Privacy policy
This page says what Voimana collects, why, who handles it, and what you can do about it. It covers the Voimana app for iPhone and this website.
At a glance
- We treat everything you log as health data. We keep it on your phone and on our server in Oregon, United States, so your history comes back when you sign in on a new phone. Where it is kept
- We use it only to run the app for you, keep it secure and fix problems you report. Only if you say yes, we also count how often you train, to learn whether people keep training with Voimana. Why we use it
- Once you agree to this policy, a crash sends us a report that is not linked to your account and holds nothing you logged. Crash reports
- The companies named in this policy handle parts of it for us, each only to do the job written beside it, such as Supabase for our server and Resend for our emails. The companies that handle it for us
- We never sell your data, never use it for ads, and never track you across other apps. What we never do
- You can export your history, turn sharing off, or delete your account, from Profile. Your rights · Deleting your data
Who runs Voimana
Voimana is made and run by one person, Josiel Loya, in Colorado, United States. When this policy says "we", it means Josiel. You can reach us at privacy@voimana.com. For feedback or a problem with the app, write to support@voimana.com.
What we collect
What you put into the app, what the app needs to work, reports of its crashes, and, only if you say yes, how often you train. We do not ask for your name, age, sex, height or birthday, and the app reads nothing from Apple Health, your contacts, your photos or your location.
Your account
Your email address and password are how you sign in and reach your history, on this phone or a new one.
Your email address, your account id, your password (of which Supabase keeps only a scrambled form that cannot be turned back into it), when you last signed in, and the IP address and device details of each phone you are signed in on. On your phone, your sign in is kept in the iOS Keychain, the phone's secure storage.
Your training
Your workouts are saved to your account, so a new or reset phone gets them back when you sign in.
Your workouts, the exercises you create, the exercises in each workout, your sets (weight, reps, time, distance, RPE, which is how hard a set felt, and set type), your templates and the rest settings you choose for an exercise. The records the app shows you are worked out from these.
Your body measurements
Your measurements are saved to your account, so they come back on a new phone, and you can follow each one over time on a chart.
Your body weight, body fat and the 15 tape measurements the app offers.
Your words
The names and notes you write are saved with your workouts, so they come back with your history on a new phone.
The words you type: the names of your workouts, templates and exercises, and the notes on an exercise or a set.
Your settings
Your units and rest timer stay the way you set them, on this phone and on the next one you sign in on.
Your units, your rest timer defaults, your timer step, the record of when you agreed to this policy, and your answer to whether you share how often you train, with when you gave it.
What stays on your phone
This is what lets you log a whole workout with no connection: your changes wait on your phone and reach our server when you are back online.
What the app needs to work on this phone: the queue of changes waiting to sync, where a download left off, your import choices and the rest timer in progress. It never leaves your phone, except as the changes it carries to our server.
How often you train, if you say yes
Sharing how often you train does nothing for you inside the app. It tells us whether people keep training with Voimana week after week. Saying no changes nothing else in the app, and your history is saved either way.
The app asks whether you want to share this, with yes and no equally easy, and no answer means no. Only if you say yes: each workout you finish, marked only with its week, and that you turned sharing on. Never the day or time you trained, or anything you logged. A workout is reported only once its week is over, so the time you trained stays on your phone; PostHog notes only when each report was sent. Workouts from before you said yes, or brought back from our server or from Strong, are never reported. You can turn sharing off in Profile at any time.
Crash reports
This is how a crash reaches us without you having to report it.
Once you have agreed to this policy, a report when the app crashes, or iOS closes it while you are using it: when it happened, where in the app's code it went wrong, details of the phone (its model, memory, screen size, processor and temperature, the iOS version and build, and its language setting), the app version and when it started, and random ids for this installation and for each launch, one of them a scrambled form of the id iOS gives the app on this phone. And when changes have waited a long time to sync, how many were waiting, for how long, and the last error with every id and value removed. These reports never carry your account, your email address or anything you logged, so they are not linked to your account.
Importing and exporting
When you import an export from Strong, the app reads its own copy of the file on your phone and then deletes that copy. Only the workouts and measurements it found are kept. Your original file stays where you saved it.
When you export your data, the file is built on your phone and goes only where you send it. We never see it.
Why we use it
Only for these:
- to store, sync and restore your history, so it is safe and comes back on a new phone;
- to show you your progress, like your records and your charts;
- to keep the service secure;
- to fix a problem you report to us;
- to find and fix crashes and sync problems, from the crash and sync reports;
- only if you say yes, to learn whether people keep training with Voimana week after week.
Nothing else.
Where it is kept
- On your phone, protected by iOS's file encryption, which works when your phone has a passcode.
- On Supabase's servers in Oregon, United States.
- Crash reports on Sentry's servers, and, if you say yes, the workout reports on PostHog's servers, both in the United States.
- In your iPhone backup, if you make one (in iCloud or on a computer). That backup is yours, and it holds the app's data as it does every app's.
The companies that handle it for us
We share your data with no one. These companies handle parts of it on our behalf, only to do the job written beside each one.
Supabase
Runs our database, sign in and server functions, on Amazon Web Services in Oregon, United States. It receives your account, training, body measurements, words and settings, as described above; what stays on your phone, the crash reports and the workout reports never reach it. Like any server, it also keeps technical logs of each request, your IP address among them, which expire as Deleting your data says.
Resend
Sends the emails with your 6 digit codes, when you sign up or reset your password, through Amazon. It receives your email address.
Cloudflare
Serves voimana.com and forwards mail sent to privacy@voimana.com and support@voimana.com. It receives no app data. It handles your IP address to deliver a page to you, and the emails you send us pass through it.
Apple
Delivers the app through TestFlight, Apple's app for trying an app before its release, while Voimana is being tested. It receives the crash reports and feedback you choose to send while testing. Apple's own privacy policy covers what Apple collects.
Hosts the mailbox that privacy@voimana.com and support@voimana.com forward to. It receives what you email us.
PostHog
Counts, for the people who say yes, whether people keep training with Voimana week after week, and stores it for us in the United States. Only if you say yes, it receives each workout you finish, marked only with its week (never the day or time you trained, or anything you logged), that you turned sharing on, the time each of these reports was sent, your account id, and the app and iOS versions. When you delete your account, it receives your account id so it can delete what it holds, even if you never said yes. Like any server, it receives your IP address with each request; it does not store it.
Sentry
Collects crash reports, so a crash reaches us without you having to report it, and stores them for us in the United States. Once you have agreed to this policy, it receives the crash reports and sync reports described above. It never receives your account, your email address or anything you logged. Like any server, it receives your IP address with each request; it does not store it.
What we never do
- We never sell your data.
- We never use it for advertising.
- We never track you across other companies' apps or websites.
- We never give it to data brokers.
- We never use your health or fitness data for marketing.
- We never put it in iCloud ourselves. Your own iPhone backup may include the app, as it does every app.
- We hand it over only when the law makes us, and then we tell you, unless the law forbids that.
Your health data
We treat everything you log as health data: your workouts and sets, the words you type, your body measurements, and, if you share it, how often you train. The app asks for your agreement before you log anything, and asks again before we collect a new kind of data, use a new company, or use your data in a new way. Sharing how often you train is a separate question: the app asks it once, and only a yes shares anything. You can withdraw your agreement at any time by deleting your account, or by emailing us, and turn sharing off in Profile at any time. Our consumer health data privacy policy says the same in the form Washington's My Health My Data Act asks for.
How long we keep it
As long as your account exists. The app deletes nothing of yours on a schedule, because your history is the point of it. The technical copies our providers keep expire on their own, as Deleting your data says.
PostHog keeps each workout report for 365 days, and the record of your account id and app versions until you delete your account. Sentry keeps each crash report for 30 days.
Deleting your data
Deleting your account (in the app, Profile, then Delete account) removes every workout, set, measurement, template and note from our server right away, and clears this phone. The copies our providers keep expire on their own: their technical logs within 7 days, backups of our database within 7 days, and their records of the emails we sent you within 30 days.
Deleting your account also asks PostHog to delete everything it holds for your account, before anything else is deleted. If PostHog does not confirm, nothing is deleted and the app tells you. PostHog deletes it within 45 days. Turning sharing off, or signing out, removes from your phone the workout reports waiting to be sent, without sending them; what was already sent stays with PostHog until it expires or you delete your account. Crash reports are not linked to your account, so we cannot tell which are yours to delete; each one is gone after 30 days.
Deleting a single workout, set, measurement or template hides it everywhere in the app. The hidden copy stays on your phone and on our server until your account is deleted, because that is how the app makes a deletion reach every copy of your data. If you want one item erased for good, email us and we will erase it from our server. The hidden copy on your phone goes when you sign out or delete your account.
If you are signed in on another phone, the copy there stays until you sign out on it. An iPhone backup you made earlier keeps what it held until you replace or delete that backup.
Your rights
- See it and take a copy. In the app, Profile, then Export all your data, gives you a copy of your workouts, measurements, templates, exercises and settings. It leaves out what you deleted, a workout still in progress and what PostHog holds; email us for those.
- Correct it. Edit your workouts, measurements, templates and settings in the app. For anything else, like your email address, email us.
- Delete it. In the app, or by email.
- Withdraw your agreement. Delete your account, or email us and we will delete it for you.
- Stop sharing. Turn off sharing how often you train, in the app, Profile, at any time. It stops at once.
- Know who has it. Ask us, and we will confirm what we hold about you and list every company that handles it (they are all named above).
- Appeal. If we turn a request down, reply to our answer and we will look at it again.
Email us from the address on your account, so we know it is you. We answer within 30 days, and using a right never costs you anything.
Children
Voimana is not for anyone under 13. If we learn that an account belongs to someone younger than that, we delete it.
How we protect it
- Everything between the app and our server is encrypted on the way.
- On our server, Supabase encrypts it while it is stored.
- On your phone, iOS's file encryption protects it when your phone has a passcode, and your sign in lives in the iOS Keychain, the phone's secure storage.
- Through the app, each account can reach only its own data (our database checks every request; this is called row level security).
Who looks at your data
We open your data only to fix a problem you reported to us, to answer a request you make under Your rights, or to keep the service running, and we let nobody else open it. That is a promise about what we do, not a claim that it cannot be done: whoever runs a service like this one can reach its database. Supabase's own staff are bound by Supabase's terms.
We read what PostHog counts as totals across everyone who said yes, and open one person's weeks only to answer a request they make under Your rights. We read each crash report to fix the crash.
If someone gets into your data
If we confirm that someone got into your data, we tell you by email within 72 hours, with what happened and what we did about it.
AI
No AI service receives your data today. Before that changes, the app will ask you.
This website
voimana.com sets no cookies, runs no scripts and no analytics, and loads nothing from anywhere else. Cloudflare handles your IP address to deliver the page.
Changes to this policy
This is version 2, effective . When we change something that matters (a new kind of data, a new company, a new use of your data), the version goes up and the app asks you again before anything new happens. A change of wording only changes the date.
What changed in version 2:
Voimana now asks whether you want to share with PostHog each workout you finish, marked only with its week, to learn whether people keep training, and sends crash reports to Sentry that are not linked to your account and hold nothing you logged.
On 2026-10-19 we also reworded this page: a summary at the top, and a line on what each kind of data does for you. Nothing we collect, use or share changed.
On 2026-10-20 we added support@voimana.com, an address for feedback and problems with the app, which Cloudflare forwards to the same mailbox as privacy@voimana.com. Nothing we collect, use or share changed.
On the app's Account screen became Profile, and this page now calls it that. Nothing we collect, use or share changed.
Version 1, effective 2026-10-17, was our first privacy policy.
Contact
Email privacy@voimana.com, from the address on your account so we know it is you.
For feedback or a problem with the app, write to support@voimana.com, or use Send feedback in Profile.