MADSET — Privacy Policy

MADSET is a personal training log. This policy explains what the app stores, what may leave your device for account functionality, encrypted restore, or an integration, and the controls available to you. MADSET does not sell data or share it with advertising networks. Optional MADSET news and offers require a separate opt-in; health and fitness records are never used for that targeting.

Data kept on your device

• Your workout and training log — sessions, exercises, sets, weights, reps, timestamps, custom exercises, selected variants, and plan answers are stored locally on the device and are also eligible for the encrypted Health Vault backup described below.
• Your health-side app data — cardio logs, InBody and body measurements, recovery history, physiology records, targets, labels, and related settings also have an on-device copy and may be backed up through the encrypted Health Vault as described below.
• Your Apple display name — Apple may provide a name on the first authorization. MADSET keeps it on the device and does not send it to the backend.
• Optional personal profile — versions with profile settings let you choose a preferred name, profile photo and optional date of birth. These are private, not a public profile. The chosen name and a small, re-encoded profile photo are stored on your device and included in the encrypted Health Vault after a successful sync, and in manual JSON exports. The system photo picker grants access only to the image you select; MADSET does not upload the original photo or its location metadata. Your optional date of birth is included in the same encrypted backup for your private profile, not for marketing or age-based audiences. You can edit or clear these fields in Settings.
• InBody images — camera or photo-library images are read on the device to prefill fields for your review. The image is not saved by MADSET or uploaded.

MADSET uses on-device SwiftData stores so logging continues offline. It does not use iCloud or CloudKit to sync new personal health or fitness records. Its temporary access to the old private CloudKit container is limited to deleting legacy records created by prior TestFlight builds. Local notifications and their preferences are handled by iOS. Depending on your iOS backup settings, ordinary on-device app files may also be covered by Apple's device backup; that is separate from MADSET Health Vault and is not an account-level MADSET sync.

Data sent for app functionality

• Encrypted Health Vault. The structured Vault archive includes workout sessions, exercise entries, sets, weights, reps, timestamps, custom exercise names and choices, plan and onboarding state, InBody and body measurements, recovery values, cardio sessions, workout physiology such as strain and heart-rate summaries, goals, recovery gate history, cached WHOOP summary, cardio machine labels, and the optional personal profile (chosen name and small profile photo, plus optional date of birth). Other photos, videos, Apple credentials, Health permission state, notification permission, and an in-progress rest timer are not included. The archive is split into encrypted parts when needed so older workouts are not intentionally removed to meet a single-file limit. The backend stores the encrypted parts for account restore. This is not a claim of zero-knowledge or end-to-end encryption: the service manages the account key needed to provide restore.
• Sign in with Apple. The signed Apple identity token and authorization code are sent to the MADSET backend for verification. After successful verification, the backend returns an account-scoped bearer session that the app stores in the iOS Keychain and uses for Health Vault, WHOOP, session, and account requests. MADSET never receives the Apple ID password and does not use a shared access key or cookie to unlock the account.
• Coach connection. The coach feature is disabled in the current Release/default configuration. That configuration does not submit a coach invite code or send plan data to a coach service.
• Legacy CloudKit cleanup. MADSET may access its old private CloudKit container during migration or account deletion solely to permanently delete workout records uploaded by earlier TestFlight builds. It does not use CloudKit to sync or write the current workout log.
• Data you export yourself. Tapping “Export data” produces a JSON file and hands it to the iOS share sheet. Where it goes is entirely your choice; MADSET does not upload it anywhere.

Apple Health

If you grant permission, MADSET requests read access only to body mass, resting heart rate, and sleep analysis. It requests no write access. These values are used to show optional body and recovery context alongside training.

• MADSET never writes anything back to Apple Health.
• Sleep and resting-heart-rate readings are read for display. A body-weight reading may be retained as a dated MADSET body measurement and included in the encrypted Health Vault. Raw HealthKit samples are not copied to iCloud or CloudKit.
• Health data is not used or disclosed for advertising or marketing.
• If you decline Health access, Health-dependent context is not shown, but the rest of the app remains available.

WHOOP

MADSET can offer an optional WHOOP connection when the service is available. If you connect it, the app may show account-scoped recovery, sleep, strain, and workout summaries and provides a Disconnect control. WHOOP OAuth credentials are held by the backend, not stored in the app, and MADSET never receives the WHOOP password.

Disconnect WHOOP asks the backend to remove the connection credentials and stop retrieving new summaries. Previously imported local history remains until you erase the relevant local data or delete the MADSET account.

Sign in with Apple

MADSET uses Sign in with Apple to verify the account used for Health Vault sync, restore, and deletion flows. Apple performs Face ID, Touch ID, passcode, or password authentication; MADSET never sees the Apple ID password. The backend verifies Apple's signed identity token and does not require your Apple email address. The display name Apple may provide on first authorization remains on the device. If you revoke MADSET in Settings → your Apple Account → Sign in with Apple, the app detects it on next launch and treats you as signed out.

Optional account messages and basic usage

In versions with these controls, Settings separates training and app updates, news and offers, and basic usage sharing. Training and app updates are functional service messages, including workout encouragement and app or service updates; they do not include offers. In current versions, all three choices start off. A forthcoming version will enable training and app updates on initial setup only when no prior preference exists. A saved off choice remains off, and an unclear older preference is not turned on. News and offers and basic usage sharing remain off until you separately opt in. These choices do not change local rest alerts. Online messages also require an active MADSET Apple sign-in and iOS notification permission; enabling the service choice does not guarantee delivery. You may turn these choices off in Settings.

To deliver messages, the backend stores an encrypted Apple push token, an installation identifier, account binding, consent choices, language, app version, notification authorization and production/development environment. Basic usage sharing adds only the UTC calendar day you last opened the app. No workout, health measurement, profile name, photo or birthday is included in this usage record or in the owner dashboard. Registered-account counts are not download counts. The dashboard does not read encrypted Health Vault contents.

Device registrations expire within 90 days unless refreshed. Campaign history and delivery-attempt receipts expire after 30 days. Turning basic usage off removes its recorded day when the server confirms the change. Offline changes remain pending and the app says so. Sign-out revokes the session used for delivery; account deletion removes the registration. A message already accepted by Apple cannot be recalled. Apple's acceptance is not proof that a message was received or read. MADSET does not collect notification-open events in this release.

Apple delivers push notifications. Our existing Vercel/Upstash backend stores the minimal operational records and schedules dispatch. The private owner dashboard requires a separately verified administrative sign-in through Cloudflare Access. No provider is given health data for marketing.

Limits on data use

• No analytics or crash-reporting SDKs.
• No third-party advertising, no ad identifiers (IDFA), and no cross-app tracking. Optional first-party news and offers are sent only with your separate consent.
• No third-party SDKs of any kind — the app ships with no external dependencies.
• MADSET does not sell personal data or share it for advertising.
• No AI or third-party processing of your plan answers: MADSET's built-in plan options are generated by rules in the app.

Sign out, erase, and delete account

• Sign out: first attempts to sync the latest eligible data to Health Vault. If that backup fails, MADSET keeps you signed in and asks you to retry. After a successful sync it asks the backend to revoke the active bearer session, then removes its Keychain copy and stops bearer-authenticated Health Vault and WHOOP requests. It does not delete local records, the Health Vault, or the account.
• Erase all data: removes MADSET records and preferences from this installation but does not send a backend account-deletion request. It also signs the app out and removes temporary MADSET exports and personal media that remain in the app's storage. It does not delete the remote encrypted Health Vault or WHOOP connection.
• Delete MADSET account: Settings → Manage your data in newer versions (Data & privacy in older versions) starts deletion of the backend account, encrypted Health Vault, WHOOP connection credentials, and active backend sessions. After the backend confirms the request, MADSET removes its local records, account-owned preferences, session credentials, temporary exports, and personal media. MADSET keeps a local deletion fence until remote deletion and local cleanup are confirmed; a connection or relaunch may be required to finish. Account deletion may also access MADSET's old private CloudKit container solely to permanently remove legacy workout records uploaded by earlier TestFlight builds. This is deletion-only access, not current workout sync or a new CloudKit write.
• Deleting the app: removes its local app container but is not an account-deletion request. Data included in the last successful encrypted Health Vault sync can be restored after reinstall when you sign in with the same MADSET Apple account. Changes made after the last successful sync, and photos or videos other than the small profile photo, cannot be restored from Health Vault. Keep the old device and its data until MADSET confirms the backup is up to date.
• Portable copy: manual JSON export remains available in Settings. The file leaves the app only when you choose a destination in the iOS share sheet. Contact the address below for any additional data request.

Children

MADSET is not directed at children and does not knowingly collect information from anyone under 13.

Changes

If this policy changes materially, the date at the top of this page changes with it.

Contact

Questions, data requests, or deletion requests: mad@beingmad.co