Activity notifications and device alerts
OVERPOWERED records notification preferences and activity events such as new followers and workout-copy milestones to provide your activity inbox. You can turn off each activity category in Settings → Notifications. Private workout exercise details are not included in these alerts.
If you enable phone notifications, OVERPOWERED stores your app-specific Apple push device token and sends the notification text and destination identifier to Apple Push Notification service for delivery. The token is tied to your authenticated account and device connection. You can disable phone notifications separately from activity categories and your daily workout reminder. Signing out unregisters the app for activity alerts on that device; account deletion removes notification events, preferences and device registrations.
The daily workout reminder is scheduled locally on your iPhone at your chosen time. Notification permission can also be managed in iPhone Settings.
Following and public workout discussions
OVERPOWERED verifies active Plus access to display a membership badge on profiles and rankings. Other users see only whether Plus is active, not payment details, prices, expiry dates or whether access was purchased or complimentary.
OVERPOWERED stores who follows whom to provide followers/following lists, personalised Following rankings and the activity notifications you enable. A follow is one-way. Your list of followed athletes does not automatically become another athlete’s list. Following does not change a session’s privacy setting. Profile totals can include private sessions, but their exercise breakdowns, private photos and private session details are not disclosed through following.
Comments on shared workouts are shown with the commenting account’s public identity and posting time. Treat them as public posts that other users may read or copy, not confidential communication. Do not include sensitive health information or another person’s private information. You may remove your own comment; the workout owner and authorised moderators also have removal controls.
Block records identify the blocking and blocked accounts so OVERPOWERED can remove their follow connections and filter community visibility and interactions in both directions. Unblocking does not automatically restore a follow. Blocking and deleting a comment cannot recall copies that someone already saved or exported.
Program enrollment stores the version you started, its session templates and any later update choice, so a catalogue change does not silently replace your program. Saved workout source snapshots support comparisons with newer versions. These account-linked records are used to provide the plans and updates you request and are removed through account deletion along with your saved records.
Community safety and photo review
When you submit a public profile photo, OVERPOWERED stores the image and its review status for authorised moderators to review. Profile photos are visible to other users immediately after upload, including while awaiting review. A rejected or removed photo is no longer available through the public profile. You can remove your photo at any time. Moderators see the submitted public-profile image and public identity information, not your private progress photos, session photos, body measurements or workout diary.
Reports store the reporting account, the reported account or content, the reason, your optional explanation and a snapshot of the relevant public text or photo reference. These records, blocks, account restrictions and moderator decisions are used to handle abuse and enforce community standards. They are not used for advertising or sent to a paid moderation or AI service.
Report details are available to authorised moderators and are not disclosed to the reported account. Moderation records are retained while needed to handle reports and enforce decisions; the account deletion process removes records linked to the deleted account. Copies independently accepted or saved by other users remain their records as described elsewhere in this policy.
About this policy
This Privacy Policy explains personal-data handling in the OVERPOWERED website, iPhone app and Apple Watch companion. OVERPOWERED is responsible for the service’s processing. Contact support@vitalfitapp.com for privacy enquiries and requests. Apple, Google and OpenAI may separately act as controllers for their own services under their policies.
The App Store privacy label describes data collected by OVERPOWERED and relevant providers. Data kept only on your device, such as the Apple Health readings described below, is distinguished from account-linked data held by the service.
Account information
The sign-in method you choose supplies a provider account identifier, verified email address when available, and a name when provided. OVERPOWERED uses these to authenticate you, associate your profile and records with your account, and support linked sign-in methods. It does not receive your Apple or Google password.
The iPhone connection uses a temporary authorisation code and a device credential. The server stores a hash of the credential, the account identifier and expiry information. The app stores its credential in the iPhone Keychain.
Sign in with Apple
Sign in with Apple uses the account identifier and authentication information Apple provides. OVERPOWERED stores the verified email address when Apple supplies it, including a private relay address if you choose to hide your email. OVERPOWERED does not receive your Apple password.
This policy will be updated before any materially different Apple authentication data handling is introduced. Apple’s own privacy terms govern its authentication service.
Sign in with Google
When you use Google sign in, Google provides a verified account identifier and email when available. OVERPOWERED validates the signed response on the server. It does not receive your Google password or access your Gmail messages or Drive files.
If the verified email matches an existing OVERPOWERED account, you can confirm connecting the new sign-in method before creating another profile. After connection, the linked methods open the same account. Already-created profiles use a separate confirmed merge through Linked accounts in Settings. Apple hidden-email addresses may need explicit linking because they differ from your regular email.
Linked accounts
If you choose to link accounts in Settings, OVERPOWERED asks you to sign in with the other provider and confirm the merge. Different provider identities and their supplied email addresses can then access one OVERPOWERED account. Email matching alone is not used to merge accounts.
The profile you start from is kept, and saved workout records, history, photos and social connections are combined. OVERPOWERED stores an internal merge record with the account identifiers, date and previous profile information to support integrity and troubleshooting. Temporary linking requests expire after ten minutes. Settings can unlink an additional sign-in method while keeping access through another method. Unlinking does not split merged workout records or undo the merge.
Legacy sign-in information
ChatGPT sign-in is no longer available. Existing account identifiers and migration records may retain a legacy ChatGPT identifier to preserve account history. That identifier does not provide an active ChatGPT sign-in method.
OVERPOWERED does not access your ChatGPT conversation history. The OpenAI API connection used for optional AI features is separate from sign-in.
Workout information
OVERPOWERED stores workout names, exercise plans, repetitions, weights, sets, rest periods, weekly plans and custom exercises you save. Session records can include completed exercises, duration, completion time, notes, effort, mood, sharing choices and a session photo if you upload one. An unfinished session can be saved so you can resume it.
Community activity can include follows, training invitations, comments, copied workouts, program enrollments and shared session information. Legacy friend-connection records may remain from earlier versions. These records support the community and ranking features.
Profile information and photos
Your profile can include your display name, country, bio, Instagram username, profile photo and setup preferences. The current setup also requests gender, height and weight. A birthday can be provided. Measurements and birthday are not included in public profiles or friend-summary responses.
Progress photos you choose to upload are stored with their date and selected view. The progress photo service restricts access to the account that uploaded them. Profile photos are visible to other users immediately after upload and may be removed following moderation. Photos attached to workout sessions are restricted to their owner in OVERPOWERED, including when the session activity is shared. If you choose to export or share a workout image outside OVERPOWERED, the selected image and statistics go to the recipients or service you choose; those external copies are outside OVERPOWERED’s moderation controls.
Apple Health and Apple Watch
With your permission, the iPhone application can read steps, active calories and details of a recorded workout, including duration and average heart rate when available. These readings are displayed on the phone. The current interface does not send these Apple Health readings to the OVERPOWERED server.
The Apple Watch companion can record a workout using Apple Health, display heart rate and active calories, and send live workout state and controls between your paired watch and phone. Recorded watch workouts are saved in Apple Health. The current workout save flow does not include these live readings in the session information sent to OVERPOWERED’s server.
You can change Health permissions in Apple’s Health or device settings. Turning off a OVERPOWERED display option does not itself revoke Apple’s permissions or erase workouts already recorded in Apple Health.
Technical information and local storage
Hosting and authentication services process the network requests needed to deliver OVERPOWERED, including IP addresses, request paths and technical information supplied by your browser or device. Operational logs may record request failures and service errors.
OVERPOWERED uses browser storage for preferences and active workout recovery. The iPhone app stores account related workout data, saved media and pending changes locally for offline use, then synchronises changes when a connection is available. Credentials are stored separately in the Keychain.
The reviewed application does not include an advertising tracking SDK or a separate marketing analytics integration. The website’s hosting and authentication providers may use their own essential storage and operational logging.
How information is used
Core account, saved-workout, progress and requested community processing provides the service you ask for (GDPR Article 6(1)(b), where applicable). Purchase validation and membership status provide purchased or granted access. Optional AI input is processed only when you choose an AI feature; do not submit medical records or unnecessary sensitive information.
Security, abuse prevention, operational troubleshooting, service usage limits and subscription analytics support legitimate interests in operating a reliable service (Article 6(1)(f)), subject to your rights and reasonable expectations. Legal compliance and required records rely on applicable legal obligations (Article 6(1)(c)). We do not use data for advertising tracking or sell it.
Device permissions control access to Health, microphone and selected photos. A device permission is not blanket consent for unrelated server processing or public sharing. Where consent is the applicable legal basis, it can be withdrawn without affecting earlier lawful processing. Processing health information that falls within GDPR special categories requires an applicable Article 9 condition, such as explicit consent; accepting these terms is not itself that consent.
Account details are needed for signed-in features. Optional profile fields, images and AI input serve the features you choose; leaving optional information out limits only the features that depend on it. An Apple Watch and Health permission are optional. OVERPOWERED does not use automated decisions that produce legal or similarly significant effects about you; AI plans are suggestions you review and choose whether to save.
AI processing
For in-app AI workout creation, the messages you submit and the relevant conversation messages in that request are sent to OpenAI to generate a response. Voice transcription sends the recording you choose to submit to OpenAI’s transcription service. Apple Health readings, progress photos and your entire saved workout history are not automatically included.
The separate “Plan in ChatGPT” link opens ChatGPT with a workout-planning prompt containing the text in the composer. Choosing that link can therefore send that text to ChatGPT. ChatGPT then operates under the privacy settings and policies for your own ChatGPT account; that is separate from OVERPOWERED’s API requests.
OVERPOWERED’s response-generation API uses store:false. This disables response application storage but does not eliminate OpenAI’s default abuse-monitoring retention, which can be up to 30 days, subject to the provider’s exceptions and account configuration. The transcription endpoint does not retain request audio for abuse monitoring or application state under OpenAI’s published endpoint policy. API inputs and outputs are not used to train OpenAI models by default. See https://developers.openai.com/api/docs/guides/your-data/ for the provider’s current practices.
OVERPOWERED does not persist submitted audio on its server. A local recording backup may remain on your device for retry or download until cleared. Transcribed text, conversation messages or a generated plan may remain locally or be saved as workout content when you choose those features. Usage records include account identifier, request counts, model, token counts, recording size and duration for service limits and troubleshooting.
Do not include another person’s information or unnecessary health information in AI input. AI output may be inaccurate and is not medical advice. You can stop using AI without losing non-AI workout features. Contact support@vitalfitapp.com about information you have already submitted.
Service providers and sharing
OVERPOWERED is hosted independently on Cloudflare Workers. Workout and profile records are stored in its Cloudflare D1 database, and uploaded images are stored in private Cloudflare R2 object storage. Apple and Google process the sign-in methods they provide. OpenAI processes the optional AI requests described above; ChatGPT Sites is not used for production hosting or sign-in. Apple processes Apple Health and watch features under its own terms. RevenueCat processes the OVERPOWERED account identifier, purchase receipts, subscription status and purchase history to validate purchases and provide membership access. It also provides subscription analytics. OVERPOWERED does not receive your payment card details.
Your public profile includes your display name, country, bio, Instagram username and avatar when provided. Shared workouts, comments and sessions can be shown to other users and contribute to rankings. Workouts are shared by default in the current data model, and sessions are not private unless the private option is selected. Review sharing controls before saving.
Information may be disclosed when legally required, to protect people or the service, or as part of a lawful business transfer with appropriate notice and safeguards. The reviewed implementation does not sell personal information or share it with advertising networks.
Data retention
Saved account, workout and photo records remain in the service until removed through available controls or an account deletion process. The current implementation does not set an automatic expiry for these saved records. Account deletion is available in Settings → Account → Legal & privacy → Delete account.
Temporary mobile authorisation codes expire after 60 seconds. Mobile device credentials expire after 90 days. Expiry prevents their use but does not guarantee immediate deletion of the corresponding database record.
Local offline copies can remain on a device separately from server records. Signing out is not full account deletion. Copies saved by other users, Apple Health records and records held by authentication providers are controlled separately. Retention needed for legal obligations or security may continue after a deletion request where lawful. Provider logs are subject to the provider’s retention practices.
Data security
OVERPOWERED uses encrypted network connections, account based access checks, credential hashing and the iPhone Keychain to help protect information. Progress photo access is checked against the requesting account. No system can guarantee absolute security.
Protect your device and authentication accounts. Do not share connection credentials. Offline records are held on your device, so its passcode, operating system protections and access controls also matter.
Your rights and account deletion
Where GDPR applies, you may request access, correction, erasure, restriction, portability of eligible data, and objection to processing based on legitimate interests. You may withdraw consent where processing relies on it; withdrawal does not affect earlier lawful processing. Rights have exceptions, including necessary legal records and other people’s rights.
Email support@vitalfitapp.com to exercise these rights. We may ask for proportionate information to verify that the request concerns your account, but do not send passwords. Requests are normally free. We will respond without undue delay and within one month; if the law permits an extension because of complexity or the number of requests, we will explain it within that first month. If a request cannot be fulfilled, we will explain the reason and available complaint rights.
You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt/, or the supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us first.
Edit supported profile information and remove supported records or photos using the app’s controls. Manage Health permissions in Apple’s settings. Delete your OVERPOWERED account in Settings → Account → Legal & privacy → Delete account. Successful deletion removes the account’s active records and uploaded media through the deletion process; a failure is shown rather than reported as success.
Account deletion does not cancel Apple subscriptions, erase Apple Health workouts, delete your Apple, Google or ChatGPT account, or remove copies other users independently saved. Cancel Apple subscriptions separately. Provider records may have separate lawful retention requirements; contact us for assistance concerning OVERPOWERED-related requests.
Children and age requirements
OVERPOWERED is intended for people aged 16 or older, subject to any higher local requirement. It is not designed for children under 16. The current account flow does not verify age, and a supplied birthday does not constitute age verification.
If information about a child has been submitted contrary to these requirements, contact support@vitalfitapp.com so it can be investigated and addressed.
International processing
Hosting, authentication, purchase validation and AI services may process data outside Portugal or the EEA, including in the United States. The processing location depends on the service and infrastructure; OVERPOWERED does not promise EU-only storage.
Transfers of personal data subject to GDPR require a lawful transfer mechanism, such as an applicable adequacy decision or appropriate safeguards including standard contractual clauses. Contact support@vitalfitapp.com to request information about the providers, transfer arrangements and relevant safeguards for your data. A provider’s general privacy policy alone is not proof that a particular transfer is compliant.
Changes to this policy
We may update this policy when the service or its data handling changes. The Last Updated date identifies the latest revision. Material changes will be communicated through the service or another appropriate method, and consent will be requested where required.
Contact information
For support, privacy questions and account deletion assistance, contact support@vitalfitapp.com.
Contact support@vitalfitapp.com for support, privacy questions and account deletion assistance. Do not send passwords, authentication tokens or unnecessary medical information.