Platesmith privacy policy

This policy covers the Platesmith app for iPhone, Apple Watch and Android, its sync service, and this website. Platesmith is made and run by an independent developer based in South Australia, Australia ("we", "us"). We handle personal information in line with the Australian Privacy Principles. Using Platesmith is also covered by our terms of use.

The short version

No ads, no analytics, no tracking, and we never sell your data. It is shared only with a coach if you link one, and with our AI provider if you turn on the AI coach or your linked coach uses AI drafts.
You can use Platesmith without an account. Then nothing you log ever reaches us.
With an account, your log syncs to Platesmith's own server, which we run on Cloudflare. No other backend service holds it.
Anything Platesmith reads from Apple Health or Health Connect stays on your phone. It is never uploaded, synced, backed up or exported.
You can export your data or delete your account from the app at any time.

1. Ways to use Platesmith

Without an account. Everything you log is stored only on your phone (and your Apple Watch, if you use it). The app never sends it to us. If you delete the app without a backup, the data is gone.
Sign in with Apple. Creates a Platesmith account on our server so your log syncs and survives a lost or replaced phone. Apple tells us a random identifier for you, unique to Platesmith, and, on your first sign-in only, the name you choose to share. We do not ask Apple for your email address.
Sign in with Google. Creates a Platesmith account the same way. Google tells us an identifier for you, your Google email address and the name on your Google account. We use the email only to show which account you are signed in with and, if you also have a Platesmith email account with the same confirmed address, to recognise it as yours. We do not get access to your Gmail, contacts or anything else in your Google Account.
Email and password. Creates an account keyed on your email address. We store your email and a salted hash of your password, never the password itself. Your email is used only to sign you in and to send account emails, such as a code to confirm the address or reset your password, never for marketing.
A passkey. Creates an account, or adds a way into the one you have, that you open with Face ID, Touch ID or your passcode. The passkey's private key stays in your iCloud Keychain (or the password manager you chose) and never reaches us. We store only its public key, an identifier for it, and when it was added and last used. If you make a new account with a passkey, we also store the name you typed, if any.

The app keeps a full copy of your data on the phone in every case, so it works offline. If you start without an account and sign in later, your existing log is uploaded to your new account.

2. What we store, and why

For an account, our server stores:

Data	Why
Account identifier from Apple or Google, your Google email address, or your email and password hash; whether you confirmed your email; the name you shared, if any	To know which log is yours and sign you in
If you signed in with Apple: a token from Apple used only to disconnect Sign in with Apple from Platesmith when you delete your account	So deleting your account also tells Apple
Your training log: programs, workouts, sets, notes, custom exercises, your own exercise cues, your gyms and their equipment, and how sessions felt	To sync your log between your devices and keep it safe
Your food log, custom foods, saved meals, recipes, meal plans, calorie and macro targets	Same
Daily habits you add and the days you ticked them	Same
Weekly check-ins: your 1 to 5 scores for energy, sleep, hunger, stress, training and food, and any note you add	Same, and so you can look back at how your weeks went
Your answers to the optional health questions in Settings (for example a heart condition, dizziness, a joint problem or prescribed medication), and the date you answered	To suggest checking with a doctor and to keep the advice gentler. Never used for anything else and never shared. If you turn on the AI coach, it is told only whether to keep the plan gentle, never your answers
Body measurements you type into Platesmith, such as bodyweight and tape measurements, and your training phase (for example a cut or a bulk)	Same, and to calculate your targets
Your profile: sex, birth year, height, activity level, goal and experience level	To set your calorie and protein targets and pick suitable programs
App settings, such as units, reminders and appearance	So a new phone is set up the way you left it
If you link a coach: the changes your coach makes, with their notes	To show you what changed and why
If you link a coach: the messages you and your coach send each other	To show your conversation in the app. Kept with your account until you delete it, also after you unlink. Neither you nor your coach can delete a message
If you link a coach: the check-ins your coach sends you, with your answers	To show them in the app and pass your answers to your coach. Kept with your account until you delete it, also after you unlink. Your coach can withdraw a check-in they sent
If you link a coach and allow notifications: a device token for each phone, up to five per account. It is an address Apple or Google issue so a notification can reach that phone, and says nothing else about you	To tell you when your coach changes something or messages you. Removed when you unlink, sign out on that phone or delete your account
If you turn on the AI coach: the date you agreed and which version of the wording you agreed to, and how much of this month's coaching allowance you have used	To respect your choice, and to keep each person within a fair monthly allowance
If you subscribe to Platesmith Coach: the App Store's or Google Play's identifier for your subscription, which plan it is and when the paid period ends. Apple or Google handles the payment; we never see your card, Apple Account or Google Account details	To know your subscription is active
Passkeys: each passkey's public key and identifier, and when it was added and last used	To check it is your passkey when you sign in
Sign-in sessions: a hashed session token and its start and expiry dates. A session lasts up to a year unless you sign out	To keep you signed in and let you sign out
For email accounts, a hashed six-digit code while a confirmation or password reset is in progress, deleted once used or within a day	To check the code you type

Data you log is used only to run Platesmith for you. Nobody else sees it unless you link a coach (below), and we do not look at individual logs except when you ask us for help with your account.

Linking a coach

If you work with a coach on Platesmith Coaching, our coaching service, they can give you a one-time code to enter in Settings > Coach. Before anything is shared, the app shows you the coach's name and what they will see. Once linked:

Your coach sees, as the app lists before you confirm: workouts and cardio you log; your programs and meal plans; food you log; weigh-ins and body measurements you enter in Platesmith; your phase and macro targets; your weekly check-in answers; and your profile (height, age, sex, goal, level). To show these, your custom exercises and foods and your units and activity level go with them.
Your coach also gets the messages you send them and your answers to the check-ins they send you.
Your coach can change your program, meal plan, phase and calorie and macro targets. Each change shows in the app with a note saying what changed.
If your coach uses AI drafts in Platesmith Coaching, a summary of what you share with them, without your name or email, goes to Anthropic in the United States to write a draft that your coach reads and edits. The Platesmith Coaching privacy policy covers it.
Nothing read from Apple Health or Health Connect is ever shared, and neither are your health-question answers, habits or progress photos.
You can unlink at any time in Settings > Coach, and deleting your account also ends the link. After unlinking, your coach sees nothing new from you.
What was already shared with your coach (for example workouts, weigh-ins, food logs, check-ins and messages) stays in your coaching record on Platesmith Coaching after you unlink or delete your Platesmith account, because it is part of your coaching history. The Platesmith Coaching privacy policy covers it, and you can ask your coach or privacy@platesmith.app to delete it.

The AI coach

Platesmith Coach, an optional subscription, includes an AI coach. It can pick your plan, write a weekly review of your week, give you a short brief before a workout and a debrief after it, and answer your questions in a chat. It is off until you turn it on, and the app asks for your agreement first. Only when you use one of these does the app send a summary to Anthropic, the AI company that runs the coach's model, through our server. Anthropic is based in the United States and may process the summary there or in other countries where it runs its service. Depending on what you asked for, the summary can include:

your sex, age, height and the bodyweight you logged or typed in Platesmith, your activity level, and whether you answered yes to any of the health questions (not which one);
your goal, experience, current phase, daily targets and program, and your answers in the plan questions (days and time to train, equipment, goal weight and date, areas to go easy on, how you eat);
summaries of your log: workouts done, the exercises in a session with their planned and last sets, personal bests and how your main lifts moved, average calories and protein over the week, and your weight trend from the weigh-ins you logged in Platesmith;
any joint pain you note after a workout, your weekly check-in scores (energy, sleep, hunger, stress, training and food) and the check-in note, and anything you type to the coach, including your chat messages.

It never includes your name, email address, account identifiers, photos, individual food entries, or anything read from Apple Health or Health Connect. Anthropic processes it to write the coach's answer and doesn't use it to train its models. It keeps it only for a limited time under its commercial terms, to run and protect its service. Our server passes each request on and records only how much of your monthly coaching allowance it used, not what was asked or answered. Your chat with the coach and its last weekly review are kept only on your phone; you can delete the chat in the app, and deleting your account or the app removes them.

The coach chooses only between options Platesmith offers and never sets numbers itself: your calories, macros, weights, sets and reps still come from Platesmith's own rules, and nothing changes until you accept it. If you link a human coach, the AI coach is switched off. You can turn the AI coach off at any time in Settings, and nothing more is sent.

To limit abuse, the server counts recent requests from each network address in memory. These counts are not written to disk and are cleared within minutes.

3. Where account data lives

Platesmith's server runs on Cloudflare, a US company, on its Workers platform. Your account data is stored in Cloudflare's database, encrypted at rest, in its Oceania region. No other backend service (such as Firebase or Supabase) stores it. Cloudflare keeps 30 days of point-in-time backups so data can be restored after a fault.

Connections to the server are encrypted in transit and pass through Cloudflare's network, which also protects it against attacks. On the way, traffic may pass through Cloudflare's servers in Australia or other countries.

4. Apple Health

Connecting Apple Health is optional and off until you turn it on. iOS asks which categories to allow, and you can change that at any time in the iPhone's Settings.

Writing: Platesmith can save your finished workouts and the bodyweight you log to Apple Health.
Reading: Platesmith can read your bodyweight from Apple Health to show your trend, and, if you switch it on, your steps, sleep, resting heart rate and heart rate variability to show them next to your training.

Data read from Apple Health stays on your iPhone. It is never sent to our server, never synced to your account, never included in iCloud Drive backups or exports, and never used for advertising or shared with anyone. Health data is used only to show you your own training.

4a. Health Connect (Android)

On Android, Platesmith can connect to Health Connect instead of Apple Health, and the same promise applies. Connecting is optional and off until you turn it on. Android asks which categories to allow, and you can change that at any time in Health Connect's settings on your phone.

Writing: with your permission, Platesmith can save your finished workouts (with the energy burned and, for cardio, the distance) and the weigh-ins you log to Health Connect.
Reading: with your permission, Platesmith can read your weight, steps, sleep, resting heart rate and heart rate variability to show them next to your training. Health Connect normally shares only the last 30 days; if you allow it separately, Platesmith can also read your earlier history.

Data read from Health Connect stays on your phone. It is never uploaded to our server, never synced to your account, never included in backups or exports, never sent to the AI coach, and never used for advertising or shared with anyone. It is used only to show you your own training.

5. iCloud Drive backups and export

Without an account, you can turn on a backup that saves a file to your own iCloud Drive. The file is stored by Apple under your Apple Account and Apple's terms; we cannot see or open it. You can also export your data to a file (a backup file, a spreadsheet or a PDF) at any time and import it again on another phone, and import workout history from other apps such as Strong, Hevy and FitNotes. Backups and exports never contain data read from Apple Health or Health Connect.

6. Camera, photos, notifications, widgets and the Watch

Camera: used only to read food barcodes. Images are processed on the phone and never stored or uploaded.
Progress photos: you pick them from your photo library. They are kept only in Platesmith's storage on your phone, never uploaded to our server, never synced to your account and never included in backups or exports. They are deleted when you delete them or the app.
Notifications: the rest timer and reminders are scheduled on your phone. The Lock Screen and Dynamic Island rest timer is a Live Activity that runs on the phone. If you link a coach, when your coach changes something or messages you, our server asks Apple or Google to show a notification with generic words only (such as "New message from your coach"), never the message or the plan.
Widgets and share cards: Home Screen and Lock Screen widgets show your next workout, streak and food totals, taken from the app on your phone (never from Apple Health). A workout share card is an image made on your phone and only goes where you choose to share it.
Apple Watch: the Watch app talks only to your iPhone.

7. Services Platesmith talks to

Apple, for Sign in with Apple, passkeys (through iCloud Keychain), Apple Health, iCloud Drive backups, the App Store and, if you link a coach, notifications about their changes and messages. Apple's own privacy policy applies to those.
Google, if you choose Sign in with Google, and on Android for Health Connect and Google Play. Google's own privacy policy applies to those.
Anthropic (anthropic.com), only if you subscribe to Platesmith Coach and turn on the AI coach, as described in The AI coach, or if your linked coach uses AI drafts, as described in Linking a coach. Anthropic's own privacy policy and commercial terms apply to what it receives.
Resend (resend.com), the email delivery service that carries account emails for email accounts. It receives your email address and the email's text (your code) in order to deliver it, and nothing from your log. Resend is a US company; our account is hosted in its Japan region, so those emails pass through servers there.
Open Food Facts (openfoodfacts.org), an open food database. When you scan a barcode that isn't in Platesmith's built-in food list, the app sends that barcode number to Open Food Facts to look up the product. Nothing else about you is sent. Searching foods by name uses the built-in list and stays on the phone.
YouTube. Exercises have a "Watch on YouTube" link. Nothing is sent to YouTube unless you tap it, and then YouTube's own privacy policy applies.
Cloudflare, which runs our server and this website and stores account data, as described in Where account data lives.

Platesmith contains no third-party analytics, advertising, crash-reporting or tracking code. If you have chosen to share crash reports with app developers in your iPhone's settings, Apple sends us anonymous crash reports; you can turn that off in Settings, Privacy & Security, Analytics & Improvements.

8. What we never do

Show ads, or sell, rent or trade your data.
Track you across other companies' apps or websites, or use device fingerprinting.
Share your data with data brokers or advertisers.
Use your log to train AI models, or let our AI provider train on what the AI coach sends it.

We would disclose data only if Australian law required it, and we would tell you unless the law forbade that.

9. Deleting your data

With an account: in the app, open Settings and, under Account, tap Delete account and data. This deletes your account and everything synced to it from the server immediately and permanently. Remaining copies in daily encrypted backups expire within 14 days; a monthly backup copy can hold it for up to six months and is only ever used to rebuild the server after a failure. Your data on the phone stays until you delete the app. If you linked a coach, see Linking a coach for what they keep. Deleting your account doesn't cancel a Platesmith Coach subscription: cancel it in the iPhone's Settings, under your name, then Subscriptions, or on Android in the Play Store, under Subscriptions. We keep the App Store's or Google Play's identifier for the subscription, with how much of each month's coaching allowance it used and any periods Apple or Google refunded, after the account is gone, linked to nothing else about you, so a subscription can't be used to get the allowance or a refunded period twice.
Without an account: delete the app. Delete any backup file from iCloud Drive in the Files app.
Sign in with Apple: you can also stop using your Apple Account with Platesmith in the iPhone's Settings, under your name, then Sign in with Apple.
Sign in with Google: you can also remove Platesmith's access at myaccount.google.com, under Security, Your connections to third-party apps and services.

If you can no longer reach the app, email us and we will delete your account for you once we have confirmed it is yours. The Delete your account page has the steps.

10. Your rights

You can see and export everything Platesmith holds about you from inside the app. You can also ask us for a copy of your data, to correct it, or to delete it, by emailing privacy@platesmith.app. We reply within 30 days. If you live in the EU, UK or another place with similar laws, you have these same rights under your local law. If you are unhappy with how we handled a privacy request, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.

11. Security

All connections are encrypted (HTTPS).
Passwords are stored only as salted scrypt hashes. Session tokens are stored only as hashes, so a copy of the database would not let anyone sign in as you.
Server backups are encrypted before they leave the machine.
Your phone keeps your sign-in in the iOS Keychain.

No system is perfectly secure. If a breach ever put your data at risk, we would tell you and the regulator as the law requires.

12. Age

Platesmith is for adults aged 18 and over, and the app asks for your date of birth when you start. If you are under 18, the app stops there and deletes any account you just made. We do not knowingly collect data from anyone under 18. If you believe a child is using Platesmith, email us and we will delete the account.

13. This website

platesmith.app is a set of plain pages served from the same machine as the app's server. The pages outside /coaching set no cookies, run no scripts, load nothing from other sites, keep no visitor logs, and have no forms. Platesmith Coaching, at platesmith.app/coaching, is a separate web app for coaches with its own privacy policy; it uses its own functional cookies, including one that remembers a campaign tag in a link (for example ?ref=client-invite) for 30 days. Cloudflare carries the traffic, as above, so it sees your IP address and the page you asked for, and your browser may report failed page loads to Cloudflare so they can spot network problems.

14. Changes and contact

If this policy changes, we will update the date at the top. If a change affects how your data is used, we will tell you in the app before it takes effect.

Questions or requests: privacy@platesmith.app. For help with the app, see support.

Privacy policy