Privacy Policy

Privacy Policy

Last Updated: October 9, 2026

Introduction

Welcome to phase.fitness ("we," "our," or "us"), a product of GrowthClan Inc. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our fitness application and services.

Information We Collect

Information You Provide

  • Account Information: Name, email address, password
  • Profile Data: Age, gender, fitness goals, workout preferences
  • Payment Information: Processed by Stripe on the web, or by Apple's App Store on iPhone (we never see or store card details)
  • Workout Data: Exercise routines, sets, reps, weights, and progress tracked through fitness platform integrations
  • Health and Fitness Data: Body measurements (weight, height, body composition), age and sex, one-rep maxes, heart rate, HRV, sleep and recovery, any injuries or limitations you mention, and the training you do, whether you enter it or it comes from an app you connect. This is health data (see "Health Data" below)

Automatically Collected Information

  • Usage Data: App interactions, features used, session duration
  • Device Information: Device type, operating system, unique device identifiers
  • Analytics Data: Aggregated usage statistics to improve our services

Third-Party Integrations

  • Connected Apps: Workout, activity and health data from the apps you choose to connect (see "Connected Apps" below)
  • We only access data you explicitly authorize us to access
  • You can revoke any integration access at any time from your account settings

How We Use Your Information

We use your personal data to:

  • Provide and maintain phase.fitness services
  • Process your subscription payments (Free or Pro)
  • Sync your workout data with authorized fitness platforms
  • Import training data from connected platforms (with your authorization)
  • Generate personalized, periodized workout programs based on your complete training profile
  • Analyze your training load to prevent overtraining and optimize recovery
  • Improve app functionality and user experience
  • Send important service updates and notifications
  • Respond to your support requests
  • Comply with legal obligations

Important: Your fitness data from integrations is used exclusively for generating your personalized programs. We never use this data for advertising, marketing to third parties, or any purpose beyond improving your training experience.

AI and Your Data

phase.fitness uses an AI model to write and adapt your training plan, to review each phase when it ends, and to comment on the sessions you record or import. This section explains what the AI reads, what it never reads, and how you control it.

  • The model: OpenAI. It processes your data only on our behalf and, under its API terms, does not use it to train its models. We don't use your data, or what the AI writes from it, to train, test or improve any AI model either
  • What it reads: your profile and goals, the health data you give us (such as bodyweight and injuries), the sessions you do with phase.fitness on the web, iPhone and Apple Watch, the workouts and activities imported from Hevy, Liftosaur and Intervals.icu, and the parts of Apple Health your plan needs, such as your weight
  • Garmin activities, only if you allow it: the activities your Garmin device records (duration, heart rate, distance) reach the AI only if you turn on "Let the AI use your Garmin activities". We ask separately when you connect Garmin, and it's off until you say yes. You can turn it off anytime in Settings → Garmin: from then on your Garmin activities, and the numbers they added to your other sessions, are left out of what the AI reads. Texts the AI wrote with your Garmin activities say so: "Built in part from your Garmin … activities"
  • Never: Strava data, and sleep, HRV, body battery, stress or other daily health data from Garmin, which we don't collect
  • Consent: we ask for your explicit consent before the AI processes your health and training data ("Before you start"), and separately for your Garmin activities. We record when you gave each consent and for which version of the text
  • Withdrawing consent: the Garmin choice, anytime in Settings → Garmin, without losing your account. The health data consent, as described in "Health Data" below
  • Its limits: the AI's plans and comments are suggestions, not medical advice, and may contain errors. You can change your plan anytime. The AI makes no decision with legal or similarly significant effects on you

Data Sharing and Disclosure

We do NOT sell your personal information. We may share data with:

Service Providers

  • Stripe and Apple: Payment processing (PCI-DSS compliant)
  • OpenAI: The AI model that helps write and adapt your plan receives the parts of your profile, health and training data it needs, such as your goals, your bodyweight and the training you've done. We ask for your consent before the first plan, and separately for your Garmin activities. OpenAI processes them on our behalf and, under its API terms, does not use them to train its models (see "AI and Your Data")
  • Infrastructure: Vercel (hosting), Neon (database), Inngest (background jobs), Upstash (cache and queues) and Clerk (sign-in) process data on our behalf to run the service
  • Connected Apps: When you choose to send a session or a phase to Hevy, Liftosaur, Garmin Connect or Intervals.icu, we send that app your planned training (sessions, exercises, sets and targets)
  • Analytics Services: Aggregated, anonymized usage data only

All service providers are bound by strict data processing agreements and security requirements.

Legal Requirements

We may disclose your information if required by law or to:

  • Comply with legal processes
  • Protect our rights and safety
  • Prevent fraud or security issues

Connected Apps

You decide which apps to connect, and you can disconnect any of them at any time in Settings.

  • Strava: When you choose to post a session you finished, we send it to your Strava feed: its name, type, start time, duration and a description with your exercises and sets. We don't import your Strava activities or profile, and no Strava data reaches an AI model. You connect with your Strava login (OAuth 2.0)
  • Garmin Connect: We receive the activities your Garmin device records (type, start time, duration, distance, heart rate, calories and the device model), to mark your planned sessions as done and to show them in your history, labeled with your Garmin device. We don't collect sleep, body battery, stress, HRV or other daily health data from Garmin. With your consent, which we ask for when you connect or before your first send, we send your planned workouts to your Garmin Connect account, where Garmin processes them under the Garmin Connect privacy notice. Don't send workouts to Garmin Connect if you aren't allowed to upload data to your Garmin Connect account. Your Garmin activities reach the AI only if you allow it (see "AI and Your Data"). You connect with your Garmin login (OAuth 2.0)
  • Apple Health (iPhone and Apple Watch): We read your weight and body composition. On Apple Watch, the sessions you do with phase.fitness are saved to Apple Health as workouts, with heart rate and active calories. You connect by giving permission on your iPhone and on your watch
  • Hevy: We receive your workouts with sets, reps and weights. When you ask, we send planned strength sessions as routines. You connect with an API key from your Hevy account
  • Liftosaur: We receive your workouts with sets, reps and weights. When you ask, we send planned strength phases as programs. You connect with an API key from your Liftosaur account
  • Intervals.icu: We receive your activities, HRV, resting heart rate, sleep, training load and zones. When you ask, we send planned cardio sessions. You connect with your athlete ID and an API key

Purpose: To create and adapt your plan on the training you actually do, to analyze your training load and recovery, to put your planned sessions in the apps you train with, and to post the sessions you choose to Strava.

Apple Health: We read Apple Health data only with the permission you give on your iPhone. We use it only for your plan: never for advertising or marketing, and never sold. The parts your plan needs, such as your weight, reach the AI model that helps write it (OpenAI), which processes them only on our behalf.

Your Control: You can disconnect any app at any time in Settings. We then stop receiving new data. What was already imported stays in your training history unless you ask us to delete it.

Data Processing Safeguards

  • Purpose Limitation: Integration data is used ONLY for generating personalized workout programs
  • No Cross-Sharing: We don't pass the data we receive from one app to another. What goes out to an app is your planned training, and only when you send it
  • No Third-Party Sales: Your fitness data is never sold, rented, or shared with advertisers or data brokers
  • Encryption: All imported data is encrypted in transit (TLS 1.3) and at rest (AES-256)
  • Data Minimization: We only import the minimum data necessary for program generation
  • Retention: Integration data is retained only while your account is active or as long as needed for service continuity

Connection Security

Strava and Garmin Connect use their own login (OAuth 2.0). Hevy, Liftosaur and Intervals.icu use an API key that you create in your account there:

  • We never see your passwords for these apps
  • You grant explicit, revocable permission for specific data access
  • Login tokens and API keys are stored encrypted. Removing a connection deletes them; switching an app off only pauses it
  • You can revoke access at any time, from Settings or from the app itself

Health Data

Some of what you share with phase.fitness is health data: body measurements, heart rate, HRV, sleep and recovery, injuries or limitations you mention, and the training you do. Under the GDPR it is a special category of personal data.

  • Explicit Consent: We process it only with your explicit consent, which we ask for separately when you start ("Before you start"). We record when you gave it and for which version of the text. Your Garmin activities reach the AI only with a further consent, which you can withdraw anytime in Settings (see "AI and Your Data")
  • Purpose: Only to create, adapt and analyze your training plan. Never for advertising, and never sold
  • Withdrawing Consent: You can withdraw it at any time by deleting your account in Settings → Delete account, or by writing to privacy@growthclan.com. We then stop processing it and delete it. Without it we can't build your plan, so your account is closed

Data Security

We take data security extremely seriously and implement enterprise-grade security measures to protect your information:

Infrastructure Security

  • Certified Infrastructure: Hosted on SOC 2 Type II and ISO 27001:2022-certified infrastructure
    • Hosting: Vercel (SOC 2 Type II, ISO 27001, HIPAA, PCI DSS compliant)
    • Database: Neon (SOC 2 Type II, ISO 27001:2022, ISO 27701:2019 compliant)
  • Continuous Monitoring: Multi-layered security architecture with 24/7 threat detection
  • Compliance: Full GDPR, CCPA, and HIPAA compliance standards

Data Encryption

  • In Transit: TLS 1.3 encryption for all data transmission
  • At Rest: AES-256 encryption for all stored data
  • Key Management: Secure key rotation policies using AWS KMS and Azure Key Vault

Access Controls

  • Authentication: Enterprise-grade authentication system (Clerk) with:
    • Strong password enforcement (60-bit entropy minimum)
    • Optional two-factor authentication (2FA)
    • Session management and automatic timeout
  • Authorization: Role-based access control (RBAC) with principle of least privilege
  • Data Isolation: User data is fully segregated and pseudonymized

Security Practices

  • Regular Audits: Annual third-party security audits and penetration testing
  • Vulnerability Management: Continuous scanning and rapid remediation
  • Incident Response: 24/7 security operations center with defined response procedures
  • Access Logging: Comprehensive audit trails for all data access

Data Processing Limitations

  • Purpose Limitation: Your data is used exclusively for generating personalized workout programs
  • No Data Selling: We never sell, rent, or share your personal data for marketing purposes
  • Minimal Data Collection: We only collect data necessary for service functionality
  • Automatic Deletion: Data is automatically purged when no longer needed

However, no method of transmission over the internet is 100% secure. While we implement industry-leading security measures, we cannot guarantee absolute security.

Your Rights and Choices

You have the right to:

  • Access: Request a copy of your personal data
  • Correction: Update or correct inaccurate information
  • Deletion: Delete your account and data yourself, at any time, in Settings → Delete account
  • Data Portability: Export your workout data in standard formats
  • Opt-out: Unsubscribe from marketing communications
  • Revoke Integration Access: Disconnect any fitness platform integration at any time through your account settings or directly through the respective platform
  • Stop AI use of Garmin activities: Turn off "Let the AI use your Garmin activities" in Settings → Garmin, at any time
  • Data Deletion from Integrations: Request deletion of all data imported from fitness integrations

To exercise these rights, contact us at privacy@growthclan.com or manage integration settings directly in your account dashboard.

Data Retention

We retain your data for as long as your account is active. If you delete your account:

  • Account data is deleted from our database right away, and access to your connected apps is revoked
  • Workout history is permanently removed
  • Backup copies are deleted within 90 days
  • Payment records are retained as required by law (typically 7 years)

Cookies and Tracking

We use cookies and similar technologies to:

  • Maintain your login session
  • Remember your preferences
  • Analyze app usage (with your consent)

You can manage cookie preferences through our cookie consent banner.

Children's Privacy

phase.fitness is not intended for users under 13 years old. We do not knowingly collect data from children under 13. If we discover such data, we will delete it immediately.

International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure adequate protection through:

  • Standard contractual clauses
  • The EU-U.S. Data Privacy Framework, where the recipient is certified
  • Equivalent data protection measures

Changes to This Policy

We may update this privacy policy periodically. We will notify you of significant changes via:

  • Email notification
  • In-app notification
  • Updated "Last Updated" date at the top of this policy

Continued use of phase.fitness after changes constitutes acceptance.

Third-Party Links

Our app may contain links to third-party services. We are not responsible for their privacy practices. Please review their policies separately.

Contact Us

For privacy-related questions or requests:

GrowthClan Inc.
Email: privacy@growthclan.com
General Inquiries: info@growthclan.com
Address: 2261 Market Street, San Francisco, CA 94114, United States
EIN: 37-2173633

Legal Basis for Processing (GDPR)

For EU/UK users, we process your data based on:

  • Contract Performance: Providing phase.fitness services
  • Explicit Consent (Art. 9(2)(a)): Health data, including data from connected apps
  • Consent: Analytics, marketing, third-party integrations
  • Legitimate Interests: App improvement, fraud prevention
  • Legal Obligations: Tax, accounting, legal compliance

California Privacy Rights (CCPA)

California residents have additional rights:

  • Right to know what personal information is collected
  • Right to deletion
  • Right to opt-out of sale (we don't sell data)
  • Right to non-discrimination

Contact us to exercise these rights.

Governing Law: This policy is governed by California law.

Questions? We're here to help. Contact us anytime at privacy@growthclan.com.