Privacy Policy

Effective 8 October 2026

Washington, Nevada and Connecticut residents: our Consumer Health Data Privacy Policy explains how we handle health data under your state’s law.

Who is responsible

Lensatic is built and operated by Deadlift Digital LLC, a Missouri limited liability company. “We” and “us” in this policy mean that company, which decides how the data described here is used and is responsible for it. This policy covers the Lensatic app on iPhone, Apple Watch and Android, and the website at lensatic.fit. Lensatic is an independent product and is not affiliated with, endorsed by, or connected to the U.S. Department of Defense or any military service.

Questions about this policy or your data: [email protected], or by post:

Deadlift Digital LLC
117 S Lexington St, Ste 100
Harrisonville, MO 64701-2443
United States

Our Terms of Service govern your use of Lensatic. This policy is a separate notice about your data.

What stays on your device

By default, everything. The app keeps your training in a private database on your phone, inside the app’s own storage, where other apps cannot read it. That includes:

• Recorded activities — GPS route points, distance, pace, splits, elevation, duration, and calorie estimates for runs, rucks, swims and land-nav sessions, including sessions recorded on Apple Watch
• Heart-rate samples, from a Bluetooth chest strap, your watch, Apple Health or Health Connect
• Strength and conditioning workouts — sets, reps, loads and any notes you add — and the workouts and exercises you create
• Fitness-test results and assessment baselines, and your age, sex, height, weight, goal weight and maximum heart rate if you enter them
• Your selected pipeline, service branch, selection date, plan progress, lesson and course progress, targets, achievements, pace counts and land-nav marks
• Daily check-ins — sleep, soreness, energy, motivation, resting heart rate, and any notes you add
• Sleep recorded by a tracker, if you connect Apple Health or Health Connect — how long you slept and when, kept separately from what you report yourself in a check-in
• Body weight and body-fat readings over time — the ones you enter, and any a scale writes to Apple Health or Health Connect
• Wear & Tear — for any ache or injury you choose to record, the body area, side, severity over time, your answers about it (such as night pain or numbness), any gear you tie it to, and your notes
• Nutrition — daily totals of calories and protein, carbohydrate and fat, and daily caffeine and water, worked out from what Apple Health or Health Connect holds, if you connect them
• Your food log — the foods, meals and recipes you log in the app, with amounts, calories and macros, fiber, sugar, sodium and caffeine where a food’s source lists them, the water you log, the time you say you ate something if you set one, and the foods the app has looked up or bundled with it
• Motion recordings of your sets, which the rep counter uses on your phone
• App settings, units, and map areas you download

Check-ins, aches, tracker sleep, weigh-in history, nutrition, your food log and motion recordings are never backed up to our servers, even when you are signed in, and are never part of a leaderboard. Two optional features can send part of them, each only with your separate agreement: the AI coach and set sharing, both described below. On iPhone, the app’s database and settings, including everything it reads from Apple Health, are excluded from iCloud and computer backups, so health-derived data never goes to iCloud. Your training comes back on a new or restored iPhone only if you sign in, which turns on our cloud backup. On Android, Google’s device backup may include the app’s data, as it does for most apps; that copy is held by your Google account, not by us.

Settings (the gear on Profile) → Danger Zone → Delete all data erases your training records from the phone — activities, workouts, plans, fitness-test results and baselines, achievements, check-ins, aches, sleep, nutrition, your food log, water, saved meals and recipes, and weigh-ins. Your settings (including your age, sex, height and weight), motion recordings, downloaded map areas and set-sharing receipts stay until you uninstall the app, which removes everything the app stored on the phone. If you have never signed in, we hold no copy of your training.

Food log and barcode scanning

Lensatic has its own food log. What you log — foods, amounts, meals, recipes, water, and the calories, macros, fiber, sugar, sodium and caffeine worked out from them — is saved on your phone and is never backed up to our servers, never sent to the AI coach, and never part of a leaderboard. The day’s total is written into the same daily nutrition record described above so your targets can use it. If you also connect Apple Health or Health Connect, a day you logged in Lensatic is not imported over again.

Camera. Scanning a barcode uses your camera to read the code on a package. Nothing is photographed, recorded or kept. On Android the scan runs in Google’s code scanner, which is part of Google Play services and reads the code on your phone; on iPhone it uses Apple’s built-in scanner. The camera permission is asked for only when you tap Scan, and everything else in the food log works without it.

Barcode lookups. To find a product, the app sends the barcode number — and nothing else you have logged — to food databases, one after another until one recognises it: Open Food Facts, the U.S. Department of Agriculture’s FoodData Central, and FatSecret. Like any web request, each learns your IP address and the barcode number. FatSecret is reached through a small relay we run, so that our FatSecret credentials are never inside the app; it keeps recent answers in memory for up to a day to serve repeat scans faster and does not store who asked, and its host’s connection logs may record your IP address for a short period. No account, name, device identifier or training data is sent to any of them. A product found once is saved on your phone, so scanning it again sends nothing.

Searching by name. Typing in the food search looks only at foods already on your phone and sends nothing. If you tap Search online (or press Enter), the app sends the words you typed — and nothing else — to USDA FoodData Central and, through our relay, to FatSecret, and shows what they return. The words you type could in principle reveal what you eat, so they are sent only when you ask, never as you type. A result you pick is saved on your phone. Building recipes and saved meals sends nothing.

Scanning a recipe or a nutrition label. If you tap Scan or upload a recipe, or Scan the label when adding a food, and take a photo or choose a picture from your library, the text in it is read on your phone — by Apple’s built-in text recognition on iPhone and by Google’s ML Kit on Android. The picture is not uploaded to us or to anyone else, and nothing is sent anywhere to read it. After the text of a recipe is read, each ingredient is matched to the foods already on your phone; for an ingredient with no match there, the ingredient’s name only (for example “tahini”, never the picture or the rest of the recipe) is sent to USDA FoodData Central and to FatSecret, through our relay, to look for a suggestion. You choose whether to use it, and nothing is saved until you do. This happens for at most a dozen ingredients per recipe and is skipped with no signal. On Android, Google Play services downloads the text-recognition model to your phone once; that download is between your phone and Google and contains nothing from the app. The app can use only the one picture you take or pick. You see every line and can change it before anything is saved, and the recipe you save stays on your phone like the rest of the food log. The camera and photo permissions are asked for only when you tap to take or choose a picture.

Location

The app uses your phone’s precise location while you record a session, to measure a run, ruck, or land-nav leg — route, distance, pace, splits and elevation. It also uses it in the foreground when you ask a tool to start from where you are: Real Ground’s “Around you”, centering the print map, and measuring a pace count. An approximate location cannot produce these numbers.

Background location. If you allow it, the app keeps recording while your screen is off or another app is in front, which is what makes a two-hour ruck possible. Android shows a notification the entire time a recording is running, and iOS shows its location indicator. Background location is used only while a session is recording — never at other times, and never to build a profile of where you go.

Location is saved only with the activities you record. It leaves your phone when an activity is backed up to your account while you are signed in, and indirectly when a map loads tiles for the area on screen (see “Maps and address search” below). It is never sent to the AI coach, never included in shared sets, and never shown on a leaderboard.

Health and fitness data

With your permission, Lensatic connects to Apple Health on iPhone or Health Connect on Android, so data your other devices and apps already record does not have to be entered twice. It is entirely optional, and the app works without it.

What it reads, and why:

• Heart rate — so a session has heart-rate data even without a chest strap
• Workouts and distance — so a run or swim recorded on a Garmin, Samsung or Apple Watch appears in your log without being re-entered
• Sleep — so a night can be shown against the session that followed it
• Body weight — because weight feeds the calorie model for rucking, where a stale figure quietly skews every estimate
• Biological sex (Apple Health only) — to select the correct fitness-test scoring scale
• Nutrition — if you log food in an app that writes to Apple Health or Health Connect, the calorie and macro entries it saved, so your eating can be shown against your training. The app adds them up by day and keeps only the daily totals — not the individual meals or food names, which stay in the app that logged them
• Water and caffeine — the same apps also write how much water and caffeine you had. The app keeps one daily total of each, on your phone, and never reads back anything Lensatic itself wrote. A day you logged water in Lensatic is not read from Health again

It writes back your completed workouts — runs, rucks and other sessions, with distance, calories, heart rate and route — so other fitness apps can see them.

Data obtained through Apple Health or Health Connect is used only to provide features you can see in the app: showing you your own training; backing it up to your account if you sign in (workouts read from Health with their heart rate, and your body weight and biological sex); and, if you subscribe to the AI coach and agree to it, writing the coach’s notes. It is never used for advertising or marketing, never sold or transferred to data brokers, information resellers or advertising platforms, never used to make decisions about credit or insurance, and never used to train machine-learning or AI models — ours or anyone else’s. No one at Deadlift Digital looks at it except with your permission, for security reasons, or where the law requires. Lensatic’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. You can revoke access at any time — Apple Health in iOS Settings → Privacy & Security → Health, or Health Connect in Android settings.

Bluetooth. Heart-rate strap support uses Bluetooth to connect to the sensor you choose. The app does not use Bluetooth to work out your location, and does not scan for or record nearby devices for any other purpose.

Motion sensors and set sharing

During a set, the rep counter reads your phone’s accelerometer and gyroscope and counts reps on the phone. Those recordings stay on your phone unless you turn on set sharing.

Set sharing is optional and off until you switch it on at Settings (the gear on Profile) → Share your sets. It is available only in the United States and its territories: our server checks which country your connection comes from and refuses uploads from anywhere else. When it is on, each set you finish sends:

• which exercise it was, where the phone was (pocket, armband, wrist or watch), and how long the set took
• the accelerometer and gyroscope trace of the set
• what the app counted, and what you corrected it to
• your phone’s model

Each set is filed under the day it arrives and its own random number. It carries no location, name, email address, account or device identifier, and nothing that links it to your other sets. So that no one phone can flood the server, the app also sends a random number created for your install; it is used only to limit how fast uploads arrive, and it is not stored with the sets.

Like any upload, each one passes through Cloudflare. Its logs record when the upload arrived, the install number, and connection details such as an approximate location worked out from your IP address; those logs are deleted within 7 days and are never copied into the stored sets. Shared sets are held briefly on Cloudflare, then copied to a computer we control and erased from Cloudflare.

Shared sets are used to build and test Lensatic’s rep counter, and for nothing else, and we keep them for as long as they are useful for that. Motion data can, in principle, be matched to the person who made it; we keep shared sets in a form that is not linked to you, and we will not try to find out who recorded them. They are never sold or shared.

You can stop sharing at any time, and delete everything you have shared, from the same screen. The app keeps a receipt for each shared set on your phone for exactly this purpose. Because nothing on our side says which sets are yours, those receipts are the only way to find them: once you uninstall the app, shared sets can no longer be traced to you or removed individually.

Account and cloud backup

An account is optional. When you create one or sign in, cloud backup is on for as long as you stay signed in — there is no separate switch. Signing out from the profile screen stops it and leaves your data on the phone.

While you are signed in, the following is stored in your account by Supabase, on servers in the United States:

• Your email address, and, if you use a password, the password stored only as a one-way cryptographic hash
• If you sign in with Apple: the account ID Apple assigns you for Lensatic, and your email address or the private relay address Apple gives you in its place. Apple also offers your name the first time you sign in; the app discards it without storing or sending it
• If you sign in with Google: your Google account ID, name, email address and profile picture link, which Google includes when it confirms who you are
• Your username, if you choose one, and your device’s time zone
• Activities, with their GPS routes, pace, elevation, calories and heart rate — including workouts read from Apple Health or Health Connect
• Strength workouts and any notes on them, the workouts and exercises you create, plan progress and adjustments, active plans, assessment results, pace counts, land-nav field tasks and achievements
• Event badges and awards you hold (see “Events and badges” below)
• Your selected pipeline, service branch, selection date and settings, including your age, sex, height, weight, goal weight and maximum-heart-rate setting

Supabase also logs the IP address and device type of each sign-in, for security. Check-ins, aches, tracker sleep, weigh-in history, nutrition and motion recordings are not backed up.

Each account can read and write only its own records; the database itself enforces this, not just the app. The exceptions are the opt-in leaderboard and events and badges, both described below. The purpose is backup, and moving your history to a new phone. Supabase also sends account emails, such as an address confirmation or a password reset.

Leaderboards

Leaderboards are off by default. You are not on them, and nothing about you is visible to any other user, until you turn on the switch at Settings (the gear on Profile) → Leaderboards or at lensatic.fit/leaderboards. They require an account and a username, because a leaderboard identifies people by handle.

When you turn them on, other signed-in users can see:

• Your username — the handle you chose, not your email address, which is never shown to anyone
• Your total miles this week, and your miles under a pack this week
• Your current streak of consecutive days trained
• While an event is on, and for a week after it, your miles that count toward it (for Ruck Week: rucks at 35 lb or more, Nov 5–11)
• Your position in each of those rankings

That is everything a leaderboard shows. Event awards are separate and are described under “Events and badges” below. Routes, maps, individual sessions, pace, heart rate, body weight, pack weight, fitness-test results, check-ins, and aches are never visible to another user, and there is no way to reach any of them from a leaderboard. There is no feed, no followers, no profile page, and no messaging. Your streak does show that you trained on each of those days, and because the boards are live, someone who checks repeatedly can see when your totals change, and by how much.

The rankings are calculated on the server from activities you have already backed up, and the server sends back only a list of usernames and numbers. Sessions you typed in by hand are excluded, so a ranking reflects sessions the app recorded or read from a watch.

Your time zone — for example America/New_York — is stored with your account when you sign in, and is used for one thing: deciding when your week and your day begin, so a Sunday evening session is counted in the right week and an event day counts by your own calendar. Because it shows roughly which region you are in, it is never shown to anyone, and it stays with your account until you delete it.

Turning the switch off removes you immediately. Nothing is cached, so you disappear from every board as soon as it is next drawn, and your username stops being visible to other users. Deleting your account removes you as well.

The AI coach

The AI coach is an optional paid subscription. If you do not subscribe and turn it on, nothing in this section applies to you. The app asks for your permission before it sends anything the first time, and you can turn the coach off at any time.

Each time it writes a note — two short paragraphs — after a session, course or test you have just finished, or when you ask — the app sends our server findings it has already calculated on your phone for that session, month, PT test, land-nav course or plan change. For example: your pace for each half; your heart rate and time in each heart-rate zone; last night’s sleep and the past week’s sleep against your usual; an ache’s body part, side and severity, how long it has been logged, and your answers about it (such as whether it wakes you at night, causes numbness, or stops you putting weight on it); your test event scores; or the distance planned for a week. With them goes a short background, so the write-up can put that session in context: the course you picked in the app, the number of days until your selection or ship date if you set one, the plan you are on and which week, how many sessions and miles you logged in the last 28 days and in each of those four weeks, your rucks in that time (how many, the longest, the heaviest load) and your average sleep over your last few recorded nights. These are totals the app works out; they are not a log of your sessions. It never sends your route, GPS points or grid references, or anything you type yourself, such as notes.

The request also carries your sign-in token, so our server can check your account. Our server does not keep it, and Anthropic never receives your name, email address or account.

Our server runs on Cloudflare. It checks with Supabase that you are signed in and with RevenueCat that you are subscribed, passes the findings to Anthropic, whose Claude model writes the note, and checks the note before sending it back. The note is saved on your phone with the session it describes.

• Our server keeps no copy of the findings or the note. To enforce the daily limit, it keeps a count of how many notes you received each day, filed under a code made from your account ID with a secret key rather than under the ID itself.
• Cloudflare keeps short operational logs for up to 7 days: whether a request succeeded, and details of the connection, such as an approximate location worked out from your IP address. They contain no findings.
• Anthropic processes each request for us under its commercial terms and data processing addendum. It does not train its models on it, and it deletes it within 30 days — unless the request is flagged in a safety review, in which case Anthropic may keep it longer to enforce its usage policy.

Some findings come from Apple Health or Health Connect, such as sleep and heart rate. They are sent only to write the note you asked for, and never for any other purpose.

Events and badges

Lensatic runs occasional events, such as Veterans Day Ruck Week, each with a badge for meeting its rule and sometimes a winner’s badge for the most qualifying miles. If you are signed in, so that cloud backup is on, the server checks your backed-up recorded sessions against each event’s rule (for Ruck Week: which sessions are rucks, how far they went, the pack weight and the day they started, by your own time zone) to award an event badge, and checks every backed-up ruck in the event’s days to pick the winners. This happens whether or not you have joined leaderboards. Sessions you typed in by hand never count, and neither do sessions too long or too fast to be real. To count your days by your own calendar, the app stores your time zone (for example America/Chicago) with your account, whether or not you have a username.

An award is stored with your account: which event, when, how it was earned, and, for a winner, a note such as “Most miles: 14.2 mi”. Other users never see your awards. We (Lensatic’s admin) can see the username and qualifying miles of each person who holds an award or is in line to win one, so that winners can be checked before they are announced and awards corrected, and can hand out or take back an award by username. An award that is taken back is recorded, so it is not given again automatically, and it is removed from your phone. We never see your email address this way. Awards are deleted with your account.

Gifts and invites

Gifts are not sold in the app. When a gift is bought directly from us, the payment is processed by Stripe, through RevenueCat, like any other direct purchase, with the email address given at checkout. The purchase is held under the gift code rather than under an account. When somebody redeems the code, our server checks it with RevenueCat and adds the gift to their account. Our server, on Cloudflare (in a Cloudflare D1 database), stores the code only as a one-way hash, so it cannot be used twice, together with when it was redeemed and what it unlocks, and records the account that redeemed it, so that a gift that is refunded can be taken back. It keeps no record of who bought it. To stop codes being guessed, it also counts wrong codes entered each day, under a code made from your account ID with a secret key.

Invite codes give 15% off. Our server, in the same D1 database, stores your invite code, who redeemed it and whether they have made a qualifying purchase, so that each of you gets your discount. How many discounts you have used is read from RevenueCat when you look, not stored. Both of you are filed under codes made from your account IDs with a secret key, never under the IDs themselves, and never with a name or email address. To check whether a friend has bought something, our server asks RevenueCat while that friend is signed in, and again if RevenueCat tells it that one of that friend's purchases was refunded or ended.

Purchases

Some features may be sold as one-time purchases or as a subscription. In the app, purchases are made through the App Store or Google Play, which take the payment and hold your payment details for what they sell. Where you buy from us directly rather than through an app store, payment is taken by Stripe, through RevenueCat, and the card details go to Stripe, never to us. We never see them.

In versions of the app that sell anything, and for purchases made directly from us, we use RevenueCat to keep track of what you have bought. The app connects to it when it starts. A purchase made directly from us is recorded against your Lensatic account ID, along with the email address you enter at checkout and the purchase itself, and RevenueCat and Stripe handle the payment record. RevenueCat receives a random ID it creates for your install (and your Lensatic account ID if you are signed in, so purchases follow you to a new phone), the store’s record of your purchases, your device type and operating-system version, and your IP address, which it uses to work out your country and then discards. On iPhone it also records whether the app has asked permission to track you; Lensatic never asks, because it never tracks you.

Crash reports

If the app crashes or hits an error, it sends a report to Sentry so we can find and fix the problem. A report contains the error, the app version, technical details of your device such as its model, operating-system version and language, and a short trail of what the app was doing just before — such as which screen was open and whether network requests succeeded. The app also tells Sentry when a session starts and ends, under a random identifier, so we can see how often the app crashes. Reports don’t include your IP address, name or email address, are set up to leave out your training, location and health data, and are deleted by Sentry within 90 days.

Maps and address search

The Topo and Imagery maps load tiles from the U.S. Geological Survey’s The National Map, and the Street map and map labels come from OpenFreeMap. Loading tiles reveals your IP address and the map area on screen to those providers, as any map or web request would. No account, identifier or training data is sent. Address search in Topo Maps sends what you type to your phone’s built-in geocoding service — Apple’s on iPhone, Google’s on Android.

Other services

• Signing in with Apple or Google. Both are optional — an email and password works just as well. What we receive is listed under “Account and cloud backup” above, and we never receive your Apple or Google password. Google’s sign-in software also collects data for Google’s own purposes: Google’s published declaration lists your name, email address, phone number, approximate location, device identifier and app usage, some of it for analytics. That goes to Google, not to us, and the app tells you before the Google sheet opens. Apple publishes no comparable declaration for Sign in with Apple.
• Supabase hosts accounts and cloud backup.
• Cloudflare serves this website, runs our servers for the AI coach, gifts, invites and set sharing, and hosts the exercise animations at art.lensatic.fit (Cloudflare R2). The app downloads the animation clips and a list of them from there; like any web request, that reveals your IP address, which appears in Cloudflare’s standard request logs. Nothing about you or your training is sent.
• Anthropic writes the AI coach’s notes, only if you subscribe.
• RevenueCat keeps track of purchases, in versions of the app that sell anything and for purchases made directly from us.
• Stripe processes card payments for purchases made directly from us, through RevenueCat. Apple and Google process the payments they sell.
• Sentry receives crash reports.

Supabase, Cloudflare, Anthropic, RevenueCat and Sentry act as our service providers. We use providers whose terms require them to use the data they handle for us only to provide their service, and to protect it at least as well as this policy does. The map providers, and Apple and Google for sign-in and address search, handle what they receive under their own privacy policies.

What we don’t do

• We don’t sell personal data, and we don’t share it for targeted advertising — so there is nothing to opt out of.
• There are no ads and no advertising SDKs, and we run no analytics of our own. If you choose Google sign-in, Google’s software collects some data for Google’s analytics, as described above.
• We don’t use or sell personal data to train large language models, and Anthropic does not train on what the coach sends.
• We don’t make decisions about you that have legal or similarly significant effects by automated means. The app’s plan adjustments are suggestions about your training.
• We don’t use geofences around places where people receive health care.

This website

lensatic.fit is served by Cloudflare, which processes your IP address and the details of each request to deliver the site and protect it from abuse. The site itself sets no cookies and runs no analytics or advertising. The features page loads two photos from picsum.photos, which receives your IP address when it serves them. The leaderboards, password-reset and email-confirmation pages load Supabase’s sign-in code from the jsDelivr network and talk directly to Supabase. If you sign in on the website, your session is kept in your browser’s local storage until you sign out. The web app also keeps its database, the same kind of data the phone keeps, in your browser’s private storage on that device. A direct purchase loads RevenueCat’s checkout, which uses Stripe, when you choose to buy.

Sharing a workout

When you share an activity, the app builds an image on your device and hands it to your phone’s share sheet. You choose where it goes. Nothing is published anywhere by default, and the app has no feed, no followers, and no public profile pages. A shared image can show your route, so think about where it goes — especially a route that starts at your home or on an installation.

When we may disclose data

We disclose personal data only as this policy describes, or: when the law requires it, such as in response to a valid subpoena or court order; when we believe in good faith it is needed to protect someone’s safety, or to investigate fraud, security problems or abuse of the service; or as part of a merger, sale or transfer of the business, in which case this policy continues to apply to data collected under it.

How long we keep data

• On your phone: until you delete it or uninstall the app. Delete all data erases your training records, including fitness-test results, but leaves settings, motion recordings, downloaded maps and set-sharing receipts, as described above.
• Cloud backup, time zone and event awards: while your account exists. Deleting an activity, workout or pace count while you are online deletes it from the server; workouts and exercises you created, and field-task ticks, stay in your backup marked as deleted until you delete your account. Copies in Supabase’s routine backups are gone within 30 days, and sign-in logs are kept for no more than 30 days.
• Shared sets: for as long as they are useful for building and testing the rep counter, or until you delete them from the app. Cloudflare’s upload logs: up to 7 days.
• AI coach: daily counts on our server, which hold only a date and a number; up to 7 days in Cloudflare’s logs; up to 30 days at Anthropic, unless flagged in a safety review.
• Purchases: RevenueCat keeps purchase records while they are needed to provide what you bought, or until you ask us to delete them. Stripe keeps card payment records for purchases made directly from us; Apple and Google keep their own records.
• Gifts: for each redeemed gift code, its hash, when it was redeemed, what it unlocks and the account that redeemed it, kept in our Cloudflare D1 database for as long as we run gifts, so the code can never be used again and a refunded gift can be taken back. A gift that has not been redeemed exists only as a purchase record at RevenueCat and Stripe. Daily counts of wrong codes entered, under coded account IDs.
• Invites: your invite code, who redeemed it and whether they made a qualifying purchase, kept in the same D1 database for as long as the invite program runs. They are not removed when you delete your account, but they are filed under coded account IDs, so once the account is gone they can no longer be linked to you.
• Crash reports: up to 90 days.
• Emails to us: as long as needed to answer them, and to keep a record of requests we have handled.

Deleting your account. Use Settings (the gear on Profile) → Danger Zone → Delete account in the app, which erases the account and everything backed up to it, and your training records on the phone, immediately. You can also email [email protected], and it will be done within 30 days. Deleting your account does not cancel a subscription — cancel that in your App Store or Google Play settings — and if you want RevenueCat’s purchase records deleted too, say so in your email. If you signed in with Apple, you can also remove Lensatic under Sign in with Apple in your iPhone’s Apple account settings. See Delete Your Account for the detail.

Security

Traffic between the app and our servers is encrypted in transit with TLS, and each account can reach only its own records. On-device data sits in the app’s private storage, protected by the operating system’s app sandbox — Android’s or iOS’s — and your device lock. Access to our systems is limited to the people who need it to run the service. No system is perfect, and this is a small independent product — treat cloud backup as a convenience, not as an archive of record. If a breach affects your data, we will tell you, and the authorities, as the law requires.

Children and teens

Lensatic is not for children under 13, and we do not knowingly collect personal data from them. If we learn that we have, we will delete it. If you are 13 to 17, use Lensatic only with the knowledge and consent of a parent or guardian, who should review this policy and the Terms of Service with you.

Your choices and rights

Most of what Lensatic holds about you is on your phone, where you can see, change or delete it yourself. For anything we hold — your account, your cloud backup, purchase records — you can ask us to:

• confirm whether we hold personal data about you, and give you a copy in a portable format;
• correct it, or delete it;
• tell you which service providers have received it; and
• stop a use you agreed to, such as the AI coach or set sharing — which you can also turn off yourself in the app.

Write to [email protected] from the email address on your account, so we can confirm the request is yours. If you signed in with Apple and hid your email address, write from any address and include your username, and we will confirm it another way. We answer within 45 days; if we need more time, we will tell you why, and take no more than 45 days more. Requests are free. If we turn a request down, you can appeal by replying with “Appeal” in the subject line. We will answer the appeal within 45 days, and if we still say no, we will tell you how to contact your state attorney general. We will not treat you differently for using any of these rights.

Some states give their residents specific rights over personal or health data, among them Washington, Nevada, Connecticut and California. The rights above are available to everyone, wherever you live. Washington, Nevada and Connecticut residents should also read our Consumer Health Data Privacy Policy.

Using Lensatic outside the United States

Lensatic is built for U.S. service members, and for people preparing to join them, wherever they are stationed. We are based in the United States. Whatever country you use the app from, the data described in this policy is stored and processed mainly in the United States — Cloudflare, which carries our website and servers, may handle a request at a data center near you — and data protection law there may differ from the law where you are. We protect it as this policy describes wherever it is processed.

If you are in the European Economic Area, the United Kingdom or Switzerland, Deadlift Digital LLC is the controller of your personal data, and we rely on these legal bases:

• Your account, cloud backup, leaderboards and purchases: providing the service you asked for.
• Health data you back up or send to the AI coach: your explicit consent, given when you sign in with the backup notice in front of you or when you agree to the coach. You can withdraw it at any time by signing out or turning the coach off.
• Crash reports, security, and answering your requests: our legitimate interest in keeping the app working and safe, and our legal obligations.

As well as the rights above, you can ask us to restrict how we use your data, object to a use based on our legitimate interests, and complain to the data protection authority where you live or work. You never have to provide personal data to use the app itself; an account and the optional features need the data described for each.

Changes

If this policy changes, the effective date above changes with it. If a change is material, we will tell you in the app or by email before it takes effect, and we will ask for your agreement before using data we already hold in a new way.