Privacy Policy · Ægir Iron

1. Introduction

Ægir Labs, LLC ("Ægir Labs," "our," or "us") operates Ægir Iron (the "App"). This Privacy Policy explains how Ægir Labs collects, uses, and protects your information when you use our App.

2. Information Collected

Information you provide directly:

Name and email address (account registration)
Training data including exercise logs, bodyweight entries, and personal records
Competition and meet results
Readiness and recovery data
Pain, when you give it as the reason for swapping an exercise
Feedback you choose to share (for example, responses to a survey sent to you, or support messages)
Community forum content, if you choose to use the forum: the threads and replies you post, the forum display name you pick, the list of users you have blocked, and any reports you submit
Coaching records, if you coach or are on a coach's roster: appointments a coach schedules with an athlete (the time, type, place or call link, and any note), the payment records a coach keeps (the rate they set, and the date, amount and method of each payment they log), and the private notes a coach keeps about each athlete (a summary, injuries and limitations with the exercises to avoid, availability changes, preferences, and dated notes)

Information collected automatically:

Basic usage data through Firebase (Google Cloud Platform)
Technical information about your browser or device, checked by Google reCAPTCHA Enterprise when the App starts and from time to time while it is open, to confirm that requests to our servers come from the genuine App (see Section 5)
Authentication tokens required for account security
Anonymous usage analytics through Vercel Analytics, including page views and interactions (used on both our marketing website and the App)
Approximate location derived from IP address (used by Vercel Analytics for aggregate reporting)
Advertising conversion measurement on our marketing website (aegirlab.com) through the Google Ads tag, so Ægir Labs can tell which ads led to a visit or a sign-up

Vercel Analytics is cookieless and does not track you across other websites.

About the Google Ads tag: it runs only on our marketing website. It does not run inside the App, and it never has access to your training data, your health data, or anything you enter while signed in. It records that a visit to our site came from one of our ads, and may set a first-party cookie on aegirlab.com for that purpose. Ads personalization is turned off, so the tag is not used to build remarketing or interest-based advertising audiences from your visit. If you are in the EEA, the UK, or Switzerland, the tag runs with all storage denied by default: no cookies or advertising identifiers are stored, and Google receives only an anonymous, cookieless signal. Ægir Labs does not use Google Analytics, session replay tools, or cross-site tracking cookies on our website or in the App.

Payment information: Ægir Labs does not store payment information directly. On the web, payment processing is handled by Stripe, Inc.; please review Stripe's Privacy Policy at stripe.com/privacy. On iOS, subscriptions are processed by Apple via the App Store, with subscription state tracked through RevenueCat; please review Apple's Privacy Policy at apple.com/legal/privacy and RevenueCat's at revenuecat.com/privacy.

Coaching records: a coach can schedule appointments with an athlete on their roster and keep a record of what each athlete pays them. Ægir Iron does not process those payments. Money moves directly between coach and athlete through whatever service they already use, and the App stores only what the coach enters. An athlete always sees the appointments scheduled with them. Payment records are visible only to the coach unless the coach chooses to show each athlete their own record. Deleting the coach's account removes all of these records. Deleting an athlete's account removes the appointments scheduled with them, but the payment records their coach logged (the athlete's name, and the amount, date and method of each payment) stay in the coach's account as the coach's own business record, visible only to the coach, until the coach removes them or deletes their own account. To ask for those records to be removed, contact your coach. A coach can also keep private notes about each athlete on their roster, which can include injuries and limitations. Those notes are visible only to the coach, never to the athlete, and are deleted when the athlete leaves the coach's roster or is removed from it, or when either account is deleted. An athlete who rejoins starts with no notes.

3. How Your Information Is Used

Provide and maintain the App
Enable coach-athlete connections and program delivery
Send transactional emails (password resets, session notifications)
Send occasional emails about Ægir Iron: a training nudge when you have not logged a session for a while (it may mention your recent training, such as a personal record), product announcements, and now and then a request for feedback. You can turn off the nudges and announcements under Settings & Support, Training Nudge Emails, or with the unsubscribe link in those emails, and you can stop feedback requests by replying to one.
Understand aggregate usage patterns to improve the App
Develop new features
Measure how well our advertising works, on our marketing website only

Ægir Labs does not sell or rent your personal information, and does not give third parties your training data, your health data, or your account details for their own marketing. The one exception to the word “share” is narrow and described in Section 2: our marketing website tells Google Ads that a visit followed one of our ads, so Ægir Labs can see which ads work.

4. Data Storage and Security

Your data is stored securely on Google Firebase (Google Cloud Platform). Ægir Labs implements industry-standard security measures including encrypted connections and Firebase security rules to protect your data from unauthorized access.

5. Third-Party Services

Google Firebase: database and authentication
Stripe: payment processing (web)
Apple App Store / RevenueCat: payment processing (iOS)
Resend: email delivery (transactional emails, training nudges and feedback requests)
Vercel: website and application hosting, and anonymous usage analytics
Sentry: crash and error reporting, which may include your account identifier and technical details about the error and your device
Upstash: rate limiting, which processes your IP address transiently to prevent abuse
Google reCAPTCHA Enterprise: abuse prevention, through Firebase App Check. It confirms that requests to our servers come from the genuine App by analysing technical information about your browser or device and how it interacts with the page, and may set a cookie on google.com for that purpose. It never receives your training or health data. Google states that it uses this information to provide and improve reCAPTCHA and for general security purposes, and not for personalized advertising.
Google Ads: advertising conversion measurement on our marketing website only, as described in Section 2. Not used in the App.
Strava: optional, user-initiated activity sharing (see Section 6 below). Only used if you connect Strava yourself.
Apple Push Notification service: optional push notifications on iPhone, off until you turn them on. We store that device's push token and send the text of your in-app notifications (for example, that your coach programmed a session) through Apple to deliver them. Turning push notifications off, signing out on that device, or deleting your account removes the token.
Anthropic: the AI provider behind Ægir Assistant Coach (optional, off until you enable it), Captain Ægir (the free helper), and the Convert with AI step of the training history importer. It receives only what you send through one of those features (see Section 6a below).

5a. Community Forum (Optional)

The app includes an optional community forum. Posting is not required to use the app, and nothing you write anywhere else in the app is ever published to it.

Forum posts are public to other users. Any thread or reply you post can be read by every signed-in user of Ægir Iron. A post shows the forum display name you choose. It does not show your legal name, your email address, or any of your training, health, or account data, and other users cannot reach that data from your post. If you choose to type training or health information into a post, you are making that information public yourself.

Moderation. Posts are screened automatically before publication and some are held for human review. You can report a post or block another user from the menu on any post; a block hides that person's content from you and is undone in Settings. Reports are reviewed by a person, ordinarily within one business day, and include the reporting user's identity so Ægir Labs can act on abuse of the reporting system itself. Ægir Labs does not tell the reported user who reported them. Removed posts remain stored, not visible, so that repeat problems can be handled.

Deleting your account. Deleting your account removes your forum replies outright. A thread you started is removed too if nobody replied to it; if other people did reply, the thread is stripped of your text, your display name and every link to your account, and their replies remain, because those are their words and not ours or yours to withdraw. Reports you filed, and reports filed about your content, are deleted with your account.

Full rules are in the Community Guidelines, reachable from the forum itself.

6a. AI Features

The app offers an optional in-app AI assistant, Ægir Assistant Coach, that is off until you enable it. When it is enabled and you send a message, the text you type plus the training context needed to answer it (such as your recent logs, training maxes, your programmed sessions, analytics summaries, and the exercise catalog) is sent to Anthropic, PBC to generate the response.

This only happens while the feature is enabled and you are actively using it; nothing is sent automatically. Your inputs are not used to train Anthropic's models. Once your message is processed, Anthropic's handling of it is governed by Anthropic's Privacy Policy. You can stop all of this at any time by disabling the feature in the app's Settings, which is also its default state. Disabling it does not cancel the paid add-on; you can manage or cancel that separately.

Ægir Labs does not store your conversations with Ægir Assistant Coach. The chat is held in your device's memory only while the app is open, and is cleared when you reload or close the app, start a new chat, or sign out. It is never written to your device's storage or to our database.

Captain Ægir, the free helper behind the round button, also uses Anthropic. When you ask him something, your question, the earlier messages in the same conversation, and the help articles the app picked to answer it are sent to Anthropic, PBC to write the reply. Nothing from your training history, your email or your roster is sent. Captain needs no setting turned on; if you would rather your questions were not sent, use Help & FAQ instead. Ægir Labs keeps a copy of each question (not the reply) for up to 180 days to find what the help pages are missing. That copy is labelled with a code derived from your account instead of your account ID, and it is deleted when you delete your account.

Convert with AI, in the training history importer, sends the training log you paste and the names in our exercise catalog to Anthropic, which reshapes the log into the importer's columns. It runs only when you tap Convert with AI, nothing is saved until you review the result and confirm the import, and Ægir Labs does not keep the pasted text. Looking up a glossary term in a language the app does not have built in sends the term and the language, and nothing about you. In every case your inputs are not used to train Anthropic's models.

6. Strava Integration (Optional)

The app offers an optional, one-way integration with Strava that is off until you connect it. If you connect your Strava account and then choose to share a specific workout, Ægir Labs sends that workout's training data (its exercises, sets, weights, total volume, and any personal records) to Strava to create an activity on your Strava feed.

This sharing is manual and one-way: it happens only when you tap Share for a given workout, nothing is shared automatically, and Ægir Labs never reads your activities or any other data from Strava. To keep the connection active without asking you to sign in each time, Ægir Labs stores your Strava authorization tokens in encrypted form on our servers. Once data is on Strava, it is governed by Strava's Privacy Policy. You can disconnect Strava at any time in the app's Settings, which deletes the stored tokens; deleting your account also removes them.

7. Apple Health Integration (iOS only)

The iOS app offers an optional, read-only integration with Apple Health, off by default. When you turn it on in Settings → Apple Health, the app:

Reads your most recent body weight sample from Apple Health and uses it to pre-fill the bodyweight field on your training log so you don't have to type it twice.
Reads last night's sleep data from Apple Health and uses it to pre-fill the Sleep readiness slider on your training log. Both your in-bed time and asleep stages (Core, Deep, REM) are summed locally on your device into a 0 to 100 score; only the resulting score is shown in the app, and it is editable. When you save the log, the slider's value is saved with it like any other readiness answer.

The app does not write workouts, calories, or any other data back to Apple Health. Apple Health data is read only on your device. Your Health records stay on your device, and Ægir Labs never sends Health data to third parties. What reaches our servers is what you would otherwise have typed: the number in the bodyweight field and the value on the Sleep slider are saved with your training log when you save it, whether or not you changed them. When you turn the integration on, the app also saves your latest body weight reading and the date you connected to your profile, where Settings shows them. You can revoke our access at any time via the iOS Health app → Sharing → Apps → Ægir Iron, and you can disable the integration entirely from Settings → Apple Health within the app.

8. Data Retention

Ægir Labs retains your personal data and training data for as long as your account is active, except as described under Inactive accounts with no training history below. If you delete your account, Ægir Labs permanently removes all of your personal data, training logs, personal records, programs, and competition history from our active databases within 30 days. Encrypted backups containing the data are rotated out within 98 days.

Inactive accounts with no training history. Ægir Iron is free for individual lifters, and Ægir Labs does not keep personal information it has no reason to hold. If an account has never had a workout logged to it and has not been used for 45 days, Ægir Labs may delete that account and the data associated with it, including any programs created on it. If you have ever logged a workout, Ægir Labs does not delete your account for inactivity, however long you are away. Ægir Labs also never removes an account this way if it is linked to a coach's roster or has held a paid subscription. Deletion is permanent and follows the same process and timelines described above, and you are welcome to create a new account at any time.

The only exceptions are: (a) legally required records (for example, tax records of completed payments, retained by our payment processors for the period required by law); and (b) anonymous, aggregated usage statistics that contain no personally identifying information.

9. How to Delete Your Data

You can permanently delete your account and all associated data at any time, directly from within the App:

Open the App and sign in
Tap More, then Settings & Support
Scroll to the bottom of the Settings page
Tap Delete My Account in the Danger Zone section
Confirm by typing "DELETE" when prompted

This deletes your account, training data, personal records, programs, coach-athlete relationships, and any connected third-party authorizations (such as Strava) from our active systems within 30 days. One exception: payment records a coach keeps about you are the coach's own business records and stay in the coach's account, as Section 2 describes under Coaching records. Stripe, our card processor, deletes your customer record (name, email and saved cards) at the same time, and keeps only the payment records the law requires it to keep. Error reports in Sentry and email delivery logs at Resend are not deleted one by one; they expire under those services' retention settings. Deleted accounts cannot be restored. Individual sessions you delete can be recovered on request for 30 days, after which they are permanently removed. As an alternative, you may email angela@aegirlab.com to request deletion; Ægir Labs will process the request within 10 business days.

10. Your Rights

Access the personal data Ægir Labs holds about you (email angela@aegirlab.com)
Request correction of inaccurate data
Request deletion of your data (see Section 9 above for the in-app process)
Export your training data (available via Excel export from the Progress, History, and Competition pages in the App)

11. Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area (EEA) or the United Kingdom, Ægir Labs processes your personal data under the following legal bases:

Performance of a contract (Art. 6(1)(b)): to create and operate your account and provide the App's core features, including Captain Ægir and Convert with AI, which run only when you use them.
Legitimate interests (Art. 6(1)(f)): to secure the service, prevent abuse, understand aggregate usage, and send the occasional emails described in Section 3, which you can turn off at any time, balanced against your rights and freedoms.
Consent (Art. 6(1)(a)): for optional features you turn on yourself, such as Strava, Apple Health, and Ægir Assistant Coach. You can withdraw consent at any time by disabling the feature.
Explicit consent (Art. 9(2)(a)): for health data, meaning your bodyweight (typed, imported, entered for a meet weigh-in, or read from Apple Health), your readiness check-ins (sleep, soreness, desire to train and stress), pain when you give it as the reason for swapping an exercise, and the estimates the App works out from them. The App asks before collecting any of it, collects none of it if you decline, and works fully either way. You can withdraw consent at any time in Settings under Health Data, which stops collection, and delete what is stored from the same place.
Legal obligation (Art. 6(1)(c)): to keep records Ægir Labs is required by law to retain, such as payment records held by our payment processors.

12. International Data Transfers

Ægir Labs is based in the United States, and the service providers listed in Section 5 (including Google Firebase, Vercel, Stripe, Resend, Sentry, Upstash, and Anthropic) may process your data in the United States and other countries. Where personal data is transferred out of the EEA or the UK, Ægir Labs relies on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) offered by those providers.

13. EEA and UK Data Protection Rights

If you are in the EEA or the UK, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. You can exercise these rights using the in-app tools described in Sections 9 and 10 above, by emailing angela@aegirlab.com, or through the representative named in Section 18. You also have the right to lodge a complaint with your local data protection supervisory authority.

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information Ægir Labs collects and how it is used, to request access to or deletion of that information, and to request correction of inaccurate information. Ægir Labs does not sell your personal information as that term is defined under the California Consumer Privacy Act (as amended by the CPRA), and does not use it for cross-context behavioral advertising: the Google Ads tag on our marketing website measures whether our own ads led to a visit, and ads personalization is turned off so it is not used to target you elsewhere. Ægir Labs will not discriminate against you for exercising these rights. To make a request, email angela@aegirlab.com or use the in-app account controls described in Section 9.

15. Children

The App is not directed at anyone under 16, and Ægir Labs does not knowingly collect personal information from anyone under 16. If you believe someone under 16 has provided us with personal information, please contact us and it will be deleted.

16. Changes to This Policy

Ægir Labs may update this Privacy Policy from time to time. You will be notified of significant changes via email or in-app notification. Continued use of the App after changes constitutes acceptance of the updated policy.

17. Contact Us

Ægir Labs, LLC
4207 SE Woodstock Blvd, PMB #225
Portland, OR 97206
angela@aegirlab.com

18. EU and UK Representatives

Ægir Labs has appointed Prighter Group, with its local partners, as its privacy representative and your point of contact in the European Union (EU) and the United Kingdom (UK), under Article 27 of the GDPR and of the UK GDPR.

Prighter gives you an easy way to exercise your privacy rights (for example, requests to access or erase personal data). To contact Ægir Labs through Prighter, or to make use of your data subject rights, visit https://app.prighter.com/portal/14852269276.

Ægir Labs has also appointed Prighter Group as its legal representative in the European Union under Article 13 of the Digital Services Act (Regulation (EU) 2022/2065). Authorities, users and anyone else with a matter under the Digital Services Act can reach it through the same portal.