PRFORM
Privacy Policy
Last updated: November 3, 2026
This policy explains what data PRFORM collects through the mobile app, Apple Watch and the website, why, with which service providers, for how long, and how to use your rights.
1. Who is responsible for your data
Your data is handled by PRFORM, the publisher of the PRFORM mobile app and the prform.io website. For any question about your data or your rights, email contact@prform.io.
2. Data we collect
Account: your email address, your first and last name if you provide them, and the technical identifier supplied by Sign in with Apple or Google if you use them to log in. Training profile: goal, level, training frequency and days, available equipment, body measurements (height, weight, goal weight) and the other answers you give during onboarding. Preferences: language, measurement units and time zone. Activity: planned and completed workouts, sets, weights, reps, perceived effort, duration, history and progress. Content: the profile, banner and progress photos you add. Approximate location: city and country, only if you allow it, to tailor your experience; your precise location is never stored or displayed. Technical data: device model, OS version, app version and push notification token. Ad measurement: your device's advertising identifier and attribution information, as described in section 8.
3. Health data, Apple Health and Apple Watch
With your explicit permission, PRFORM reads certain Apple Health data (steps, distance, energy burned, heart rate, height, weight) to personalize your programs and tracking. On Apple Watch, during a workout started from the watch, PRFORM measures your heart rate and active calories to show them on your wrist, and saves the workout (strength training, duration, calories) to the Health app so it counts toward your Activity rings. Only aggregated values (calories, average and maximum heart rate for the workout) are kept in your PRFORM history. This health data is used only for your training features: it is never sold, never shared with third parties, never used for advertising, marketing or profiling, and never sent to analytics or crash reporting services. You can remove access at any time in Settings › Health › Data Access & Devices, and you can keep using the app without it.
4. Camera and photos
Camera and photo access is used only to choose your profile or banner photo, when you decide to. The photos you add are stored privately and are never published without an explicit action from you.
5. AI coaching
Your programs, recaps and messages from your coach, Magnus, are generated by artificial intelligence models provided by Google Cloud (Gemini through Vertex AI), and Magnus's voice is produced by a Google Cloud text-to-speech service. To do this, PRFORM sends these services only what they strictly need: your training profile, goals, the measurements you entered and your workout history. Under Google Cloud's contractual commitments, this data is not used to train its models. When you message Magnus during a workout, your message, the current workout and the relevant training information (first name, goal, level, equipment, recent workouts and the instructions you gave) are sent to a third-party AI service to generate the reply; any change to your workout that Magnus suggests has to be approved by you. What the AI generates is training guidance and is not medical advice.
6. Payments and subscriptions
Subscriptions are purchased and billed through Apple's App Store. RevenueCat, the service we use to manage subscriptions, receives an anonymous user identifier and the transaction information provided by Apple (product, dates, status). PRFORM never has access to your full payment details.
7. Service providers
PRFORM relies on providers that process data on its behalf and according to its instructions: Supabase (authentication, database, file storage), Apple and Google (login, notifications, App Store, Apple Health), Expo (push notification delivery), RevenueCat (subscriptions), Google Cloud (artificial intelligence and text-to-speech), a third-party AI service (Magnus's replies during workouts), Sentry (crash reports: device model, OS version and the technical trace of the error, with no health data or personal content) and PostHog (product analytics: screens viewed and actions in the app, with no health data). Some of these providers are based in the United States. For users in the European Union, these transfers are covered by the safeguards required by the GDPR (standard contractual clauses or the EU-U.S. Data Privacy Framework).
8. Measuring our ads
PRFORM advertises on Instagram and Facebook (Meta), TikTok, Google and the App Store (Apple Ads). To find out which ad led you to the app, PRFORM asks for your permission once, at the end of sign-up, through Apple's "Allow PRFORM to track your activity" prompt. If you allow it: PRFORM turns on the measurement tools of Meta (Facebook SDK), TikTok (TikTok Business SDK) and Google (Google Analytics for Firebase). They receive your device's advertising identifier, a technical identifier specific to each tool, the app's install and opens, and the start of your trial and your subscription payments (product, amount, date). This subscription information is sent to Meta and Google by RevenueCat, and to TikTok by the app. It is used only to measure and improve our own campaigns: PRFORM shows no ads in the app. If you decline: the Meta and TikTok tools are not turned on, no advertising identifier is sent, and Google Analytics for Firebase runs in "no consent" mode, sending only anonymous signals without any identifier, which Google uses to estimate results statistically. In every case, PRFORM uses two Apple measurement systems that cannot identify you: SKAdNetwork, through which your iPhone tells the ad network concerned, anonymously, in aggregate and after a delay, that one of its ads led to an install and to certain steps (install, program ready, trial started); and Apple Ads attribution, through which Apple tells RevenueCat whether the app was installed from an App Store ad, and which one. Your health data, workouts, photos, messages to Magnus, email address and phone number are never sent to these ad networks. You can change your mind at any time in Settings › Privacy & Security › Tracking, or Settings › PRFORM; measurement then stops going forward. Under their terms for these measurement tools, Meta, TikTok and Google commit to protecting this data at a level at least equal to what this policy describes; they may process it outside your country, including outside the European Union with the safeguards required by the GDPR.
9. Why we use your data, and on what legal basis
Providing the service and performing our contract: creating your account, generating and tracking your programs, syncing with Apple Watch and managing your subscription. Consent: access to Apple Health, the camera, approximate location and notifications, as well as ad measurement by Meta, TikTok and Google (Apple's tracking prompt), which you can withdraw at any time in your device settings. Legitimate interest: security, fraud prevention, fixing errors, improving the app and anonymous ad measurement (SKAdNetwork, Apple Ads attribution). Legal obligation: keeping billing records.
10. How long we keep your data
Your data is kept as long as your account is active. When you delete your account, it is erased from our systems, except for transaction records kept for as long as the law requires. Crash reports and product analytics are kept for a limited time, at most twelve months, and then deleted or anonymized. Ad attribution information is kept with your subscription; data received by Meta, TikTok and Google is kept according to their own policies.
11. Sharing: profile page, shared workouts and referrals
Your public page, prform.io/u/<identifier>, does not exist by default: it is created only when you choose to use the "Share My Profile" button in the app, and you can turn it off at any time (Profile › Public Profile). While it is active, this page and its preview image in messaging apps show only: your first and last name (or a neutral label if you have not entered one), your country, your goal, your level, your profile and banner photos, and the date you signed up. It never shows your city, email address, health data or training history. Anyone with the link can view the page while it is active; turning it off makes it unavailable immediately. Each use of the "Share" button creates a short link of the form prform.io/s/<random code>: this code contains no personal data and only redirects to your public page. Sharing a workout: when you use the "Share" button on a workout or routine, PRFORM creates a prform.io/s/<random code> link that gives access to a copy of that workout: its name, your first name and, for each exercise, its sets, reps, weights and rest times. Anyone with the link can view it on the website, in the PRFORM App Clip (no account needed) or in the app, and add it to their own routines. No other data from your account is included (no last name, photo, history or health data). For each link, we count the opens (date and time only) and, if the person installs PRFORM and creates an account, we connect that account to the link to measure installs. Sets checked off in the App Clip are not saved. Your workout links are deleted with your account. Referrals and codes: each member has a referral code (the first letters of their first name followed by numbers) and a prform.io/i/<code> link they can share. When you use a friend's code, we record the connection between your two accounts; your friend then sees, on their Referrals screen, your first name, your profile photo if you added one, and the status of your subscription (signed up, on a trial, subscribed), and nothing else. When you use a content creator's code, only PRFORM sees that you used it, as aggregated numbers (sign-ups, trials, subscriptions, revenue); nothing about you is sent to the creator. To grant the free trial and the free days given to referrers, we check the status of your purchases with RevenueCat; free days given to a subscribed referrer extend their subscription through Apple, which informs them. This information is deleted with your account.
12. Your rights
If you are in the European Union or the United Kingdom, you have the right under the GDPR to access, correct, erase, restrict and port your data, to object to its use, and to withdraw your consent at any time (for ad measurement: Settings › Privacy & Security › Tracking). To use these rights, write to contact@prform.io; we reply within one month. You can also file a complaint with the CNIL (cnil.fr), the French data protection authority, or with your local authority. If you live in the United States, see sections 16 and 17.
13. Deleting your account
You can delete your account at any time in the app (Profile › Delete Account). This removes your profile, programs, history, photos and related data, including the aggregated health values kept in your history, subject to legal retention requirements. Data already saved in Apple Health stays under your control in the Health app.
14. Security
Communication between the app and our servers is encrypted. Access to your data is restricted by authorization rules specific to each user. Since no method is foolproof, we encourage you to protect access to your device and your account.
15. Children
PRFORM is not directed to children under 13, and the app does not allow anyone under 13 to create an account. If you believe a child under 13 has given us personal information, write to contact@prform.io and we will delete it.
16. California residents
This section applies to California residents and covers the California Consumer Privacy Act, as amended (CCPA). What we collect: the categories in the last 12 months are identifiers (email, name, account and device identifiers, advertising identifier if you allow tracking), commercial information (subscription status and purchases), internet or device activity (screens viewed, actions in the app), approximate location, photos you add, sensitive personal information (health and body data described in section 3 and section 2) and inferences about your training (level and progress). We collect it from you, your device, Apple Health if you allow it, and Apple for purchases. We use it for the purposes in section 9 and keep it for the periods in section 10. Sale and sharing: we do not sell your personal information for money. If you allow tracking in Apple's prompt, the information described in section 8 goes to Meta, TikTok and Google to measure our ads, and California law may treat this as "sharing" for cross-context behavioral advertising. To opt out, decline the prompt or turn off tracking at any time in Settings › Privacy & Security › Tracking; if you do not allow tracking, we do not share it. We do not knowingly sell or share the personal information of anyone under 16. Sensitive personal information is used only to provide your training features, as section 3 explains. Your rights: you can ask to know what we collect and disclose, ask us to delete it, correct it, and opt out of sale and sharing, and you will not be treated differently for using these rights. Delete your account in the app, or write to contact@prform.io from your account's email address so we can verify your request. An authorized agent can also make a request for you, with proof of your permission. We respond within 45 days.
17. Consumer health data (Washington and Nevada)
This section is our consumer health data privacy policy under Washington's My Health My Data Act and Nevada's similar law. What we collect: height, weight and goal weight, workouts and perceived effort, any pain or discomfort you mention to Magnus, and, if you allow it, Apple Health data (steps, distance, energy burned, heart rate). Why: to build and adjust your programs, track your progress, and let Magnus coach you. Where it comes from: you, your iPhone and Apple Watch, and Apple Health. Who receives it: the service providers in section 7 that need it to run these features (hosting and database, Google Cloud and a third-party AI service for coaching). We do not sell it, and we do not share it with ad networks or other third parties for their own use; the ad measurement in section 8 never includes it. We collect it to provide the service you asked for; Apple Health data is read only after you grant permission in Apple's prompt, and you can withdraw that permission in Settings › Health at any time. Your rights: you can confirm whether we collect or share your consumer health data, access it, get a list of the third parties and affiliates it was shared with, withdraw your consent, and have it deleted. Write to contact@prform.io or delete your account in the app. We reply within 45 days. If we deny your request, you can appeal by replying to our answer; if the appeal is denied, you can contact the Washington State Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).
18. Changes
This policy may change as the app evolves. The date of the last update is at the top of this page, and we will tell you about any significant change in the app or by email.