Privacy policy

Pre-launch draft, pending legal review.

In short

W7SH keeps your training so you can reach it from any device. No ads, no tracking across apps and websites, and we never sell your data.

What we collect

• Only a way to sign in is required. Everything else below is optional and stays off until you use it.
• Your email address to sign in, or what Apple shares when you sign in with Apple (possibly a private relay address, and your name the first time only), or what Google shares when you continue with Google (your email, name and account picture). If your Google account's email is the email of your W7SH account, it opens that same account.
• What you log: workouts, sets, weights, reps, routines, your own exercises and body measurements such as bodyweight. We treat this as sensitive health data.
• Your settings: language, digit style, weight unit and time zone.
• If you turn on activity (optional, off by default): from Apple Health, for each day, your steps, wheelchair pushes, walking and running distance, exercise minutes and the steps in each hour, with your time zone; and the strength sessions you record with the W7SH Watch app (start, end and energy). They give your flame, emblems, step challenges and ranks. Your flame and emblems show on your profile to whoever can see it (any signed-in user, if your profile is public). The people you accept as followers also see your steps today and when your phone last sent them, your weekly and monthly totals among friends, and your emblem and challenge cards. Turning off "Show my flame and emblems" hides all of this. Members of a step challenge see each other's scores in it. Turning activity off deletes all of it.
• If you also add a nickname for the city, country and world boards (optional): the nickname, your country and city (found from your location once, when you tap; the coordinates are not kept), and your days at the goal and steps. Other users see them with your nickname and country only. Leaving those boards deletes the nickname and place.
• If you set up a public profile (optional): your username and shown name, who you follow and who follows you, the workouts you choose to share (a summary your phone makes: title, length, volume, exercises and best sets, with your caption), likes and flames on posts, the nudges you send and receive, the friends you invite with your link, the programs you publish and your program ratings. Your profile is private unless you make it public, and only people you accept see your posts.
• Reports you send, and who you have blocked, so we can protect the community and review reports.
• Exercise requests you send (the exercise name you type), so we can add it to the library. Deleted with your account.
• If you connect WHOOP (optional): your WHOOP access keys (encrypted) and, for each day, the summary WHOOP shares: recovery score, heart rate variability, resting heart rate, skin temperature, sleep (performance, hours, consistency, efficiency), day strain, energy and heart rate. W7SH only reads from WHOOP and never writes to it. You can disconnect at any time in the app; deleting your account deletes all of it.
• If you allow notifications: your device's push token, to send you challenge results, nudges from friends and the evening flame reminder. At most two social notifications a day, and none between 10 pm and 7 am. The token is removed when you sign out on that phone.
• To keep the boards fair, the app asks Apple's App Attest to confirm that activity comes from the real W7SH app on a real iPhone. We keep only that key's public part and a counter; the attestation identifies no person.
• Short-lived technical logs at our providers, such as IP addresses, to run and protect the service.

What we do not collect

• No advertising identifier and no tracking. We never keep your location coordinates. Apple Health data stays on your phone and is never used for ads, except the activity above if you turn it on, and your body weight if you turn on reading it: it joins your body-weight log and syncs like a weight you log yourself.
• If you turn on saving workouts to Apple Health, your phone writes each workout you finish (its type, start and end, with its volume and how many sets and exercises) to Health on your device. It does not pass through our servers.
• CSV files you import from other apps are read on your phone and not uploaded. Share cards are drawn on your phone.
• Gym check-in codes stay on your phone: never synced, not in your export, deleted with your account.
• Progress photos stay on your phone (and in your iPhone backup, if you use one): never uploaded to our servers or synced, deleted with your account. Only what you choose to share leaves it.
• If you use your data with an AI assistant on your computer (W7SH's small server), it reads your export file there and sends nothing to us.

Who processes it for us

• Supabase: database and sign-in, on servers in Frankfurt, Germany.
• Resend: sends your sign-in code.
• Google: only if you continue with Google, to confirm who you are when you sign in.
• Cloudflare: delivers exercise videos (needs none of your personal data).
• WHOOP: only if you connect your account, to read the daily summary above.
• Expo (650 Industries): passes notifications on to Apple, if you allow them (your push token and the message).
• Apple: delivers notifications, and checks that uploads come from the real app (App Attest).
• Vercel: hosts this website (standard request logs, such as IP addresses, kept for a short time).
• Any new provider, such as crash reporting, is added here before it is used.

Why we use it, and on what basis

• Your account, and syncing your training between your devices: to provide the service you asked for under our terms.
• Your training log, body measurements, activity, Watch sessions and WHOOP data are health data, a sensitive category under Saudi Arabia's Personal Data Protection Law: we process them only with your explicit consent, asked for in the app before anything is collected, and only for the features you turned on. You can withdraw it at any time by turning the feature off or deleting your account.
• Your public profile, posts, challenges, nudges and invites: because you chose to use them.
• Notifications: with the permission you give in iOS.
• Reports, blocks, App Attest and technical logs: to keep W7SH safe and fair and to meet the law. Never with your health data.
• We never use your data for ads, never sell it, and never use Apple Health data for anything but the features above.

Where it is kept, and how it is protected

• On your phone first, with a copy on servers in Germany (EU). Under Saudi Arabia's Personal Data Protection Law we ask for your explicit consent to process your health data and to transfer it outside the Kingdom before we store it, and our providers process it only on our instructions, under their data protection agreements.
• Your data travels encrypted (TLS) and is stored encrypted on our servers. Only the systems that run the features above can read it, and each person reaches only their own data and what others chose to share with them.

How long we keep it

• Your account, training log, settings, profile and posts: until you delete them or your account.
• Activity, emblems, Watch sessions and the App Attest key: until you turn activity off or delete your account. Your board nickname and place: until you leave those boards.
• Notifications: sent within 12 hours or dropped, and deleted after 7 days. Nudges: 30 days. Your push token: until you sign out on that phone or delete your account.
• WHOOP data: until you disconnect WHOOP or delete your account. Blocks: until you unblock. Reports: as long as needed to review them and protect the community.
• Technical logs: a few days at our providers. Deleting your account removes your data from our servers at once, and from backups when their period ends.

Your rights

• To know: this policy says what we collect, why, and for how long.
• Access and copy: export all your data from Settings as CSV or JSON.
• Correct: edit anything you logged at any time.
• Delete: delete your account from Settings; it is removed from our servers at once, and from backups within their retention period.
• Withdraw consent: turn off activity, leave the boards or disconnect WHOOP at any time, and what each one collected is deleted. Turn notifications off in iOS to stop them; signing out removes the token.
• We answer requests within 30 days. You can also complain to the Saudi Data and AI Authority (SDAIA).
• Questions, or to use your rights: w7sh.app@gmail.com

Children

The app is not directed at children under 13. If you are under 18, use it with a parent's or guardian's agreement.

If something goes wrong

If a security incident puts your data at risk, we notify the Saudi Data and AI Authority and, where it could harm you, you, as the law requires.

Changes

We announce changes here and in the app before they take effect. Last updated: 2026-10-15.