Cadence Lift Privacy Policy

Privacy at a glance

Cadence Lift is a strength-training log from LightPath Apps. Core workout logging needs no account. Optional Communities use a separate account. There is no advertising, analytics SDK, or cross-app tracking. Workout history, routines, body measurements, reminders, preferences, and local Coach chats are stored on your device unless you deliberately use one of the optional off-device features described below.

Since version 1.2, Cadence no longer creates iCloud workout backups or the older unlisted hosted workout links. Exports and everyday sharing go through files, images, text, and the system share sheet. If you use Communities, you can also post to a group or share a selected workout with it and, where its organizer allows web links, publish a seven-day web link to a post or strength workout, as described under Optional communities. The iPhone app retains a temporary read-only recovery path for old Cadence 1.1.x iCloud archives so affected users can restore and export a user-owned JSON copy.

Data stored on your device

• Sessions, exercises, sets, weights, reps, RPE, timestamps, and notes
• Workout templates, reminders, rest-timer settings, and preferences
• Body-weight and body-composition entries
• Coach profile fields and local Coach conversations
• Your billing customer ID and current Cadence Pro status, cached with RevenueCat's software to check Cadence Pro access
• A random installation identifier used for abuse prevention and support

Cadence uses SwiftData on iPhone and Room on Android. Deleting the app removes its ordinary local database. On Android, Clear storage does the same without uninstalling. Data that Cadence wrote into Apple Health or Health Connect remains in that health store until you remove it there.

Optional communities

Workout logging does not require a community account. If you use Communities, Cadence creates a separate random account ID and stores device credentials and a private recovery code in protected device storage. Our Cloudflare service stores credential hashes, memberships, display names, roles, joining requests, community names and goals, invitation settings, and your community preferences. We do not ask for an email address or upload your contacts to create this account.

You can link another device using a private, single-use code that expires after five minutes. The linked device receives its own community session, not your recovery secret. Keep linking codes private, and use the device controls to sign out other sessions when needed. Local workout databases are not copied by linking.

Groups start private with organizer approval required. The organizer can separately choose discoverability and whether approval is required. A discoverable group's name and goal appear in search. A private group's invitation code can be forwarded; anyone holding it can preview the group and request to join. Member lists are visible to current members. Keep workplace or other sensitive details out of names and goals if you do not want invitation recipients or discovery users to see them.

Chat, reminders, the social feed, workout sharing, and cardio sharing each start off, including for organizers. You choose them independently for each group. Chat text is sent to our service when you send a message. Sharing a workout requires selecting and reviewing that workout; joining or enabling sharing does not upload your history. Shared workout records contain the workout title, the date it was completed (never a time of day), and the exercise names, repetitions, weights, and units shown in the preview. They exclude heart-rate readings, bodyweight, RPE, private workout notes, and Coach conversations. Text you write in names, goals, messages, posts, captions, comments, or reports is still shared as entered; avoid sensitive details you do not want others to read.

Current members who opt into chat or workout sharing can view that respective content. Organizers can manage membership and review member reports, including the report reason and reference to the reported content. So that they can moderate, an organizer reviewing a report also sees the reported message, post or comment text, the reported workout's title, or the reported cardio workout's shared details, with any caption and the author's current display name. This applies even if the organizer has not turned on chat, the feed, workout sharing or cardio sharing, and even if there is a block between the organizer and the author. Reported content that has since been deleted, removed or expired is not shown. Community reminders are scheduled on your device after your permission; their lock-screen text does not include the group name, goal, or chat content. Community content is not sent to the Coach model.

You can report a community directly to LightPath Apps instead of reporting to its organizer. Direct reports go into a separate private case queue that the organizer cannot see. The queue stores your account and group IDs, your written reason, the case status, operator actions, and the decision. An authorized Cadence operator may inspect content members already shared in that group: member display names, messages, posts, comments, workout titles and captions, and share summaries. This inspection can include content hidden by a member block or participation setting; it does not include local workout history, health-store records, or Coach conversations. The operator may remove shared content, revoke a web link, or pause new joining and community activity while reviewing a case. Direct reports stay open until reviewed; their details, including case action history, are removed 90 days after resolution or the last follow-up. The group's separate action fingerprints expire after 90 days. If a pause lasts longer than that, a minimal case ID and group ID remain in the operator queue until the pause is lifted.

Messages and shared workouts expire from the service after 90 days, and each group retains at most its latest 500 messages and 500 shared workouts. Reports to the organizer also expire after 90 days; direct reports to Cadence follow the separate retention above. You can remove your shared messages and workouts sooner. Leaving or being removed from a group removes your messages and shared workouts from that group; reports may remain until reviewed or expired. Turning an opt-in off does not delete content already shared. Other members may have saved or photographed content they previously saw, and deleting it in Cadence cannot remove those copies.

The optional social feed adds text posts, workout captions, comments and kudos. Only participating members can view the feed; workout posts additionally require workout-sharing participation. In the app, members who can see a post or shared workout can also see who gave it kudos; the browser shows only the count. Blocking hides content and prevents interaction in both directions. The one exception is an organizer reviewing a report, who sees the reported content as described above whether or not they participate and even if there is a block between the organizer and the author. The latest 500 text posts are kept for at most 90 days. Comments expire after 90 days or when the parent post is removed, whichever is sooner. Groups allow up to 100 comments per post and 1,000 overall. Leaving or being removed also deletes your posts, comments and kudos; deleting a post removes its discussion.

Cardio sharing adds completed cardio workouts to the social feed. It is a separate choice for each group and also requires the social feed. Sharing a cardio workout requires selecting it and reviewing a preview; you can leave out the distance and add a caption. A shared cardio workout contains the activity, whether it was indoors or outdoors, the date it was completed, its duration, the distance if included, and your caption. Other members see the date it was completed and the date it was shared, never a time of day. Our service records when the share was created so it can order and expire it, but does not show that time to members. The shared cardio details never include workout start or end times, notes, effort, interval settings, heart-rate readings, or location. Only members who have turned on both the social feed and cardio sharing can view cardio workouts, apart from an organizer reviewing a report. Cardio workouts cannot be published as web links. Shared cardio workouts expire after 90 days, and each group keeps at most its latest 500. You can remove yours sooner, and leaving or being removed from a group removes them. Turning cardio sharing off does not delete cardio workouts you already shared.

Web publication requires two choices: the organizer allows web links, and the author explicitly publishes a selected post after reviewing it. Anyone with that link can see and copy the author's display name and selected text or workout, without joining. Group names, member lists, comments and kudos are not published. Links expire after seven days or when the shared content expires, whichever is sooner. Authors or organizers can revoke them. Disabling group web links invalidates all links; disabling social participation invalidates your links, and disabling workout sharing invalidates your workout links. Creating a new link for a post invalidates the previous link. Revocation cannot remove copies other people saved. Only a hash of the link secret is stored with the post. The browser viewer has no trackers, does not cache shared content and requests that search engines not index it. These controls do not prevent a recipient from copying or forwarding content.

You can also sign in to Communities in a web browser. The browser shows a short, single-use code that expires after ten minutes; you enter it in the Cadence app on a phone already signed in to Communities, review the request, and approve or deny it. Approve only a request you started yourself. A signed-in browser can read community feeds and post, comment, give kudos, report, block, and delete your own content, subject to the same choices you made in the app. From the phone, an organizer can separately allow a browser to review reports and remove reported content. A browser cannot change your sharing choices, share workouts, join or leave groups, or manage devices.

For each signed-in browser, our Cloudflare service stores with your community account one-way hashes of the browser's current and recent session secrets, its browser and system family (such as "Chrome · macOS"), whether it is a shared computer, the access you approved, which of your devices approved it, when it was approved and signed in, when it was last active, and when it expires. It also keeps short-lived rate-limit counters and, if a browser is signed out because its sign-in was used from two places, a note of that event with the browser and system family and time so the app can show it. It does not store the browser's IP address or full user-agent text with your account. The browser keeps its session secret in a secure cookie that the page's scripts cannot read. The signed-in web page has no trackers, analytics, or third-party scripts; apart from its sign-in cookies, it saves only your km/mi choice in the browser.

To help you spot a request you did not start, the approval screen may show the approximate country that Cloudflare associates with the browser's network address, with a warning if it differs from your phone's. This location can be wrong, for example when a VPN is used. The browser's country is kept only with the pending request and deleted within about 15 minutes; it is never saved with your account or the browser's session, and your phone's country is compared but not stored. Starting a sign-in is rate-limited by IP address with the short-lived counters described under Security, attestation, and support records. If a code entered in the app is not valid, the service counts the failure under a keyed one-way hash of the network address it came from (an IPv4 address, or the first half of an IPv6 address) and keeps that count for up to 24 hours after the last failure, to limit code guessing.

A browser stays signed in for at most 30 days, or 14 days without use. If you choose not to stay signed in, for example on a shared computer, the limit is 12 hours, or one hour without use. Automatic page refreshes do not count as use. The app's Web sign-ins list shows each signed-in browser and when it was last active, and lets you sign out one browser or all of them; a browser can also sign itself out. Signing out the phone that approved a browser also signs that browser out, and signing out all other devices, recovering the account, or deleting it signs out every browser.

Approving a browser, or allowing a browser to moderate, first requires your phone's own biometric unlock (such as Face ID, Touch ID or a fingerprint) or its screen lock. That check happens on your device through iOS or Android. The app learns only whether it succeeded, and Cadence never receives your biometric data or passcode. A phone without a screen lock cannot approve web sign-ins.

An organizer can transfer ownership or delete the group. After leaving all groups and withdrawing outstanding requests, you can delete your community account in the app. This removes its active credentials and membership index without deleting your local workouts. Minimal identifiers, credential hashes for deletion retries, and operation-ordering records remain without an automatic expiry to prevent identity reuse and unsafe retries. Sign-out and uninstall alone do not delete server-held memberships or content. Keep the private recovery code safe: anyone with it can take over the account, and recovering the account signs out its previous devices. Never send that code in a community message or support email.

AI Coach — optional and adults only

Coach is optional and available only after you confirm that you are 18 or older and accept its versioned privacy disclosure. Everything else in Cadence works without Coach. If you do not send a Coach message, Cadence does not send Coach content.

When you send a message, Cadence may include:

• Recent exercises, sets, weights, reps, RPE, workout notes, and bodyweight
• Recent cardio workouts: activity, indoor or outdoor, day, duration, distance, and effort rating (cardio notes are not sent)
• Your training goal and optional Coach profile, including goals, limitations, experience, and facts you asked it to remember
• The Coach conversation needed to answer the current message

The request goes to a LightPath Cloudflare Worker and then to Google's paid Gemini API through Cloudflare AI Gateway. Each app request also carries a random installation ID and platform attestation to the LightPath Worker for abuse prevention. The Worker does not include that installation ID or the attestation material in the Gemini prompt.

Cloudflare is instructed not to collect the raw Coach request or response body. Cloudflare retains operational metadata such as provider, model, token counts, status, cost, and duration. Google may retain the prompt, contextual training data, and generated response for up to 55 days for abuse monitoring and required disclosures unless the project has approved zero-data retention. Google states that paid-service content is not used to improve its general AI products; policy-enforcement systems and authorized review of flagged content may still process it.

Deleting a local Coach chat removes the device copy. Cadence does not have an established way to delete Google's abuse-monitoring copy early or locate it using your Support ID; it expires under Google's retention policy.

Purchases and subscriptions

Cadence Pro is sold through Apple App Store or Google Play subscriptions. The store processes payment details; Cadence does not receive your card or bank information.

Cadence uses RevenueCat, Inc. as its subscription processor: RevenueCat handles purchases, restores, and renewals for Cadence Pro and records whether it is active. When the App shows Cadence Pro prices, buys or restores a subscription, or checks whether Cadence Pro is active, RevenueCat's software in the App sends RevenueCat a pseudonymous billing customer ID; the store's purchase records for Cadence Pro, such as the product, price and currency, transaction and receipt or purchase-token data, and purchase, renewal, and expiry dates; and basic technical information such as the app version, operating-system version, device model, preferred languages, store country, and, on iPhone, the identifier Apple assigns to your device for LightPath's apps (not an advertising identifier). Like any internet service, RevenueCat also receives your IP address. Apple and Google send RevenueCat subscription updates such as renewals, cancellations, and refunds. Cadence derives the billing customer ID from a key created on your device; it is not your name or email address. Cadence does not turn on RevenueCat's advertising-attribution or advertising-identifier collection, and it does not give RevenueCat your name, email address, workouts, health data, community content, or Coach conversations. RevenueCat processes this information under its privacy policy.

With each AI Coach request, the App sends that billing customer ID to LightPath's Cloudflare service as purchase proof. The service asks RevenueCat whether the customer has an active Cadence Pro subscription from Apple or Google before it allows the request. The App and RevenueCat's software keep the current subscription status on your device as needed to restore and authorize access. Our Cloudflare service does not log or retain the raw transaction ID or purchase token, and it never sends that proof to Gemini. The service may cache a one-way hash and active/expiry verdict for up to five minutes, never beyond the subscription's expiration. Subscription records held by Apple, Google, and RevenueCat remain subject to their policies. You can view, cancel, or manage the subscription through your store account.

Rest-timer Live Activity relay — iPhone only

When Live Activities are enabled, Cadence sends a push token, timer target, current exercise name, set number, and random installation ID to its Cloudflare relay so Apple can update the Lock Screen and Dynamic Island. Pending jobs are removed when delivered, canceled, or stale. Rate-limit counters expire within their hour or day window. Android rest-timer alarms are local and do not use this relay.

Apple Health and Health Connect

Health integrations are optional and controlled by system permission. With permission, Cadence can write completed workouts and manually logged body measurements. It can read supported body measurements when you request an import. On iPhone, the optional readiness display may read recent sleep and HRV signals; the Apple Watch companion can collect heart rate and active energy during an active workout. On Wear OS, heart rate is used locally on the watch for display and optional set-timing detection; the heart-rate values are not sent to a LightPath server.

Apple Health and Health Connect data is governed by the platform health store. Except for bodyweight or other context explicitly included in a Coach request after consent, Cadence does not send health-store data to a LightPath server.

User-owned export and sharing

Cadence can export or share JSON, Markdown, text, and an image card. The app creates these locally and hands them to the destination you select through the system file picker or share sheet. LightPath does not receive those exports. Once you choose a destination, that destination's privacy terms apply.

Legacy iCloud recovery — iPhone only

Cadence 1.1.x offered iCloud workout backup. Version 1.2 no longer creates, uploads, replaces, or deletes iCloud workout backups. While this temporary recovery path remains in the app, an affected user can deliberately open Settings → Data → Recover old iCloud backup to read an existing archive from that user's private Apple CloudKit database, restore it locally, and export JSON.

LightPath cannot browse that private archive. The existing record remains unchanged during the 1.2 recovery path while LightPath obtains and follows Apple's guidance for cleanup and removal of the temporary recovery bridge.

Historical hosted workout links

Builds before 1.2 could publish a chosen workout at an unlisted URL. Version 1.2 cannot create new hosted workout links. An existing link remains public to anyone who has it until it expires: after about 30 days without a view and no later than 90 days after creation. Local sharing does not create a hosted link.

Security, attestation, and support records

Coach, Live Activity relay, and community requests from the app use a random installation ID, IP rate limits, and platform integrity checks such as Apple App Attest or Google Play Integrity. Starting a web sign-in is rate-limited by IP address. Short-lived rate counters expire within 24 hours. App Attest public-key and counter records persist so later requests can be verified. A Coach request also includes the current Cadence Pro purchase proof, which the Worker verifies with RevenueCat and removes before calling Gemini. Attestation providers, app stores, and RevenueCat process their own technical and transaction records under their terms.

Settings → Contact can prefill a random Support ID. If you choose to email us, we receive your message and normal email headers. The Support ID can help correlate LightPath-controlled support and installation-ID rate-limit records. It is not forwarded to Gemini and cannot locate Google's abuse-monitoring copy or a separate App Attest key record.

What Cadence does not use

• No advertising networks or advertising identifiers
• No behavioral analytics or cross-app tracking
• No account required for workout logging; no contact upload, location, camera, or microphone access
• No sale of workout, health, Coach, or support data

Retention and deletion

• Local app data remains until you delete it or uninstall the app.
• Where zero-data retention is not approved, Google's Coach abuse-monitoring copy expires within 55 days.
• Cloudflare stores Coach operational metadata rather than raw Coach text; its exact operational retention is controlled in the LightPath gateway account.
• Relay jobs and rate counters expire automatically as described above.
• Raw purchase proof is used for store verification and not retained by the Worker; a hashed verdict lasts at most five minutes and never beyond subscription expiry.
• RevenueCat keeps Cadence Pro subscription records under its own privacy policy.
• Historical hosted links expire within 90 days.
• The legacy private iCloud record remains unchanged by Cadence 1.2's read-only recovery.

See the Cadence data-deletion page for platform-specific steps and the limits of a support request.

Age and medical disclaimer

Cadence Lift is intended for people 13 and older, or the minimum age of digital consent where they live if that is higher. The AI Coach is only for adults 18 and older and asks you to confirm your age before you first use it. Cadence is a fitness log, not a medical device, and Coach output is not medical advice, diagnosis, or treatment. Consult a qualified healthcare professional for medical questions.

International processing

Cloudflare, Google, Apple, RevenueCat, and email providers may process optional request data outside your country. Their terms and regional safeguards apply to their processing. LightPath uses these services only for the app functions described above.

Changes and contact

Material changes will appear here with a new revision date. Because Cadence does not collect an email address for community accounts or maintain a mailing list, we cannot notify every user directly.

• Email: [email protected]
• Website: https://lightpathapps.com