Where your data lives
Peak Fettle is built local-first. On the free plan your workout log stays on your iPhone. Here is what does leave the phone, how it travels and where it is kept, including the parts that are not end-to-end encrypted.
Where data is kept
| Where | What it holds | How it is protected |
|---|---|---|
| Your iPhone | Every workout, set, weight and health reading, in a private database inside the app. On the free plan this is the only copy of your workout log. | The iOS app sandbox, your passcode or Face ID, and the Keychain for sign-in tokens. |
| On the way | Sign-in, Pro sync, groups, push notifications and subscription status. | HTTPS only. Sign-in endpoints are rate-limited. |
| Our server | Your account email, your group memberships and, if you have Pro, a copy of your workout log so it follows you to a new phone. | A Postgres database that our provider encrypts at rest. Pro data is not end-to-end encrypted. No card numbers, ever. |
How it is protected
Data on your phone
On the free plan your workout log is stored on your iPhone and works offline; it is not sent to our server. An automated check runs on every code change and fails any new screen that reaches our server for personal data without going through the free-plan path.
- Store
- On-device SQLite, inside the app sandbox
- Check
- Local-first sweep on every change, in continuous integration
- Free plan
- Your workout log stays on the phone
Sign-in
Passwords are stored only as a slow one-way hash, so we could not read yours if we tried. Sessions use short-lived tokens kept in the Keychain, and Apple or Google sign-ins are verified on the server rather than taken on trust.
- Passwords
- bcrypt, cost 12; never stored in plain text
- Sessions
- Access token 15 minutes; refresh token 30 days, single use and rotated
- Apple and Google
- RS256 signature, issuer and audience checked against the provider’s published keys
Payments
Subscriptions run through Apple’s App Store. Your card number never reaches Peak Fettle: we receive a signed message that you are subscribed, and the server will not let the app set its own Pro status.
- Billing
- Apple StoreKit, through RevenueCat
- Webhook
- Shared-secret authorization; unauthenticated calls are rejected
- Pro status
- Decided by the server, not the app
No ad tracking
There are no advertising or analytics SDKs in the app. Crash reporting runs only in builds it has been configured for, and it strips personal details: it carries the crash, not your training log.
- Ads and analytics SDKs
- None
- Crash reports
- Off unless configured for a build; personal details removed
Backups
On the free plan your workout log exists only on your iPhone. If the phone is lost and you do not have Pro, the log goes with it, so treat the phone as the copy that matters.
With Pro, your log is also stored on our server so it follows you to a new phone. That copy is encrypted in transit and at rest, but it is not end-to-end encrypted: the service can read it, which is how it reaches your next phone.
LifeOS is different: its backups are optional and end-to-end encrypted. The details are in the LifeOS privacy policy.
Details
- Pro data is readable by the service. It is processed on our server, which is what lets it move to a new phone. Free-plan users are not affected: their workout log is not sent.
- Your account email is on our server. Signing in needs it. Apple’s Hide My Email works if you would rather we never see your real address.
- You can delete your account. Deleting it from the app removes the account and the data our server holds for it.
- Your phone is part of the model. On-device data is protected by iOS and by your passcode or Face ID. That layer is the one only you control.
Questions about security: admin@peakfettle.app.