Privacy Policy

Privacy Policy

Effective Date: August 19, 2026 Last Updated: August 19, 2026

Scope

This Privacy Policy explains how Iron Ladder collects, uses, stores, transmits, shares, and protects information when you use the Iron Ladder iPhone application, Apple Watch application, widgets, website, profiles, social features, leaderboards, classes, subscriptions, artificial-intelligence features, and related services collectively referred to as the “Service.”

Who Operates Iron Ladder

Iron Ladder is operated by Iron Ladder LLC, a New York limited liability company.

For purposes of applicable privacy law, Iron Ladder LLC is the controller, business, or other party responsible for Iron Ladder’s processing of personal information where those terms apply.

Iron Ladder LLC Email: support@ironladderapp.com

Information We Collect

Depending on the features you use, Iron Ladder collects the information described below.

Account Information

Account information can include:

* Email address. * Username. * Display name. * Profile photograph. * Biography and profile information. * Referral information. * Verification information. * Account preferences. * Notification preferences. * Subscription status. * Password-reset information.

Passwords are not stored in plaintext.

Passwords stored by Iron Ladder are stored as bcrypt password hashes.

Fitness, Health, And Wellness Information

You can choose to provide fitness, health, and wellness information including:

* Workouts. * Exercises. * Sets. * Repetitions. * Weight lifted. * Training volume. * Workout duration. * Personal records. * Bodyweight. * Starting weight. * Goal weight. * Height. * Fitness goals. * Experience level. * Focus muscles. * Weekly workout targets. * Progress information. * Body-composition information. * Progress photographs. * Nutrition information. * Meals. * Calories. * Macronutrients. * Water tracking. * Fasting information. * Creatine or supplement tracking. * Dietary preferences and restrictions. * Recovery information. * Cycle day and cycle phase if you choose to use Cycle-Aware Training. * Class participation. * Other fitness information you choose to enter. * Precise GPS route information when, and only when, you start an Outdoor Run or Outdoor Bike Ride session.

For an Outdoor Run or Outdoor Bike Ride session that you start, Iron Ladder records GPS fixes during that session.

Each fix contains:

* Latitude. * Longitude. * Altitude. * Speed. * Horizontal accuracy. * Timestamp.

Iron Ladder derives the following workout information from those fixes:

* Distance. * Duration. * Average pace. * Elevation gain.

Some of this information can be considered health information, consumer health data, sensitive data, or special-category data under applicable law.

Social And Community Information

When you use Iron Ladder’s social features, we process:

* Posts. * Photographs. * Videos. * Captions. * Comments. * Likes and reactions. * Follows and followers. * Leaderboard participation. * Rankings. * Class participation. * Reports. * Blocks. * Moderation information.

Information you choose to make public can be seen by other users according to applicable privacy settings.

Photos And Videos

Photos and videos you upload can be stored so Iron Ladder can provide:

* Social posts. * Profile photographs. * Verification. * Progress-photo features. * Body-analysis references. * Form Check. * AI Food Scanner. * Other media-based features you choose to use.

Body and progress photos are encrypted on your device before upload and stored as encrypted blobs in private storage.

The decryption key is held in your device keychain and can sync through your iCloud Keychain so your other authorized devices can access the encrypted content.

When you choose a starting body photo from your photo library, Iron Ladder reads the date the photo was taken from the Photos library record or, when needed, the photo’s EXIF data.

Iron Ladder uses that date only to prefill the “photo date” field.

You can change or undo the prefilled photo date.

Iron Ladder does not read other photo metadata for this feature.

Iron Ladder does not use location information embedded in a photo.

A photo or video is sent to Anthropic only when the applicable AI-processing or moderation activity described in this Policy occurs.

Contacts

Iron Ladder reads your contacts only when you tap “Find contacts on Iron Ladder” and grant the required contact permission.

For that lookup, phone numbers from your contacts are sent to Iron Ladder’s server so the server can look for existing Iron Ladder accounts.

Those phone numbers are used only for that lookup.

Contact phone numbers from your address book are not written to Iron Ladder’s database or otherwise stored as part of the lookup.

Iron Ladder does not continuously read or upload your contacts.

You can revoke contact access through the permissions for Iron Ladder in iOS Settings.

Location

Iron Ladder uses precise location only for Outdoor Run and Outdoor Bike Ride sessions that you start.

Iron Ladder does not continuously collect your location outside an active Outdoor Run or Outdoor Bike Ride session.

When you start one of those sessions, Iron Ladder records precise GPS location for the duration of that session.

Each recorded location fix contains:

* Latitude. * Longitude. * Altitude. * Speed. * Horizontal accuracy. * Timestamp.

Iron Ladder uses those fixes to record your route and calculate:

* Distance. * Duration. * Average pace. * Elevation gain.

The GPS fixes are uploaded to Iron Ladder’s servers and stored as part of the specific workout that created them.

Your route is shown back to you as a map in your own workout history.

You can also choose to turn the route into a shareable sticker image.

A normal social-feed post for a run or ride shares workout information such as:

* Distance. * Duration. * Pace.

A normal social-feed post does not publish your GPS coordinates or route map.

If you separately create and share a route sticker image, that image can display the route because you chose to create and share it.

Background Location During A Workout

Location recording continues while the phone screen is off or Iron Ladder is in the background, so an active run or ride continues tracking while your phone is in your pocket.

Background location collection occurs only during an Outdoor Run or Outdoor Bike Ride session that you started.

Recording stops when you finish the session.

iOS displays its blue location indicator while the location session is active in the background.

Iron Ladder requests location permission while using the app.

Iron Ladder does not request Always location permission.

Iron Ladder uses the iOS location background mode only for the duration of an Outdoor Run or Outdoor Bike Ride session that you started.

Apple Watch Location Recording

The Iron Ladder Apple Watch application can record an Outdoor Run or Outdoor Bike Ride without an iPhone being present.

When a workout is recorded on Apple Watch, the workout result can later sync to your paired iPhone through Apple’s WatchConnectivity system.

That Watch-to-iPhone transfer occurs directly between your own paired Apple devices and is protected by Apple’s operating-system security.

The WatchConnectivity transfer is not routed through Iron Ladder’s server.

After the workout reaches the iPhone, the workout and its GPS fixes are stored with your Iron Ladder workout record in the same way as other Iron Ladder workouts.

Location Retention And Deletion

Precise GPS fixes remain attached to the workout that created them.

When you delete that workout, its GPS fixes are automatically deleted through the database relationship between the route and the workout.

When you delete your Iron Ladder account, workouts associated with your account are deleted, and their GPS fixes are automatically deleted through the same database cascade.

Iron Ladder does not retain a separate copy of those deleted GPS fixes.

No separate route-cleanup process is required.

Precise location is not sent to Anthropic.

Precise location is not sold.

Precise location is not shared for advertising or marketing.

Precise location is not shared with data brokers.

Turning Location Off

You can deny or turn off location access for Iron Ladder through:

iOS Settings > Privacy & Security > Location Services

You can continue using the rest of Iron Ladder without precise location access.

Outdoor Run and Outdoor Bike Ride route tracking will not work without the location access needed to record the session.

Technical And Device Information

Iron Ladder processes technical information reasonably necessary to operate and secure the Service, including:

* Device type. * Operating-system version. * App version. * Device or push-notification token. * Login activity. * Network information. * IP address. * Error information. * Security information. * Feature usage necessary to operate and troubleshoot the Service.

Iron Ladder does not use:

* Advertising SDKs. * Advertising identifiers for advertising. * Cross-app tracking.

Iron Ladder collects precise location only while an Outdoor Run or Outdoor Bike Ride session that you started is active. Iron Ladder does not collect your advertising identifier, does not run advertising, and does not perform cross-app tracking.

Subscription Information

Apple processes purchases made through the App Store.

Iron Ladder can receive information necessary to verify and provide a subscription, including:

* Subscription product. * Subscription status. * Purchase status. * Renewal status. * Transaction or receipt information. * Trial status. * Expiration information. * Refund or cancellation status.

Iron Ladder does not receive your complete payment card details from Apple.

How We Use Information

We use information to:

* Operate your account and authenticate you. * Save and display your training and nutrition history. * Record Outdoor Run and Outdoor Bike Ride routes that you start. * Calculate distance, duration, pace, elevation gain, stats, and estimates. * Display recorded routes in your workout history. * Create a route sticker when you choose to create one. * Run leaderboards. * Provide social features. * Provide classes and challenges. * Generate results from AI features you invoke. * Send notifications and emails you have enabled. * Send necessary account and transactional communications. * Process and validate subscriptions. * Provide support. * Review reports. * Moderate User Content. * Prevent fraud and abuse. * Investigate safety issues. * Secure the Service. * Meet legal obligations. * Establish, exercise, or defend legal rights. * Maintain and improve the Service.

Third-Party AI Processing — Anthropic PBC

Iron Ladder’s AI features are not processed entirely on your device.

When you use an AI feature, the app sends applicable inputs to Iron Ladder’s server, which forwards them to Anthropic PBC through the Claude API to generate the result.

Iron Ladder asks for your explicit permission in the app before this happens for the first time.

You can withdraw that permission at any time at:

Settings > Privacy > AI & Your Data

If you do not grant permission, nothing is sent to Anthropic for those user-invoked AI features, and the applicable AI features remain off.

If you later withdraw permission, new user-invoked AI requests are not sent to Anthropic.

What Is Sent To Anthropic

Depending on the AI feature you choose to invoke, Iron Ladder can send:

* A meal photo you select for AI Food Scanner. * A progress photo you select for Body Composition Analysis. * Lift-video frames selected for Form Check. * Age range. * Sex. * Height. * Bodyweight. * Starting weight. * Goal weight. * Experience level. * Fitness goal. * Focus muscles. * Weekly workout target. * Recent workouts and exercises. * Weekly training volume. * Workout count. * Personal records. * Food or meal descriptions you enter. * Restaurant or brand names you enter. * Dietary preferences. * Dietary restrictions. * Calorie targets. * Macro targets. * Cycle day and cycle phase when you use Cycle-Aware Training. * Free text you enter on an AI screen, including applicable music-genre or goal preferences.

Workouts imported from Apple Health become ordinary Iron Ladder workouts and can therefore contribute to recent-workout information, workout counts, personal records, and training-volume totals supplied to Anthropic for an AI feature you invoke.

Raw Apple Health samples, including individual heart-rate, calorie, and distance readings, are not sent to Anthropic.

What Is Not Sent To Anthropic

Iron Ladder does not send the following to Anthropic as part of the AI processing described above:

* Your name. * Username. * Email address. * Password. * Payment details. * Precise location. * GPS coordinates. * Recorded route maps. * Social posts, except for the separate moderation use described below. * Comments. * Follow graph. * Raw Apple Health samples.

Health and fitness data is never shared with Anthropic or anyone else for advertising, marketing, or data mining.

How Anthropic Handles AI Requests

Anthropic processes the applicable request and returns a generated result.

Under Anthropic’s commercial terms for its API, API inputs and outputs are not used to train Anthropic’s models unless a separate agreement provides otherwise.

Anthropic’s privacy and commercial terms are available through Anthropic’s legal and privacy resources.

Iron Ladder does not provide the information described in this AI section to Anthropic for:

* Advertising. * Cross-app tracking. * Marketing. * Data brokerage. * Unrelated profiling. * General-purpose model training.

Anthropic PBC provides the same or equal protection of your data as described in this Privacy Policy and required by the App Store Review Guidelines.

The same confirmation applies to every other service provider listed under “Sharing.”

Moderation-Related Anthropic Processing

Separately from user-invoked AI features, when a post is deleted and preserved in Iron Ladder’s restricted moderation archive, its image can be sent to Anthropic to generate a text description that helps administrators search and investigate archived moderation records.

This use is for safety, moderation, and abuse investigation.

It is not used for advertising or marketing.

Health And Nutrition Calculations

Calorie, macronutrient, hydration, recovery, and body-composition figures shown in Iron Ladder are estimates derived from published formulas and public-health guidance applied to information you provide.

The formulas and citations are identified in the app under:

Settings > Privacy > Health & Nutrition Sources

Applicable citations can also be displayed near screens containing the applicable estimates.

Iron Ladder is a fitness tracking application.

Iron Ladder is not a medical device and does not provide medical advice, diagnosis, or treatment.

Apple Health And HealthKit

If you grant permission, the Iron Ladder iPhone application reads only the following Apple Health data types for importing training history and displaying workout metrics:

* Workouts. * Active energy burned. * Heart rate. * Walking and running distance. * Cycling distance. * Swimming distance.

The Iron Ladder iPhone application does not write data to Apple Health.

The Iron Ladder Apple Watch application writes only workouts recorded through the Apple Watch application so those workouts can appear in applicable Activity and Health history.

Iron Ladder does not store Apple Health data in iCloud.

Iron Ladder does not use Apple Health information for:

* Advertising. * Marketing. * Data mining.

Workouts imported from Apple Health become ordinary Iron Ladder workout records.

Because of this, imported workouts can contribute to workout counts, training volume, recent workouts, and other derived training information supplied to Anthropic when you voluntarily invoke an applicable AI feature.

Raw Apple Health samples such as individual heart-rate, active-energy, and distance readings are not sent to Anthropic.

You can revoke Iron Ladder’s Health permissions through Apple’s applicable Health privacy settings.

Sharing

Iron Ladder does not sell personal information.

Iron Ladder does not share personal information with third parties for their own marketing.

Iron Ladder does not sell precise location or share precise location for advertising, marketing, cross-app tracking, or data-broker purposes.

We share information with service providers that help operate Iron Ladder, limited to what each provider needs for its applicable function:

* Anthropic PBC — AI processing for applicable AI and moderation features described in this Policy. Precise location and GPS routes are not sent to Anthropic. * Render — application and database hosting, including stored workout records and applicable GPS route records. * Cloudflare R2 — media storage. * Resend — transactional and product email. * Twilio — text messages where enabled. * Apple — subscription purchasing and validation, Apple platform services, HealthKit functionality, WatchConnectivity, and push-notification delivery.

Each of these providers is contractually required to provide the same or equal protection of your data as described in this Privacy Policy.

We can also disclose information where reasonably necessary to:

* Comply with applicable law. * Respond to valid legal process. * Enforce the Terms of Service. * Prevent fraud or abuse. * Protect users. * Protect the public. * Protect Iron Ladder. * Respond to serious safety risks. * Establish, exercise, or defend legal claims.

Information Shared With Other Users

Other users can see information you choose to make visible, including:

* Your profile. * Profile photograph. * Public posts. * Comments. * Applicable social activity. * Rankings and associated statistics if you leave leaderboard participation enabled.

If you publish an Outdoor Run or Outdoor Bike Ride to the social feed, the post can show workout information such as:

* Distance. * Duration. * Pace.

A normal social-feed post does not publish:

* GPS coordinates. * Your stored GPS fixes. * The route map from your workout history.

If you choose to create and share a route sticker image, the image can display the route map because you chose to share it.

Your privacy settings determine applicable visibility within Iron Ladder.

Iron Ladder cannot prevent another person from taking a screenshot or otherwise preserving information that was legitimately displayed to them.

Deleted Content And Moderation

Deleted posts can be preserved in a restricted moderation archive.

A moderation archive can include:

* Captions. * Media references. * Metadata. * User reports. * Moderation information. * AI-generated image descriptions.

This preservation is intended to help:

* Investigate illegal conduct. * Investigate abuse. * Enforce community standards. * Investigate inappropriate content. * Prevent repeat abuse. * Protect users. * Meet legal obligations. * Preserve evidence.

Access to the moderation archive is restricted to administrators and service providers with an appropriate operational need.

This moderation archive does not preserve precise GPS fixes from a workout that you delete.

Automated Content Filtering

Iron Ladder uses automated systems to assist with content moderation.

Automated systems can:

* Detect potentially objectionable content. * Flag content. * Assist administrators. * Create moderation-related descriptions.

Automated systems can make mistakes.

Human administrative review can be used where appropriate.

Reports And Blocking

Iron Ladder provides functionality for you to:

* Report objectionable User Content. * Block other users.

Moderation reports can include information reasonably necessary for administrators to review the reported account, content, and surrounding circumstances.

Communications

Iron Ladder sends certain communications necessary to operate your account, including:

* Password resets. * Security notices. * Policy updates. * Moderation outcomes. * Subscription-related communications.

These Service communications can be sent regardless of promotional preferences when reasonably necessary to operate your account or comply with applicable law.

Product News And Promotional Communications

Product news and offers by email or text are off unless you turn them on.

Manage them at:

Settings > Notifications > Product News

You can also unsubscribe from any marketing email we send.

This setting does not cover:

* Service messages such as password resets, policy updates, moderation outcomes, and subscription receipts that are necessary to operate your account. * Occasional announcements shown inside the app itself, which you can dismiss.

Your Choices

You can:

* Update profile information. * Adjust notification settings. * Delete eligible individual entries. * Delete workouts and the precise GPS routes attached to them. * Manage public profile information. * Block other users. * Report User Content. * Revoke specific device permissions.

Revoking AI Consent

Turn off “Allow AI features” at:

Settings > Privacy > AI & Your Data

After it is turned off, new user-invoked requests are not sent to Anthropic.

Revoking HealthKit Access

You can revoke Apple Health permissions through the applicable Health privacy controls provided by Apple.

Revoking HealthKit permission does not necessarily remove an Iron Ladder workout that was previously imported and became an ordinary Iron Ladder workout record.

Revoking Location Access

You can turn off location access through:

iOS Settings > Privacy & Security > Location Services

Turning location access off prevents Iron Ladder from recording the precise GPS route needed for Outdoor Run and Outdoor Bike Ride route tracking.

The rest of Iron Ladder continues to work without precise location access.

Revoking Device Permissions

Camera, photo library, microphone, and contact permissions can be managed through the applicable iOS permission settings for Iron Ladder.

Location access is controlled separately as described under “Location” and “Revoking Location Access.”

Notifications

Push-notification and reminder categories can be managed through Iron Ladder’s notification settings and applicable iOS notification settings.

Leaderboards

You can disable leaderboard visibility using:

Settings > Privacy > Show me on leaderboards

Account Deletion

You can delete your Iron Ladder account through:

Settings > Delete Account

Account deletion permanently removes your account and associated personal information from Iron Ladder’s active production systems, subject to the limited exceptions described below.

Deleted account information can include:

* Workouts. * Precise GPS fixes attached to Outdoor Run and Outdoor Bike Ride workouts. * Personal records. * Nutrition entries. * Fasting entries. * Profile information. * Photos. * Posts. * Comments. * Device tokens. * Other account-associated information.

Account deletion cannot be undone.

Precise GPS fixes attached to your workouts are automatically deleted by database cascade when the workouts or account are deleted.

Iron Ladder does not retain those precise GPS fixes under the general legal, moderation, or account-retention exceptions below.

Other limited information can be retained where reasonably necessary or legally required for:

* Legal compliance. * Fraud prevention. * Security. * Abuse prevention. * Safety investigations. * Moderation records. * Dispute resolution. * Evidence preservation. * Establishing, exercising, or defending legal claims.

Deleting your Iron Ladder account does not automatically cancel an Apple subscription.

Privacy And Data Requests

You can contact support@ironladderapp.com for account or personal-data assistance.

Iron Ladder will respond to privacy and data requests within 30 days.

We can reasonably verify your identity before providing, correcting, exporting, or deleting personal information.

Where applicable law permits additional time for a particular request, we use an extension only to the extent legally permitted and provide applicable notice.

Your Privacy Rights

Depending on where you live, you can have rights concerning your personal information.

These can include the right to:

* Confirm whether personal information is processed. * Access personal information. * Correct inaccurate information. * Delete eligible personal information. * Obtain a portable copy of eligible information. * Withdraw consent. * Object to certain processing. * Restrict certain processing. * Appeal certain privacy-request decisions. * Complain to an applicable privacy regulator.

Iron Ladder will not unlawfully discriminate against you for exercising a privacy right.

Privacy rights can be subject to exceptions allowed by applicable law.

Consumer Health And Sensitive Data

Some information processed by Iron Ladder can qualify as consumer health data or sensitive personal information under applicable privacy laws.

This can include fitness, health, body-composition, nutrition, cycle-related, and precise-location information depending on applicable law.

Iron Ladder processes this information only for purposes connected with operating the fitness, health, social, safety, location-tracking, and AI features described in this Policy and as otherwise permitted by applicable law.

Where applicable law requires separate or additional consent to collect, process, or share sensitive information, Iron Ladder obtains that consent.

Iron Ladder does not sell consumer health information.

Iron Ladder does not use consumer health information for targeted advertising.

Iron Ladder does not sell precise location or use it for advertising or marketing.

International Users

Iron Ladder LLC operates Iron Ladder from the United States.

Information can be processed in the United States and other countries where Iron Ladder’s service providers maintain systems or personnel.

Privacy laws in those locations can differ from the laws where you live.

Where applicable law requires safeguards for international transfers, Iron Ladder uses an available lawful transfer mechanism or other legally permitted safeguard.

Legal Bases Where Required

Where applicable law requires Iron Ladder LLC to identify a lawful basis for processing, processing can rely on:

* Performance of the contract with you when information is necessary to provide Iron Ladder. * Consent where you choose optional processing and applicable law requires consent. * Legitimate interests in operating, securing, moderating, supporting, and improving Iron Ladder where those interests are not overridden by applicable rights. * Compliance with legal obligations. * Protection of vital interests in qualifying emergencies. * Establishment, exercise, or defense of legal claims.

Where special-category or sensitive information requires an additional legal condition, Iron Ladder LLC relies on an appropriate condition available under applicable law.

Withdrawal of consent does not make processing that occurred before withdrawal unlawful.

Security

Iron Ladder uses reasonable safeguards appropriate to the size and nature of the Service.

Safeguards include measures such as:

* Encrypted network connections. * Hashed passwords. * bcrypt password hashing. * Client-side encryption for designated body and progress photographs. * Private storage for encrypted body and progress photographs. * Administrative access controls. * Restricted moderation access. * Other technical and organizational measures.

No online service can guarantee perfect security.

You are responsible for maintaining security over:

* Your password. * Your email account. * Your devices. * Your authentication methods.

Data Retention

Iron Ladder generally keeps account information for as long as your account remains active and the information is reasonably necessary to provide the Service.

Precise GPS fixes for Outdoor Run and Outdoor Bike Ride workouts are kept only while the workout they belong to remains stored in your account.

When you delete one of those workouts, its precise GPS fixes are automatically deleted by database cascade.

When you delete your account, its workouts and their precise GPS fixes are automatically deleted by database cascade.

Iron Ladder does not keep a separate copy of deleted precise GPS fixes.

For other information, when an account is deleted, personal information is removed from active production systems except where limited retention is reasonably necessary or legally required for:

* Legal compliance. * Fraud prevention. * Abuse prevention. * Safety records. * Moderation. * Security. * Financial or transaction records. * Evidence preservation. * Dispute resolution. * Legal claims.

Other information processed by a service provider can also remain for the limited period permitted under the applicable provider agreement and applicable law.

Iron Ladder does not retain personal information longer merely because it might someday be useful.

Security Incidents

If Iron Ladder discovers a security incident involving personal information, we investigate it and provide notices to users, regulators, or other parties when required by applicable law.

Because Iron Ladder processes fitness and health information, some incidents can be subject to specialized consumer-health-data breach-notification requirements even where HIPAA does not apply.

No Advertising Or Cross-App Tracking

Iron Ladder does not:

* Display third-party behavioral advertising. * Run advertising. * Use advertising SDKs. * Collect or use IDFA for advertising. * Sell personal information. * Sell precise location. * Share precise location for advertising or marketing. * Share personal information with data brokers for advertising or marketing. * Share personal information for third parties’ own marketing. * Perform cross-app behavioral tracking.

If these practices materially change in the future, this Privacy Policy and applicable consent or opt-out systems will be updated before the new processing begins where required by law.

Children

Iron Ladder is not directed to children under 13.

We do not knowingly collect personal information from children under 13.

If we learn that a child under 13 created an account or provided personal information without legally sufficient authorization, we take appropriate steps to remove the account and information, subject to applicable legal and safety retention requirements.

A parent or guardian who believes a child under 13 provided information to Iron Ladder can contact:

support@ironladderapp.com

Users between 13 and the age of legal majority can be subject to additional protections under applicable law.

Changes To This Privacy Policy

We can update this Privacy Policy as Iron Ladder changes.

When a material change is made:

* The date at the top of this Policy is updated. * You are provided with applicable notice. * You are asked to review or accept an updated policy in the app when required or when Iron Ladder determines renewed acceptance is appropriate.

Where a new use of information legally requires consent, Iron Ladder obtains the required consent before beginning that use.

Contact

Privacy questions, data requests, account-deletion questions, and privacy complaints can be sent through the Iron Ladder contact system or to:

Iron Ladder LLC Email: support@ironladderapp.com

© 2026 Iron Ladder LLC. Iron Ladder™. All rights reserved.