Mainstay — Privacy Policy

Effective Date: August 27, 2026 · Policy Version 1.2

Mainstay ("the App") is a personal AI fitness coach for iOS and Apple Watch, operated by ALC SFR LLC, a Wyoming limited liability company, doing business as Mainstay ("we," "us"). This policy explains what data we collect, how we use it, and your rights. The short version: your data is used to coach you, never to advertise to you, and never sold.

1. Health & Fitness Data (Apple HealthKit)

The App reads and writes the following HealthKit data types with your explicit permission:

• Read: Steps, walking and running distance, active calories burned, exercise minutes, heart rate, resting heart rate, heart rate variability, sleep, VO2max, body mass, and workout history, including workouts recorded by other apps, which are imported into Mainstay when they are 20 minutes or longer. You can delete an imported workout from the App at any time.
• Write: Workout sessions (type, duration, calories burned), heart rate samples recorded during workouts, walking/running distance and cycling distance recorded during cardio sessions, and workout routes for outdoor cardio (see Section 2).

HealthKit data is used solely to personalize your workout plans, track your fitness progress, and display performance metrics within the App. We do not use HealthKit data for advertising, marketing, or similar services, and we do not sell, share, or transfer it to any third party for advertising, marketing, use-based data mining, or data brokerage purposes. Summary health metrics derived from HealthKit (such as sleep duration, resting heart rate, heart rate variability, and body weight) are stored securely on our servers to personalize your coaching, and are permanently deleted when you delete your account. Raw HealthKit samples remain on your device and in Apple Health.

2. Location & Workout Routes (Outdoor Cardio)

If you record an outdoor run, walk, or hike, the App uses your device's GPS to measure distance, pace, and your route, with your explicit location permission.

• Route maps (GPS coordinates) are stored in Apple Health on your device. We do not upload your GPS coordinates or route maps to our servers.
• Our servers receive only summary metrics for each cardio session: activity type, duration, distance, average pace, heart rate summary, and calories. These power your workout history, progress, and coaching.
• Location is used only while recording an outdoor workout. We do not track your location outside of workouts, and we never use location for advertising or profiling.

3. Account Information

When you sign in with Apple, we receive your Apple-provided user identifier and, optionally, your name and email address. This information is used to create and authenticate your account.

4. Workout & Training Data

Your workout plans, exercise logs, sets, reps, weights, and messages you send to the AI coach are stored on our servers to enable AI-powered coaching, progression tracking, and cross-device sync. This data is associated with your account and is not shared with other users.

5. AI Coaching

When you use the AI coach feature, your training history, profile (such as goals, experience level, and injury notes you provide), and messages are sent to our servers to generate personalized advice. We use Anthropic's Claude API to power these responses. Your data is processed under Anthropic's commercial API terms, which prohibit using customer data for model training. Do not include information in coach chat that you do not want processed for coaching purposes.

We store the exact prompt we sent to the model and the response it returned for each AI-generated workout and coach reply. This is what lets us check whether the coaching you received was any good and fix it when it was not. During the beta, the founder reads this material personally — see Section 12.

6. Notifications

With your permission, we send push notifications through Apple's notification service (for example: your weekly plan is ready, a personal record celebration, or a coach check-in). Notification delivery uses a device token that identifies your device, not your health data. You can turn notifications off anytime in iOS Settings.

7. Analytics & Crash Reporting

We use the following third-party services to improve app quality:

• Sentry — Crash reports and error diagnostics. Configured to exclude personal health values.
• PostHog — Product analytics, session recordings, and AI observability. Three distinct things:
  • Usage analytics — screen views, feature usage, and funnel events such as "workout completed". These describe what you did in the App, not your health measurements, and exclude personal health values such as weights lifted, heart rate, or body metrics.
  • Session recordings — a replay of your screens as you used the App, so we can see where the App confused you. Every text field you type into and every image is masked on your device before the recording is sent, so the text of your injury notes, weights, and coach messages does not appear in the recording.
  • AI observability — the prompts and responses behind your generated workouts and coach conversations, so a generation can be traced end to end. Unlike the recordings, this does include the full text of your coach conversations and the profile details used to generate your training.
  Session recordings and AI observability are enabled during the beta.

We do not use third-party advertising SDKs, and we do not track you across other companies' apps or websites.

8. Service Providers

We share data only with the service providers needed to run the App, under their commercial terms:

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

9. Data Storage & Security

Account and training data is stored on servers hosted by Railway (cloud infrastructure). All communication between the App and our servers uses HTTPS encryption. Authentication tokens are stored in your device's Keychain.

10. Data Retention & Deletion

Your training data is retained as long as your account is active. You can delete your account directly in the App: go to Profile > Delete Account. This permanently deletes your account and all personal data (profile, workouts, progress, health snapshots, and coach history) from our servers immediately. Deletion extends to our processors: when you delete your account we also ask PostHog to delete your person record, your events, your session recordings, and your AI traces (see Section 7). If a processor is temporarily unreachable, deleting your account still completes on our side immediately; the outstanding processor-side deletion is recorded and completed as a manual follow-up. Deleting your account does not cancel an active Apple subscription — manage subscriptions in iOS Settings > Apple ID > Subscriptions. You may also request deletion at any time by contacting us.

11. Your Rights

Depending on where you live (including California), you may have the right to know what personal information we hold about you, to access it, to correct it, and to delete it. You can exercise access and deletion directly in the App (Profile > Delete Account), or by contacting us at the address below. We will not discriminate against you for exercising these rights. Because we do not sell personal information or share it for behavioral advertising, there is nothing to opt out of.

12. Beta Testing (TestFlight)

If you use a beta version of the App through Apple TestFlight, Apple provides us with beta feedback you choose to send (including screenshots and crash logs) under Apple's TestFlight terms. Beta builds may collect additional diagnostic detail to help us fix problems. Beta data handling otherwise follows this policy.

Founder review. During the beta the founder personally reads beta testers' coach conversations, the workouts the AI generated for them, what they trained against those workouts, and the feedback they left. This is manual review of an individual account, not an anonymous aggregate, and it is how the coaching gets judged and fixed at this stage. Session recordings and AI traces described in Section 7 are enabled for the same reason.

13. Children's Privacy

The App is not directed at children under 17, and our beta program is limited to adults 18 and older. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the App or via email, and the version number and effective date above will change.

15. Contact

If you have questions about this privacy policy or your data, contact us at: support@mainstay.fit