Privacy

What we collect

VeraForma is a coaching app. To coach you it has to know things about you, and most of what it knows is what you type in or record. Nothing is collected in the background that you have not entered or done in the app.

The one thing the app notes as you go is a short list of the screens you visited, the buttons you tapped and any errors it hit, so that a bug report can say what happened. That list stays on your device and leaves it only if you send a bug report.

Your account

Your email address and a password. The password is never stored as typed; it is hashed with a per-user salt (PBKDF2-SHA256, 120,000 rounds). A sign-in token identifies your device after that. On the website and in the Android app you can also sign in with Google, in which case Google tells us your email address and we create the same kind of account.

When you ask your coach for something

If you join a waitlist or ask for coaching, you give your name and how to reach you — your email address and phone number — so your coach can reply to you himself. They are stored with your request and used only for that.

Your evaluation

The intake evaluation asks for your name, age, sex, height and weight, the readiness questions a trainer asks before programming (the PAR-Q), any conditions that change how you should train, injuries and their history, aches and pains, medications that affect heart rate or recovery, whether you take a GLP-1 medication such as Ozempic, Wegovy or Mounjaro and the day you answered (you can change that answer in Settings, under Profile & goals; a yes turns on a monthly check of your weight and strength), goals, eating habits, and resting heart rate and blood pressure if you measure them. You also sign a liability waiver by typing your name. This is health information and we treat it as sensitive.

What you record day to day

• Training: workouts, sets and loads, perceived effort, your programme and its phase, cardio sessions and time in heart-rate zones.
• Body: measurements, weight, body composition, resting heart rate, sleep, steps, soreness and energy check-ins. If you record your menstrual cycle, that is stored too.
• From your phone's health app: if you connect Apple Health or Health Connect, or import an Apple Health export, the app reads your steps, sleep, heart rate, active calories and weight. An Apple Health export you import is also read for your workouts: for each day, how many you finished and for how many minutes, which count toward your streak. It looks at which app recorded each workout only to skip the ones VeraForma recorded itself. The export is also read for your walking asymmetry, heart rate variability (HRV), VO2 max, resting energy, body fat percentage from a smart scale, blood pressure, blood sugar, and the time you fell asleep each night. Those readings are saved to your VeraForma account like everything else you record, so they follow you to a new phone and your coach can see them. They are never sold or used for advertising, and the AI features never train AI models on them.
• Health logs: if you keep them, the blood pressure and blood sugar readings you type in, a daily POTS check (how the day was and how your last session sat), and a monthly menopause symptom check (eleven symptoms, such as hot flushes, sleep, mood, changes in your sex life and vaginal dryness, each rated from none to very severe). They are saved to your VeraForma account like everything else you record, your coach can see them, and they are printed on the report for your doctor or physio when you make one.
• Food: what you log, saved meals and recipes, allergies and restrictions, water, fasting windows and calorie targets. If you are offered the choice to see your food without the numbers, whether your numbers are hidden or shown, and when that was set, is stored too.
• Pain and recovery: pain regions and levels, flare-ups and the notes you write about them, range-of-motion checks, release and mobility work, and any clearance or instruction you record from your doctor or physio. If you rate what your problem stops you doing, the activities you name in your own words and your 0 to 10 score for each are stored every time you rate them, including each re-rating at a re-screen; the first and latest ratings are printed in the report for your physio when you make one.
• Habits, messages, bookings with your coach, and referral or buddy codes you create.

Friends

If you start sharing under Friends, our server keeps a share under a six-character code: your first name, your streak and the last day you trained, and, while "Friends see my finished workouts and badges" is ticked, your finished workouts from the last two weeks (for each one only the day, the kind of workout, the minutes and the number of sets, never its name, weights or notes) and the names of your recent badges with the day you earned them. The code is the permission: anyone who has it can read those things without an account, so give it only to people you want to see them. A friend with an account can send you a high-five on a workout; it is kept with their first name, and a high-five you send is kept with yours. You can block someone who high-fives you, get a new code (the old one stops working), or tap Stop sharing, which deletes your share, the high-fives on it and the high-fives you sent from our server. Deleting your account deletes all of it too.

Device and app information

When the app starts it tells our server which version of the app bundle it is running, and whether the coach voice is on and which voice is chosen. That is so we can see what version a phone has when something goes wrong. It does not include your name or account. A bug report you choose to send is different: it goes with your account, as described under Bug reports. Our web server keeps a standard access log with the address your device connects from and the page or file requested; the log rolls over at forty megabytes and only the two most recent files are kept.

Camera and pose

The form tracker uses your camera to watch you move. The video is analysed on your phone, by a pose engine built into the app, not on our server. So you can watch a set back, the app keeps a recording of each set on your phone. Your set videos stay on your phone. They are not uploaded unless you send one to Brad for review yourself (below), and they are deleted when you erase the app's data or your account.

During a hands-free workout on Android, if you allow the microphone, the phone's own speech recogniser listens for a few commands such as “how many” or “swap”; it runs on the phone, and no audio or words are sent to us or anyone else.

Things that do leave your phone: a photo you ask us to read, and a gym scan

Some features use the camera for something other than watching you move, and each sends what it captures to be read. Snap a meal sends the one photo you take or choose, to estimate what is on the plate. The same way, you can send a photo of a menu (to list the dishes), your fridge (to find recipes), a nutrition label (to fill in its numbers) or a lab report (to copy your results; a lab report is health data, so it is sent only after you tick the box that says so, for each photo). Scan this gym takes a few still frames from the camera while you point it round the room, to tick which equipment is there; the video itself is not recorded or sent. All of them go to our server, which passes them to Anthropic's Claude to read and does not keep them (see Other companies). None is ever used to train AI models. Nothing is sent unless you start one of them.

The camera is only on while the form tracker, a photo to be read or a gym scan is open. You can revoke camera permission at any time in your phone's settings; the rest of the app keeps working.

If you think the camera got a call wrong and tap "I don't think so" under one of those photos, the app shows you the photo and the call, and asks your consent before sending that one photo to Brad. He looks at it himself and answers under the photo. He may keep it, with his answer, to test the camera against; it is never shown publicly or used in marketing. You can delete it from the app at any time, and it is deleted with your account. This is not offered under 18.

If you are one of Brad's coaching clients and send a set to him for review, the app first plays you the set and tells you who will see it, then sends that one video only when you tap Send. Brad watches it and records his voice and a drawing over it for you to play back. Only Brad sees it. It is deleted from our server 30 days after you send it, straight away if you delete it in the app (at the top of "Watch my sets back", even after you stop being a coaching client), and with your account. Our server backups can keep a copy for up to 30 days after that. The recording on your phone is not changed.

Anonymous progress stats. If you say yes to "Share anonymous progress stats" (you can change it in Settings at any time), the app sends, under a random code with no name, email or account: the change in each measured angle between two of your screens, how many days apart they were, and your push-up count before and after when you tested it the same way both times; three plan facts: that a free trial started, that you subscribed and to which plan, and that a trial ended; and four programme facts: that your programme started (your first session), that it moved up a phase on time, that it moved up a phase early, and that it was changed (rebuilt, or switched to or from a Comeback). Each programme fact carries only the names of the phases involved, plus which week of the phase a move up came in, and whether a changed programme is a Comeback. Nothing about your exercises or answers is sent, and while the pregnancy or postpartum rules keep your programme at Phase 1, no programme facts are sent at all. Brad sees these only as group medians and counts. Say no and nothing is sent; the app works the same.

If you said yes to an earlier version of this question, the programme facts are not sent until you say yes to this one. The app asks you once more the next time you open the comparison of a new re-screen ("See what changed", part of Premium), and once you answer it does not ask again. You can also add them at any time with "Include my programme" in Settings, on any plan. Saying no keeps your earlier yes exactly as it was.

Anonymous corrective results. If you turn on "Share which corrective work moved your screen" in Settings, the app sends, under a random code with no name, email or account, which corrective exercises you did between two screens and whether each measured finding moved. Brad sees these only as group counts. It is off unless you turn it on.

Progress photos

Progress photos you take live on your phone. They are not uploaded unless you choose to post one to the transformations wall, which asks for your consent first, or attach one to a bug report yourself. You can remove a wall post at any time and anyone can report one.

Where your data goes

Our server is a machine we rent from DigitalOcean. Data travels to it over an encrypted connection and is stored under your account identifier.

What your coach can see

VeraForma is run by a coach, and coaching is the point. The coach who runs the service can see the data you sync, including your evaluation, your training, your food and your camera results, in order to coach you, adjust your programme, and answer your messages. The coach can also open your account view to see exactly what you see, which is how remote coaching and support work. The coach cannot see your password, your camera video, or photos you have not posted, attached to a bug report, or sent with "I don't think so".

If your coach records their own voice for the in-set cues, the app downloads those recordings to your phone and plays them for the lines they recorded; you can switch this off in Settings. A coach's recordings are stored on our server with their account and deleted when they delete them or their account.

Bug reports

If something in the app goes wrong, you can report it from Settings → Help & about → Report a bug.

A report is sent only when you tap Send.

What a report contains

• What you write: what happened, what you were doing, and where in the app, which the form fills in for you to check.
• Screenshots you choose to attach, up to three, each one picked by you.
• Technical details, unless you switch them off: the app version and how it is installed, your device and browser type, screen size, language, time zone and connection, the screen you were on, the screens you visited and buttons you tapped just before, and error messages the app recorded. The form shows you every one of these before you send.

The list of screens, taps and errors is recorded on your device only, and never includes anything you typed into a field.

Who sees it

Brad, the coach who runs VeraForma, sees every report, with your name and email so he can answer you.

Claude, Anthropic's AI, reads every bug report, to find the fix. The form says so on the screen you send it from.

Claude reads your words, your screenshots and the technical details you left switched on, working in our private code repository at GitHub. It writes what it thinks is wrong and a suggested fix; Brad reads both and decides whether anything ships.

We do not send GitHub or Claude your name, email or account id, and we take email addresses and long numbers out of what you wrote.

There is no way to send Brad a report that Claude does not read. If there is something you would rather Claude did not see, leave it out of the report, switch the technical details off, or message Brad instead.

A screenshot shows whatever was on your screen, so leave out any picture you would not want read.

Reports are used only to find and fix the problem and to answer you about it, and never for marketing.

How long it is kept

On our server a report is kept with your account until you delete your account, and deleting your account removes it like everything else.

The copy at GitHub is held only while Claude is working on the report, and is removed once it has been diagnosed.

Copies in GitHub's backups and its clean-up of old files can take a little longer to disappear.

Claude's own notes on the problem and the fix carry no name or email, and are removed from GitHub when the report is finished with.

What Claude read is also kept in our account at Anthropic, under Anthropic's privacy policy.

Company perks

Some employers, and some gyms, offer VeraForma Premium to their people as a free perk. If you join through one, this is what happens to your information.

• What your account keeps: which company's or gym's perk you used, whether you joined as the employee or gym member, or as an employee's spouse or partner, when your perk started and ends, and how you confirmed it (a personal code or a work email). If you joined as a spouse or partner, your account also keeps which employee invited you and when you confirmed you are 18 or older.
• Personal codes are never stored as typed. The code HR or your gym gave you is kept only as a keyed hash, so a stored record cannot be turned back into a code. The one spouse or partner invite code is kept on the inviting employee's own account, so they can find and share their link again; everywhere else it is kept only as a keyed hash.
• Your work email is never stored. If your company's perk lets you confirm with a work email, we send a one-time code to that address through our email provider, Resend, and keep only a keyed hash of the address, so the same address cannot be used twice. That hash stays in the company's record after the perk ends or your account is deleted, for that reason only.
• Your employer or gym sees only a count. The company or gym can be told how many people joined through its perk, and any number from 1 to 9 is shown as "fewer than 10". It never sees your name, your email, whether you in particular joined, or anything you record in the app.
• The perk ends on its date. Your account then moves to the free plan. Nothing is charged, and nobody is told.

Other companies that may see something

We do not use advertising networks, outside analytics services, crash reporters or tracking of any kind, and we never share or sell your data. Errors the app records reach us only inside a bug report you choose to send. A small number of other companies do receive something in the course of the app working, and here is exactly what:

• Apple and GoogleApple handlehandles app installation, updates and purchases under theirits own policies. On the website and in the Android app, Google Sign-In, if you use it.
• Stripe, a payment company. Only if you subscribe with a card on the website: Stripe receives your card details and what you type at its checkout (your name, email and billing address, and a phone number for an in-person training plan), and handles the payment under its own privacy policy. We get back the plan, its status and renewal date, and Stripe’s reference numbers, never your card number. For an in-person training plan we also keep the name, email and phone number you gave, so Brad can book your sessions.
• ntfy.sh, a notification service. When you sign up, message your coach, send a bug report, or something changes with a purchase or a referral, a notification is sent to his phone through ntfy.sh. It can include your name and the start of your message or report, and for a bug report a one-line summary of the problem and its fix. Email addresses and phone numbers are taken out of it before it is sent.
• Resend, an email delivery service. When we can email you a password-reset code you asked for, your email address and the code are sent to Resend, which delivers it. Only if you turn on Email me my week in Settings: once a week your email address and that week’s numbers (your workouts and their sets, how many cardio and corrective sessions you logged, how many sets the camera watched and how many were clean, and how often each fault showed against your three weeks before) are sent to Resend, which delivers the email. Before the first one, your email address is also sent to Resend for an email asking you to confirm that address is yours; nothing about your week is sent until you do. Every weekly email has a link that turns it off, and so does the switch. Nothing about your week is sent to Resend while it is off.
• USDA FoodData Central and Open Food Facts receive the food search terms and barcodes you look up. They receive nothing about who you are.
• Anthropic. Four features run on Anthropic's Claude: the meal-photo estimate (with the menu, fridge, nutrition-label and lab-report photo reads), AI food logging, the gym scan and the AI Coach (including the weekly review). The meal-photo estimate and AI food logging are free with an account, 3 a day (10 a day on Premium), and the other photo reads count toward the same allowance; the gym scan and the AI Coach are part of Premium. All four are on by default — you do not need an API key of your own. When you use one, the content it needs (the photo you snapped or chose to have read, the food you described, the gym photo, or your message together with what the coach answers from) is sent from your device to our server, which forwards it to Anthropic under our own account and under Anthropic's privacy policy. What the coach answers from is your first name, age, sex, goal, movement-screen findings and equipment, whether training or your calories are on hold, and — unless you switch any of them off in Settings › What the coach can read — your weight, your injuries and health answers (your health questionnaire, medical history, what a clinician told you and why training is held), your pain map, your food logs, your workouts and your health data. If your food numbers are hidden, the coach is also told not to give you calorie, macro or weight-loss figures; that instruction is sent only while both food logs and health answers are switched on, because it follows from one of your health answers and is about your food. Whether it is sent or not, any such figure in the coach's answers is hidden on your screen. Apart from the first name the coach is given, we do not send your name, email or account id with any of it. It is never used to train AI models: these requests go through Anthropic's commercial API, whose commercial terms do not allow Anthropic to train on them, and we do not use them to train any model either. Settings has a box for your own Anthropic key; the app is not using it at present, and anything you put there stays on your device. Separately, Claude reads every bug report you send, working on it under our own account, without your name, email or account id, as described under Bug reports.
• Content hosts. Exercise demonstration clips and coach audio are served from our own server and from GitHub Pages, and some exercise pictures come from an open exercise library hosted on GitHub (raw.githubusercontent.com). The icon font and the pose engine are served from our own site, and inside the iPhone and Android apps app the pose engine is built in. Like any web request, these hosts see the address your device connects from. GitHub also holds our private code repository, where a bug report you send is kept while it is being fixed.
• Amazon. Some equipment and supplement suggestions link to Amazon. Following one is an ordinary link, and it may carry an affiliate tag so we earn a small commission. Nothing is sent to Amazon unless you tap.

Security

Connections use HTTPS. Passwords are salted and hashed, never stored. Your device holds a sign-in token, not your password. The server is a single machine with key-only administrative access, automatic security updates and a firewall that exposes only the web ports. A hosted-media access token expires every six hours and is scrubbed from server logs. No system is perfectly secure, and if we ever learn of a breach that affects you we will tell you.

Deleting your data

You can delete your own account from inside the app, and you do not need to ask anyone. Open Settings → Data → Delete my account. It asks twice and then asks you to type the word DELETE. The moment you confirm, everything held on the server for your account is removed: your synced data, your account record, your messages, any transformation-wall post, your bug reports, and your buddy and referral codes. Your sign-in stops working immediately, on every device, and the app itself cannot reverse it.

The same screen wipes this phone as it goes — your logs, your settings and every stored photo, assessment and progress alike. Deleting the app afterwards is not necessary, though you are welcome to.

If you cannot get into the app — a lost phone, a forgotten password, an account you cannot sign in to — email the address at the bottom of this page from the address you signed up with, and say you want your account deleted. We will do it and confirm when it is done.

We hold a locked copy for 90 days. It is there so a deletion made by mistake can be undone if you ask us. Nothing in the app can reach it and it is not used for anything else. After 90 days it is permanently deleted, and at that point nobody can get it back, including us.

We keep our own record of a store purchase — the date, what was bought and the store's reference for it. Never your card, your name or your email. It is the proof of what you paid for, so it is not deleted with the account, and it is not used for anything else. Payment records held by Apple or Google belong to them, not to us. And deleting your account does not cancel a subscription — cancel that in the store as well, or the charge carries on. A card payment on the website is recorded the same way, and Stripe keeps its own payment records. Deleting your account does not cancel a website subscription either — cancel it under Manage billing in Settings first. The support page lists what goes and what stays.

And an invitation you sent stays with the person who accepted it. That record is filed under their account, not yours, so deleting yours does not remove it. It holds the invite code and your account id — never your name or your email — and it is what keeps their side of the referral honest.

Two things that are not deletion. Signing out only removes the sign-in token from this device — your data stays on the server for when you sign back in. And Settings → Data → Reset all data clears this phone only, and leaves your account alone.

Your choices

• See and correct anything in the app by editing it. Your evaluation can be re-taken.
• Export. Your food diary exports as a spreadsheet, and the app can produce a full copy of your data.
• Camera. Grant or revoke it in your phone's settings. The form tracker, the meal photo and the gym scan use it.
• Sync. You can use the free app without an account. What you record then stays only on that phone and is lost if you delete the app or change phones. An account backs it up and carries it to any device.
• AI features send nothing until you use one: nothing goes to Anthropic unless you snap a meal or send another photo to be read, describe one for AI logging, scan a gym or ask the AI Coach.
• Bug reports are sent only when you tap Send, and Claude reads every one — the form tells you so before you send it. If you change your mind after sending one, message your coach and he will stop the work on it.
• Delete your whole account yourself, from Settings → Data → Delete my account, as described above.

If you are in a place with data-protection law such as the EU, UK or California, you have the rights that law gives you, including access, correction, deletion and portability. Contact us and we will act on them.

Age

VeraForma is for people aged 13 and over. If you are under 18, use it with a parent or guardian's permission; a coach may ask for that. We do not knowingly collect data from anyone under 13, and if we learn we have, we delete it.

Guardian view. A client aged 13 to 17 can choose to give a parent or guardian a read-only code. Whoever holds it sees only the client's first name, programme phase and week, how many days they trained in the last 7 and 28 days, the last day they trained, and whether training is on hold until a doctor or clinician clears it (never the reason). Never photos, camera video, weight, pain, food or messages. Stopping it in the app deletes it from our server and the code stops working; deleting the account deletes it too.

Changes

If the app starts collecting something new or sending it somewhere new, this page changes first and the date at the top moves. Material changes are announced in the app.

Contact

Privacy questions and deletion requests: message your coach from the Messages tab in the app, or email VeraFormaApp@gmail.com.