Privacy Policy

Last updated September 16, 2026

1. Introduction

SpotMax is a voice-first workout tracker for iPhone. You say your sets out loud between lifts, SpotMax logs them and answers back.

This policy explains exactly what SpotMax collects, what leaves your phone, and what we do with it. SpotMax is built local-first: your workout history lives on your device, and raw microphone audio never leaves your phone. This policy is written to describe what the app actually does, not what it might do someday.

SpotMax has no user accounts. You never give us a name, email address, or password to use the App.

2. Information We Collect

2.1 Voice and audio data

SpotMax listens through your microphone while a workout is running so it can hear the wake word (“Yo Maxa”) and your spoken sets.

All audio processing happens on your device. Specifically:

• Wake word detection runs on a machine-learning model bundled inside the app, on your phone.
• Voice activity detection (deciding when you started and stopped talking) runs on a bundled model, on your phone.
• Speech-to-text runs on your phone, using a Whisper speech-recognition model bundled inside the app. No speech recognition service is contacted over the network, and the model is never downloaded.
• When you speak, SpotMax writes a single short temporary audio clip to your device’s temporary storage so the on-device transcriber can read it. Each new clip overwrites the previous one, so only the most recent one exists at any time, and iOS clears temporary storage on its own.

Because SpotMax has to keep listening while your phone is locked and in your pocket, the microphone stays active in the background for the duration of a workout. It stops when the workout ends.

We never upload, transmit, or store your audio recordings. No audio file, audio buffer, or voice recording is ever sent to our servers or to any third party.

What can leave your device is the text transcript of what you said, and only when the AI Coach is enabled — see below.

2.2 Workout and exercise data

Everything you log — exercises, sets, weights, reps, notes, personal records, programs, rest timers, workout history — is stored on your device only. There is no account, no cloud backup, and no cross-device sync. If you delete the app, this data is deleted with it, so we recommend using the built-in export before uninstalling.

So that a crash mid-workout can’t lose your sets, SpotMax also keeps a local recovery log of the current workout, which includes the transcribed text of the commands you spoke. It stays in the app’s own storage on your device and is never transmitted.

You may also optionally enter profile information in the app: a display name, a profile photo, your bodyweight, your training goal, your training environment, and your experience level. The display name and profile photo stay on your device and are never transmitted anywhere.

2.3 Data sent to the AI Coach

When the voice coach is turned on and you speak to it, SpotMax sends a request over an encrypted (HTTPS) connection to our coaching backend, which passes it to Anthropic’s Claude model to produce a reply. That request contains:

• The text transcript of what you said (never the audio).
• Workout context: the current exercise, recent sets (exercise name, weight, reps, unit), planned and completed exercises, superset groupings, and the next set you’re expected to do.
• Training history summary: how long you’ve been training, workouts in the last 30 days, total workouts, your best sets per exercise, your unit preference, and — if you have entered it — your bodyweight.
• Your training profile: your stated goals, training environment, and experience level.
• An anonymous user identifier (see “Device identifiers” below).

Your name, your profile photo, your email, your phone number, your location, and your contacts are not sent. We have no way to tie this data to your real identity.

The same backend is used when you ask SpotMax to generate a workout or a training program; those requests carry your goals, environment, experience level, equipment, and the exercise catalog — not audio, not your name.

What the backend stores: to give the coach memory across a conversation, our backend saves the text of your coaching turns (what you said and what the coach replied) along with timing and model-usage information, plus a cached copy of your training profile (goals, experience level, training environment, unit). These records are keyed to the anonymous identifier, not to you.

If you turn the voice coach off, nothing is sent to the coaching backend at all.

2.4 Usage and analytics data

SpotMax uses PostHog to understand how the app is used and to catch crashes. This is on by default and you can turn it off at any time in Settings ▸ “Share usage & crash data.”

When it is on, we collect:

• Product events — app opened, onboarding steps viewed and completed, workout started/completed/discarded, set logged, personal record detected, sets edited or deleted, supersets created, wake word fired, voice command parsed or dropped, coach turn completed, workout or program generated, backup exported or imported, purchase started or completed, settings changed.
• Performance and diagnostic data — request latencies, retry counts, error codes, audio-engine and storage failures.
• Crash and error reports, captured automatically.
• Profile-shaped properties — your training goal, training environment, experience level, unit preference, weekly target, which feature toggles you have on, whether you have an active program, and whether you have a subscription.
• Device and build context — app version, build number, release channel, iOS major version, and platform.

We do not collect your name, your bodyweight, your profile photo, or the content of your workouts or coach conversations through analytics — these are explicitly stripped before any event is sent. We do not use session replay, screen recording, or automatic UI-interaction capture.

SpotMax does not track you across other companies’ apps or websites, does not use the Advertising Identifier (IDFA), and contains no advertising SDKs.

2.5 Subscription and purchase data

SpotMax Pro subscriptions are sold through Apple’s App Store and managed with RevenueCat. When you subscribe, restore, or your subscription renews, RevenueCat receives the App Store transaction data needed to verify the purchase (transaction identifiers, product identifier, purchase and expiration dates, receipt information) along with your anonymous SpotMax identifier.

We never see or receive your payment card, billing address, or Apple ID. Payment is handled entirely by Apple.

Free-tier usage counts (how many coach workouts and AI programs you’ve used this month) are counted on your device only and are not transmitted.

2.6 Device identifiers

On first launch, SpotMax generates a random identifier (a UUID) on your device and stores it locally. It is not derived from your Apple ID, your email address, your phone number, or any hardware or advertising identifier, and it is not shared with other apps.

This identifier is used as the key for coach conversations, as the analytics identifier, and as the subscriber identifier for RevenueCat, so that the same person is recognized consistently across those three services. It is reset if you delete and reinstall the app.

2.7 Photos

If you choose to set a profile photo, SpotMax uses Apple’s system photo picker. Only the single image you pick is given to the app. It is stored on your device and is never uploaded.

2.8 What we do not collect

SpotMax does not access, collect, or transmit: location data, contacts, calendars, health or fitness data from Apple Health (HealthKit is not used by the app), the camera, your music library, your browsing activity, or any advertising identifier.

3. How We Use Information

• To run the app — log your sets, track personal records, run rest timers, and read your workout back to you.
• To answer you — send your spoken request and workout context to the AI coach so it can give a relevant reply, and to generate workouts and programs on request.
• To improve SpotMax — understand which features are used, where onboarding is abandoned, and how fast and reliable the voice loop is.
• To fix bugs — diagnose crashes and errors.
• To manage subscriptions — verify entitlements and unlock Pro features.

We do not use your data to train machine-learning models, and we do not sell or rent it.

4. Third-Party Services

5. Data Storage and Security

• On your device: workout history, programs, settings, profile name and photo, and free-tier counters are stored in the app’s local database and preferences, protected by iOS app sandboxing and device encryption. Keeping a device passcode enabled is the single most effective protection for this data.
• In transit: every network request the app makes uses TLS (HTTPS).
• On our backend: coach conversation records and cached training profiles are stored in a managed Postgres database hosted by Supabase, encrypted at rest, with direct client access denied by row-level security — only our server-side functions can read or write them.

No system is perfectly secure, and we cannot guarantee absolute security. But because SpotMax has no accounts and stores your workout history only on your phone, the amount of your data that exists on any server is deliberately small.

6. Data Sharing

We do not sell your personal information, and we do not share it for advertising or cross-context behavioral advertising.

We share data only with the service providers listed above, only for the purposes described, and only to the extent needed to make the corresponding feature work. Those providers are bound by their own agreements and privacy policies.

We may also disclose information if we are legally required to do so, or where necessary to protect our rights, safety, or the safety of others.

If SpotMax is ever involved in a merger, acquisition, or sale of assets, information covered by this policy may be transferred; we will post notice here before that happens.

7. Data Retention

• On-device data is kept until you delete it (individual sets and workouts, “Delete all logged workouts” in Settings) or until you uninstall the app.
• Coach conversation records and cached training profiles on our backend are retained for as long as needed to provide conversational memory and to operate and improve the coach. We do not currently run automatic deletion on a fixed schedule; you can request deletion at any time (see below).
• Analytics and crash data are retained according to PostHog’s retention settings for our project.
• Subscription records are retained by RevenueCat and Apple according to their own policies and applicable tax and accounting requirements.

8. Your Rights and Choices

Whatever jurisdiction you’re in, you have these controls:

• Turn off the AI coach. Turning the voice coach off in Settings stops all transmission to the coaching backend. Transcripts are not sent, and nothing is stored server-side.
• Turn off analytics. Settings ▸ “Share usage & crash data” opts you out of PostHog immediately, without restarting the app.
• Revoke microphone access. iOS Settings ▸ SpotMax ▸ Microphone. Voice features stop working, but the rest of the app continues to function.
• Access and export your data. Settings lets you export your complete workout history as JSON, or your sets as a CSV file, at any time.
• Delete your data. Delete individual sets and workouts in the app, or use “Delete all logged workouts” in Settings to erase everything logged. Deleting the app removes all local data.
• Delete server-side data. To have your coach conversation records and cached training profile deleted from our backend, contact us at snassabi7@yahoo.com from the device you use SpotMax on, or include enough detail (such as when you started using the app) for us to help locate your records.
• Manage or cancel your subscription. Use the App Store: iOS Settings ▸ your name ▸ Subscriptions, or the link in SpotMax Settings. Refunds are handled by Apple.

Depending on where you live, you may have additional rights — to access, correct, delete, or port your data, to object to or restrict processing, or to withdraw consent. Contact us at snassabi7@yahoo.com and we will respond as required by applicable law. We will not discriminate against you for exercising any of these rights.

9. Children’s Privacy

SpotMax is a general-audience fitness app. It is not directed at children, and we do not knowingly collect personal information from anyone under 13 (or under 16 where that is the applicable age of digital consent). If you believe a child has provided us information, contact us at snassabi7@yahoo.com and we will delete it.

10. International Users and Data Transfers

SpotMax is operated from the United States. Our backend infrastructure and our analytics, AI, and subscription providers may process and store data in the United States and in other countries where they or their sub-processors operate.

If you use SpotMax from outside the United States, you understand that your information may be transferred to, stored in, and processed in countries whose data protection laws differ from those of your own. Where required, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses — for those transfers.

11. Changes to This Policy

We may update this policy as SpotMax changes. When we do, we will revise the “Last updated” date at the top of this page. For changes that materially affect how we handle your information, we will give notice in the app before the change takes effect. Continuing to use SpotMax after an update means you accept the revised policy.

12. Contact Us

Questions about this policy, or requests about your data:

Shayan Nassabi
Email: snassabi7@yahoo.com

We aim to respond to privacy requests within 30 days.