Privacy Policy
Effective September 23, 2026
The short version: Zfit is local-first. Your workouts, meals, runs, and health data live on your iPhone — not on our servers. Five things you choose to do send data out: searching or scanning food in the database, and the four AI features — the AI coach, meal-photo analysis, AI meal plans, and barbell-photo reading. Your Apple Health measurements — sleep, HRV, heart rate — are never part of any of them. We don't run ads, we don't sell data, and we keep no copy of what's processed.
Who we are
Zway Fitness ("Zfit", "we") makes a training app for iPhone. Questions about this policy: hello@zwayfitness.com.
This website
- Waitlist email. If you join the early-access list, we store your email address (hosted with Supabase) and use it to tell you about the launch and major updates. Nothing else. To be removed, reply to any of our emails or write to us.
- Confirmation emails are delivered by Resend, our email processor.
- No analytics, no ads, no tracking pixels. This site sets no advertising or analytics cookies.
The Zfit app
The app is built local-first: everything you log is stored in the app's database on your device, and the app requires no account. Data leaves the device only when you use one of these: food-database lookups (below), or the four AI features described under AI features. Nothing else is transmitted, and we store no copy of your training, nutrition, or health records on our servers.
- Apple Health. With your permission, Zfit reads sleep, heart-rate variability, heart rate, resting heart rate, steps, and active energy to compute your recovery score. This processing happens on your device. The iPhone app writes nothing to Health; runs you track with the Apple Watch app are saved to Health by the watch. You control every category in iOS Settings and can revoke access at any time.
- Camera & photos. Used for barcode scanning, meal photos, and barbell photos. Barcodes are read on your device. A meal photo leaves your device only when you tap ANALYZE PLATE, and a barbell photo only when you tap READ — see AI features. Photos are re-encoded before sending, which strips location and camera metadata.
- Food-database lookups. When you search for a food by name or scan a barcode, the search text or barcode is sent over HTTPS to two public food databases — Open Food Facts and the USDA FoodData Central — to fetch the nutrition facts. They receive the query and your IP address, as any website you visit does; they do not receive your name, your logs, or any identifier from us, and we keep no copy of the query.
- Location. Used to trace your running route on the map during a run you start. Routes are stored on your device only.
- Shared programs. Sharing a program creates a text code containing only the program's structure (exercise names, sets, reps, schedule) — never your logs, health data, or identity.
AI features
Four features use AI processing. All four are things you actively choose to do — nothing is sent in the background, and the app is fully usable without any of them.
- IRIS, the AI coach. When you send IRIS a message, we send your question along with the training context needed to answer it: recent sessions, your program, your calorie and protein totals, today's calories and protein and your protein adherence over the last week, a summary of your training history (how often you train, your most-logged lifts, whether your volume is rising or falling, your training-load ratio), your last few messages in the thread, your unit preference, the two free-text answers you gave during The Scan (what a normal day of eating looks like, and anything else about your days), and today's recovery score and state. We deliberately withhold your Apple Health measurements — sleep duration, heart-rate variability and resting heart rate never leave your device, even though the score is partly derived from them — and we withhold the history of your recovery scores too. IRIS sees today's recovery, never its trend.
- Meal-photo analysis. When you analyse a meal photo, that photo is sent to estimate its calories and macros, and the estimate comes back to your device. Results are always an estimate, labelled as such. If you correct what the photo shows, the corrected food names are sent with it.
- Barbell-photo reading. When you photograph a loaded barbell to read the weight on it, that photo is sent and the plate count and bar weight come back to your device as an estimate for you to check. Nothing else is sent with it.
- AI meal plans. When you ask for a meal plan, we send your calorie and macro targets together with the dietary preferences you entered in Diet — eating style, allergies, dislikes and favourites — so the plan can respect them. Allergies are included on purpose: a plan that does not know about them is unsafe. Nothing else about you is sent; there is no name, account or identifier attached.
Processing runs on our server (Supabase) and through Anthropic's Claude API, which acts as our processor. We do not store your photos, messages, or training context — they are used to answer the request and not retained by us, and neither we nor Anthropic use them to train AI models. Your data is not sold or shared with anyone else, and no account or identifier is attached to these requests. To prevent abuse of these features we keep a request counter per network address for up to 48 hours; it holds a count and a timestamp, nothing about what was asked.
Don't want any of it? Don't use IRIS chat, the photo pane, or AI meal plans. Every other feature — logging, programs, recovery, runs — works entirely on your device, with the one exception above: searching or scanning a food contacts the public food databases. Quick-logging a food by typing its macros does not.
What we never do
- We never sell your personal data.
- We never show third-party ads.
- We never read Apple Health data for anything other than the features you see.
- We never send your Apple Health measurements to any third party, including our AI processor.
- We never use your data — photos, messages, or logs — to train AI models.
Deleting your data
In the app: Settings → Delete Account erases your profile, your Sign in with Apple identity, and every workout, meal, run, and recovery record on the device. Two things it cannot reach: runs the watch saved into Apple Health stay there until you delete them in the Health app, and the device remembers that a free trial was already used. Waitlist: email us and we'll delete your address.
Future features
Optional accounts (sync) and coach/client tools are planned. Each will be opt-in, and this policy will be updated before any of them changes what we collect. If we ever propose including your Apple Health measurements in AI coaching, it will be an explicit choice you make, off by default — never a silent change.
Children
Zfit and this site are not directed at children under 13, and we don't knowingly collect their data.
Changes
We'll post any changes here with a new effective date. Material changes to app data handling will also be announced in the app.