
- A client may also subscribe to Iron Club Premium independently and log their own personal workouts and data. A client's personal premium data is NOT shared with their coach automatically, and a coach's view of a client does not grant access to the client's personal account data.
- If a coach removes a client from their coaching hub, the client's data stored within the coaching hub is deleted. The client's own independent account data is unaffected.
- If a coach deletes their entire account, all coaching hub data — including all clients' coaching-hub data under that coach — is permanently deleted.

Iron Club Fitness does not verify any coach's professional credentials, certifications, or qualifications. The coaching feature is a software tool for logging and organization only. See our Terms of Service for the full coaching disclaimer.

7. PUSH NOTIFICATIONS

If you enable notifications, we use Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) to deliver alerts such as:

- Likes, comments, replies, mentions, and crew activity
- Direct message notifications
- Crew invites and acceptance confirmations
- Safety and moderation notices
- Contact-sync events (when someone from your contacts joins)
- Subscription and account notices

You can disable notifications at any time in your device settings or within in-app notification preferences.

8. REPORTS, SAFETY, AND CONTENT MODERATION

The Platform includes in-app reporting and blocking features. When you submit a report, we may collect and review:

- The reported content
- Account identifiers and timestamps
- Related context from posts, comments, or messages
- Category of report (e.g., spam, harassment, nudity, impersonation)

We use this information to:

- Evaluate and enforce our Terms of Service and community standards
- Remove content, limit visibility, restrict features, or disable accounts
- Investigate fraud, abuse, and threats to user safety
- Cooperate with law enforcement where legally required or where we believe in good faith it is necessary to prevent harm
- Preserve evidence relating to reported conduct

We reserve the right to act on reports at our sole discretion. Submitting a report does not guarantee a specific outcome or response time.

9. HOW WE SHARE INFORMATION

We share information only in the limited circumstances described below. We do NOT sell your personal information to third parties, and we do NOT share personal information for cross-context behavioral advertising.

With Service Providers

We use third-party service providers who process information on our behalf under contractual confidentiality obligations:

- Google Firebase — authentication, database (Firestore), cloud storage, Cloud Functions, push messaging (FCM), analytics, crash reporting (Crashlytics), and App Check
- Apple — App Store distribution, in-app purchase processing, Apple Push Notification service (APNs), and Apple App Attest
- RevenueCat — subscription management, entitlement tracking, and billing event processing (RevenueCat receives your user ID and subscription receipt data; it does not receive payment card information)
- Shopify — hosting of our merchandise store (see Section 15). Purchases made through Shopify are subject to Shopify's own terms and privacy policy

With Other Users

- Information you make public on the Platform (username, display name, profile photo, public posts and workouts) is visible to other users.
- Your private account content is visible only to people you approve as crew members or specific audiences you select.
- If you register at a gym hub, your membership and check-in count are visible to other users browsing that gym's hub. If you choose to display your gym on your profile, your gym name and city are visible on your profile page.
- Gym tags on your public posts and workouts are visible to anyone who can see those posts or who browses the associated gym hub.
- Users who have your phone number in their contacts may be able to discover your account via contact sync, unless you opt out.
- When you block another user, that user cannot see your future posts or contact you, and is hidden from your feed and discovery.

For Legal or Safety Reasons

- We may disclose information if required by law, legal process, or a valid government request
- We may disclose information to protect the rights, property, and safety of Iron Club Fitness, our users, or the public (for example, to investigate credible threats of violence, fraud, or CSAM)

In Connection with Business Transfers

- If Iron Club Fitness is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will require the successor to continue honoring this Privacy Policy or provide you advance notice.

10. DATA RETENTION

We retain information as long as your account is active or as needed to:

- Provide the Platform
- Comply with legal obligations
- Resolve disputes and enforce our agreements
- Prevent abuse and protect user safety

When you delete your account, we delete or de-identify information associated with your account, including:

- Your user profile, user directory entry, and username reservation
- Your posts, workouts, personal records, and saved content
- Your direct messages you sent (copies retained by recipients in their own threads may persist)
- Your coaching hub data (all clients under you)
- Your uploaded contact hashes and matched-contact entries
- Your phone verification data
- References to you in other users' contact-match lists, block lists, and crew lists
- Your fitness data, journal entries, body measurements, and media files
- Your gym registrations (home gym and alternate gym), check-in history, and gym tags on your posts and workouts
- Your quote pack preference and any associated widget configuration data
- Your push notification tokens
- Your rate-limit and safety records associated with your account

We may retain certain limited information after deletion where:

- Required by law or regulation
- Necessary to enforce our agreements, prevent fraud, or investigate ongoing abuse
- Preserved in secure backups for a limited period (deleted on our standard backup rotation cycle)

If your Iron Club Premium subscription lapses without account deletion, your premium-only data (analytics, journal entries, body measurements, coaching hub, and quote pack preference) is retained on our servers and becomes accessible again if you resubscribe.

11. YOUR CHOICES AND RIGHTS

You have the following choices regarding your information:

- Access and Export: request a copy of certain information we hold about you
- Correction: update or correct profile information directly in the app
- Deletion: delete your entire account at any time via Settings → Account → Delete Account (this triggers the deletions described in Section 10)
- Privacy Controls: make your account private, block users, and control who sees your content
- Phone Discovery: opt out of phone-based contact discovery at any time in settings
- Contact Sync: disable contact sync at any time; doing so deletes your previously uploaded hashes
- Notifications: disable push notifications device-wide in iOS settings or per-category in the app
- Body Measurements: delete manually entered body measurement data within the app at any time
- Gym Profile Display: control whether your registered home or alternate gym is shown on your profile via your profile settings
- Quote Pack Preference: change or clear your selected quote pack at any time via Settings → Quote Pack

To exercise these choices, use the in-app controls or contact us at luke.hoyle@ironclubfitness.com. We may take reasonable steps to verify your identity before acting on a request. We may deny requests as permitted by law (for example, where granting the request would violate another person's privacy or where we are legally required to retain the information).

12. STATE PRIVACY RIGHTS (U.S.)

If you are a resident of certain U.S. states (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with similar privacy laws), you may have additional rights, which may include:

- The right to know what personal information we collect and how we use it
- The right to access and obtain a copy of your personal information
- The right to correct inaccurate personal information
- The right to delete personal information (subject to legal exceptions)
- The right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising
- The right to limit the use of sensitive personal information
- The right to non-discrimination for exercising any of these rights

Iron Club Fitness does NOT sell personal information, and we do NOT share personal information for cross-context behavioral advertising. If this changes in the future, we will update this Policy and provide the opt-out options required by law.

To exercise your rights, use the in-app controls (including in-app account deletion) or contact us at luke.hoyle@ironclubfitness.com. You may designate an authorized agent to make requests on your behalf, subject to our verification procedures.

13. CHILDREN'S PRIVACY

The Platform is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13.

Some jurisdictions (including Florida, South Korea, Spain, and Quebec) require a higher minimum age for social media platforms. If you are in one of those jurisdictions, you must meet the higher local age requirement (typically 14).

If we learn that we have collected personal information from a child under the applicable minimum age without appropriate consent, we will terminate the account and delete the information. If you believe a child under the applicable minimum age has provided us information, contact us at luke.hoyle@ironclubfitness.com.

14. SECURITY

We use reasonable administrative, technical, and physical safeguards to protect information, including:

- Encryption of data in transit (HTTPS/TLS) and at rest (via our cloud infrastructure providers)
- Access controls restricting internal access to personal information
- App Check with Apple App Attest to prevent abuse by unauthorized clients
- Server-side enforcement of data-access rules (a user cannot read another user's private data through any supported interface)
- Rate limiting on sensitive operations such as contact sync
- Secure password storage (Firebase Auth uses industry-standard password hashing)

No system is 100% secure, and we cannot guarantee absolute security. If we become aware of a security breach that affects your personal information, we will notify affected users as required by applicable law.

15. MERCHANDISE STORE (SHOPIFY)

Iron Club Fitness operates a merchandise store hosted on Shopify. The Platform includes an embedded view of our Shopify store, which uses a separate login and is operated under Shopify's infrastructure.

- When you access the Shopify store through the Platform, your interactions with the store are governed by Shopify's terms of service and privacy policy, in addition to any policies we post on the Shopify storefront.
- Iron Club Fitness receives order-related information (such as order confirmations, shipping addresses, and return requests) necessary to fulfill and support your purchase.
- Payment information (card numbers, billing addresses) is processed by Shopify and its payment partners — Iron Club Fitness does not see or store payment card details.
- The Platform may also include promotional cards that open our website in your device's external browser (for example, Safari). Once you leave the app, you are subject to your browser's and the destination website's terms and privacy practices.

16. INTERNATIONAL DATA TRANSFERS

Iron Club Fitness is based in the United States, and our infrastructure providers (including Google Firebase) operate servers in the United States and other jurisdictions.

If you access the Platform from outside the United States, you understand and agree that your information may be processed and stored in the United States and other jurisdictions where our service providers operate. These jurisdictions may have data protection laws that differ from those of your home jurisdiction.

Where required by applicable law (such as GDPR Standard Contractual Clauses), we rely on appropriate safeguards to protect international data transfers.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will:

- Update the Effective Date at the top of this Policy
- Provide notice in the app or by email (for significant changes)
- Where required by law, obtain your consent

Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

18. CONTACT

If you have any questions, concerns, or requests regarding this Privacy Policy or your information:

Iron Club Fitness, LLC
North Carolina, United States
Email: luke.hoyle@ironclubfitness.com

We respond to privacy inquiries as promptly as reasonably possible and within the timeframes required by applicable law.