Privacy Policy — IPTAS

Effective date: May 8, 2026 Last updated: May 8, 2026

1. Who we are

IPTAS ("the app", "the service") is an AI fitness coaching product owned and operated by Guerrilla Consulting Ltd ("we", "us", "our"), a company incorporated under the laws of British Columbia, Canada. IPTAS is a fully-online service operated remotely; we do not maintain a public mailing address. This Privacy Policy is the agreement between you and Guerrilla Consulting Ltd in respect of your use of IPTAS.

For privacy questions, contact customerservice@getiptas.com.

2. What information we collect

Information you give us directly

When you sign up and use IPTAS, you provide:

Account info: email address, password (hashed and stored by our authentication provider, not visible to us in plain text).
Profile info from onboarding: name, date of birth, sex, height, weight, fitness level, primary goal, equipment access, dietary restrictions, injuries, timezone, sleep / stress / activity habits, coach personality and tone preferences, custom coach name.
Logged data: workouts (sets, reps, weight, RPE, mood/energy, notes), meals (descriptions, macros, photos if taken), cardio sessions, body metrics (weight, body fat %, circumferences), hydration entries, soreness reports, mobility sessions, progress photos.
Coach conversations: every message you send to and receive from the in-app AI coach.
Subscription info: tier (free or Pro), purchase status, managed via Apple App Store / Google Play and our subscription provider (RevenueCat). We do not see or store card numbers.

Information collected automatically

Usage data: which features you use, how often, when. Used for analytics and to improve the product.
Device info: device type, operating system version, app version. Used for crash reporting and compatibility checks.
Push token: a per-device identifier so we can send notifications you've opted into.

Information we do NOT collect

No third-party tracking pixels or advertising IDs.
No location data beyond timezone, which you provide explicitly during onboarding.
No contacts or social graph data.

3. How we use your information

We use your data only to:

Run the service: generate your plans, render your dashboard, surface coach replies, send notifications you've opted into.
Personalise the coach: send your context (profile, recent logs, current plans) to our AI provider so the coach can respond specifically to you.
Improve the product: aggregated, de-identified usage analytics help us prioritise features and fix bugs.
Communicate with you: account-related emails (password resets, subscription receipts, important policy changes).
Comply with legal obligations.

We do not sell your data, share it with advertisers, or use it for any purpose unrelated to the service.

Running the service requires sharing some data with third parties. These are the only ones:

Provider	What they receive	Why
Anthropic (claude.ai API)	Your profile snapshot, recent logs, current message — sent on each AI call to generate the coach's reply. Inputs are processed by Anthropic per their API data policy and are NOT used to train their models.	Generate AI coach responses, plans, recipe ideas, photo reviews.
Supabase	All your account and logged data.	Backend database, authentication, storage.
RevenueCat (when subscriptions go live)	Your user ID, purchase events.	Subscription management.
Apple App Store / Google Play	Purchase events.	Process subscription payments.

We do not share your data with any other third parties. If we introduce additional sub-processors (for example, a future error monitoring or analytics provider), we will update this Privacy Policy and notify users in the app at least 30 days before any new provider begins receiving data.

5. AI processing

IPTAS's coach is powered by Claude, an AI model from Anthropic. When you interact with the coach (chat, plan generation, photo review, etc), we send a snapshot of your relevant data to Anthropic's API to generate the response. By Anthropic's API agreement:

Your inputs are not used to train Anthropic's models.
Anthropic retains the data only as long as necessary to provide the service (typically a short retention window for abuse monitoring).

Health and safety note

The information IPTAS shows you — workout plans, macro targets, trends, coaching messages, photo reviews, recipe ideas — is generated for informational and educational purposes only. It is not medical advice, dietary advice, or any other form of professional advice, and it is not a substitute for consultation with a qualified healthcare professional.

Always consult a qualified physician, registered dietitian, physical therapist, or other licensed professional before acting on anything IPTAS produces, especially if you have a medical condition, are pregnant or postpartum, are recovering from injury or illness, or are taking medication. See our Terms of Service for the full medical disclaimer.

If you don't want your data sent to a third-party AI provider, do not use the service.

6. Photos

Two storage buckets hold images you upload:

Progress photos: stored privately under your account. Only you can access them (we use signed URLs that expire). They are sent to Anthropic's vision model only when you tap "Ask coach to review" on a side-by-side comparison.
Chat attachments: photos you attach in coach chat. Same privacy posture; sent to Anthropic on the message you attached them to.

You can delete individual photos any time. Deleting your account removes all photos.

7. Notifications

We send push notifications for events you've opted into (workouts, streaks, recovery prompts, etc). You can opt out of any individual trigger or set quiet hours in Settings → Notifications.

8. Your rights

You have the right to:

Access your data — most of it is visible in the app. For the rest, email customerservice@getiptas.com and we'll provide an export within 30 days.
Correct your data — edit it in your Profile.
Delete your account — Settings → Delete account. This permanently removes every record we hold about you, including photos and chat history, within 30 days.
Withdraw consent for AI processing — you'd lose access to the service since it can't function without it. Use the delete-account option instead.
Object to processing or request data portability — email customerservice@getiptas.com.

If you're in the EU/UK, you can also lodge a complaint with your local data protection authority.

9. Data retention

Active accounts: data is retained for as long as your account is active.
Deleted accounts: every owner-keyed record is removed within 30 days of deletion. Backups are retained for an additional 30 days before being overwritten.
Aggregated, de-identified analytics: may be retained indefinitely for product improvement; this data cannot be linked back to you.

10. Security

All traffic is HTTPS / TLS.
Database access is gated by row-level security: every query enforces user_id = auth.uid() so one user can never read another's data.
Photos use signed URLs with a 1-hour expiry.
The Anthropic API key lives only in our server environment; the client never sees it.

We follow industry best practice but no system is perfectly secure. If we discover a breach affecting your data we will notify you within 72 hours of confirmation.

11. Children

IPTAS is not directed at children under 13. Onboarding requires a date of birth and the wizard rejects ages under 13. If you believe a child has signed up despite this, contact customerservice@getiptas.com.

12. International transfers

Our primary hosting region is AWS us-west-2 (Oregon, USA) via Supabase. Anthropic AI processing occurs in their US infrastructure. By using IPTAS you consent to data transfer to and processing in those regions. We use industry-standard contractual clauses with Anthropic and Supabase for cross-border data transfers, including for users located in the EU/UK.

13. Changes to this policy

We will notify you in-app and via email at least 30 days before any material change to this policy. Continued use after the effective date constitutes acceptance.

14. Contact

For privacy questions, data-export requests, deletion requests, or any data-protection matter, email customerservice@getiptas.com.

For California residents: see Section 9 for data retention details. You can also exercise your rights under the CCPA by emailing customerservice@getiptas.com with subject line "CCPA request".

For EU/UK residents: our data protection contact is the same customerservice@getiptas.com.