Privacy Policy

Interdependence is small, and there is no data strategy here: no ad business, nothing clever being done with what you log. Here's the honest version of what we collect and why, in plain English, for both the app and this website.

Interdependence Fitness Limited is the data controller for everything described here: a company registered in England and Wales, company number 17420484, and registered with the Information Commissioner's Office under number ZC248935. If you want to see what we hold, correct it, get a copy, or have it deleted, email privacy@interdependence.app and a real person will reply within a month. Prefer a form? Use our contact form, and pick "My data and privacy".

If you're unhappy with how we've handled your data, you can also complain to the Information Commissioner's Office at ico.org.uk. We'd rather you told us first so we can put it right, but that's your call.

Running your account and the core app (the training, food and body data under "What the app collects" below) is processing we need to do to provide the service you signed up for, what the law calls performance of a contract. Security logging and abuse prevention, the kind that stops accounts being hijacked or scraped, relies on our legitimate interest in running a working, safe service, weighed against your right to privacy. The GLP-1 and supplement or medical fields are the one place we ask for your separate, explicit consent, because health data needs it under UK GDPR (see "Health information you choose to share" below); you can withdraw that consent at any time without it affecting the rest of your account.

We keep your account data for as long as your account is open. What happens once you delete it, including how long backups and the deletion receipt are kept afterwards, is on the delete your account page.

If you send us a message through the contact form, we keep that request for 2 years after we close it. It's deleted along with your account, and sooner if you ask us to.

The contact form uses Cloudflare's Turnstile check to tell people from bots. Cloudflare already hosts this site.

On top of seeing, correcting, exporting, or deleting your data (covered here and further down this page), UK GDPR also gives you the right to ask us to restrict how we use your data and to object to processing that relies on our legitimate interest. Email privacy@interdependence.app for either and we'll sort it out within a month.

To run your account: your email address, a hashed password (it comes out as gibberish even to us, so we genuinely can't see your actual password), and a display name.

To run the app: the workouts, exercises, day templates, and sets/reps/weights you log; food and macro entries, custom foods you add, and daily targets; bodyweight entries and goals; and progress photos you choose to upload.

If you use barcode scanning or the food search, the barcode or search term is sent to Open Food Facts (a free, public, open food database) to look up nutrition info. Nothing else about you goes with that request.

The gym directory used for check-in (name/address/location search) is sourced from OpenStreetMap, © OpenStreetMap contributors, available under the Open Database Licence (ODbL); see openstreetmap.org/copyright. How the app uses your location is in its own section, "Where we use your location", below.

Health Connect (Android) and Apple Health (iPhone): if you turn on health sync under You, then Health and devices, the app reads your steps, active energy, resting heart rate and sleep from Health Connect or Apple Health, and writes the workouts and weight you log back to it. Nothing is read until you turn it on and allow it on your phone. What it reads stays on your phone, to show you your own trends; we don't copy it to our servers. It's never used for advertising, never sold and never shared. The one exception is the AI Coach, and only once you've agreed to it on the screen it shows you and, for heart rate, HRV and sleep, switched on its own separate option in this section (see below). To stop, turn health sync off in the You tab, or remove our access in the Health Connect or Apple Health app.

Anything AI in the app runs on Anthropic's Claude API, and only what that feature needs goes over, only when you use it. The app asks you first: before the AI Coach reads anything, and before a scan or a suggestion sends anything, it shows you a screen saying exactly what goes to Anthropic, and nothing is sent until you tap Agree. You can take it back any time in the You tab, under AI and your data, and from then on nothing is sent. If you never touch an AI feature, none of this reaches Anthropic.

To write your analysis, the AI Coach sends a summary of your training to Anthropic's Claude API: your workouts and personal bests, the notes you wrote on sessions, your template and exercise names, and your weekly check-in (soreness, sleep, motivation, how closely you stuck to plan, and any notes you added). If you've connected WHOOP or Oura, or switched on heart rate and sleep trends for the AI Coach, those go too. Heart rate, sleep and the like count as health information, and you're choosing to share it. Session and check-in notes go exactly as you typed them, so leave out anything you'd rather keep private. Not your name, your email, your food, your photos or your exact weight.

Heart rate, HRV and sleep need two steps from you: agreeing on the AI Coach screen, and turning on the separate AI Coach option in the Health Connect (or Apple Health) section of the You tab, which is off until you do. Even then they go only as whether they're above, below or around your usual, never the readings themselves.

Scans and suggestions send only what they need, and the app asks before the camera opens. Your meal photo goes to Anthropic's Claude API so it can estimate what's on the plate. Your photos of a package go so it can read the label. Your phone turns what you say into text, and only that text goes to Anthropic's Claude API so it can work out what you ate; on Android, that step can be done by Google's speech service, which isn't ours. The workout notes you paste, or your photo of a workout, go so it can turn them into a workout. For a meal idea, your calories and macros left for today, plus the names and macros of the foods and recipes in your library, go so it can pick one. Nothing else goes: not your name, your email or the rest of your logs. If a photo or your notes show something about your health, that counts as health information, and you're choosing to share it.

The AI is an AI, not a coach or a doctor, and what it says isn't medical advice.

Where we want to get to: running the AI ourselves, so even that aggregated summary stays with us and no outside company is involved in it at all. That needs money we don't have yet, so take it as the direction we're heading rather than a promise with a date on it. If it changes, this page changes with it, and if it ever stops being the plan, we'll say so here rather than quietly dropping it.

Oura, WHOOP and Withings connections are switched off for now, so the app doesn't talk to any of them.

The app asks for your location in six places. Each one starts with something you do: a tap, a switch you turn on, or starting a run. Here's what each one does with it.

• Gyms near me. Your position goes to our server to find gyms close to you. The app holds it in memory on that screen, so a name search you do next is still near you, and lets go of it when you close the screen. We don't store it.
• Find a coach near me. Same again: your position goes with the search to find coaches close to you, and we don't store it.
• Suggesting a gym. If you use your current location in the gym picker and then suggest a gym that isn't listed, we keep that position, with your suggestion and your account, in a suggestions list so we can add the gym. Only our admins can see that list. We delete the position once we've looked at your suggestion, and after 90 days at the latest; your suggestion itself stays until you delete your account. If we add the gym, that spot becomes the gym's listed location for everyone, with nothing about you attached.
• Your coaching base. If you're a coach and set a base, we store it, rounded to about a kilometre, with the place name you typed, so clients can find you. People searching see it rounded the same way.
• Auto check-in. It's off until you switch it on. Once it's on, the app reads your position when you open it and when you start a workout, without you tapping anything, and compares it on your phone with gyms saved there. It never sends that position anywhere.
• Runs, walks, rides and swims. While you're tracking one, the app follows your position to add up the distance. On an iPhone it keeps doing that with your screen locked (you'll see the blue location indicator). It saves the distance and the time, never the route.

Apart from the suggestion and the coaching base above, we don't write your position to our database, and our own systems don't log it. Searches do travel to our servers, which run on Cloudflare like everything else in the app.

Two parts of the app ask for something that counts as special category health data under UK GDPR: whether you take or plan to take a GLP-1 medication like Ozempic (it changes how your calorie and protein targets get worked out, and your risk of losing muscle along with fat), and a free-text field for supplements and medical context, things like iron deficiency or creatine. Both are entirely optional. Skip them and the app works exactly the same, nothing is disabled or nagged about.

Because it's health data, we don't rely on the same basis as the rest of your account for it. We ask for your explicit consent before we store any of it, separate from agreeing to this policy as a whole, and that consent has to be freely given, specific to this data, and something you can take back whenever you want, not a box ticked once and forgotten.

The GLP-1 answer feeds into how your calorie and protein targets are worked out. The supplement and medical notes are for your own reference and aren't used to calculate anything automatically. Both are stored in the same place as everything else you log: a Cloudflare D1 database, with a copy on your device. Neither is sent to Anthropic or anyone else unless this page says otherwise elsewhere.

You can clear or change either of them at any time from your profile, the same way as any other detail you log. That withdraws your consent and stops it being used going forward. Deleting your account removes it completely, using the export and delete controls further down this page.

This site doesn't set tracking or advertising cookies and doesn't run analytics that fingerprint you. If you already have an Interdependence account, you can sign in here to use the web tools: your food diary and progress charts, and, if you're a coach, your client list. Signing in sets one cookie, called session, that keeps you logged in. Sign-in can't work without it, only our servers can read it, and logging out clears it. You can't sign up on the site; new accounts are made in the app. Anything you do in the web tools is the same data, kept in the same place, as in the app, so everything above covers it.

Standard web hosting logs (via Cloudflare) apply here the same as on any website: request metadata like IP address and user agent, kept briefly for security and abuse prevention, not used to build a profile of you.

If you leave your email on our join-the-test page, we keep it so we can send you a test invite. If you tick the box, we also use it to tell you when the apps launch and about coaches near you; if you do not tick it, we only ever send the invite. We keep the address until the apps launch publicly or until you ask us to remove it, whichever comes first. Email hello@interdependence.app and we delete it the same week. We do not share it with anyone, and we do not use it for anything else.

Account and log data lives in a Cloudflare D1 database. A copy is also kept on your device (in the app's local storage) so it keeps working offline and syncs when you're back online.

We back the database up every day. The backups are encrypted and stored with Cloudflare, in its R2 storage. We keep each daily backup for 35 days and a monthly backup for no more than 90 days, so once you delete your account, your data drops out of every backup within 90 days.

Progress photos are stored the same way as everything else you log, tied to your account only.

Cloudflare runs our servers and database, and Anthropic processes the AI features on our instructions, as our processor, and doesn't use what it receives to train its models (what they receive is set out above). Both are US companies, so your data may be processed in the United States. The protection travels with it: Cloudflare is certified under the UK extension to the EU-US Data Privacy Framework and also signs the UK's International Data Transfer Addendum, and Anthropic's data processing terms include the same UK Addendum to the standard contractual clauses. How long anything is kept once you delete your account is on the delete your account page.

Foods you add are shared with other users without your name, to grow the food list; switch "Keep private" on any food you'd rather keep to yourself. Only the person who added a food can rename or delete it. The built-in exercise library is visible to everyone and can't be edited by anyone.

Your workouts, sessions, bodyweight, macros, and photos are private to your account. If you switch on Shared Progress, the people you approve to follow you can see what you've chosen to share: your workouts, including any notes you wrote on them, and, on a separate switch, your templates. Nobody sees any of it until you accept their follow request, and you can remove a follower whenever you like without them being told.

Your coach sees your account name. Followers you've accepted see your public name, whichyou can set at the top of the You tab, or your account name if you haven't set one. Everyone else, including anyone with a link you've shared, sees your public name; if you haven't set one, they see "Interdependence member". When you ask to follow someone, they see your public name, or your account name if you haven't set one, so they know who's asking.

If you share a single workout or a programme as a link, anyone with that link can see it. A workout shows the exercises, sets and date, never your notes. A programme leaves your exercise notes out unless you choose to include them when you make the link. That works even if you don't share anything else, and the link keeps working until you turn it off.

You can also share a picture of a workout, a personal best, your streak, or a photo with your stats on it. The app draws that picture on your phone and hands it to whichever app you pick, like Instagram or WhatsApp; we don't post anything for you, and nothing is sent to us. If you add a photo, the picture that leaves your phone is freshly drawn, so it carries no location or camera details from the original.

If your coach sends you a plan, nothing is added to your account until you accept it. Plans from your coach are labelled as theirs, you can remove one whenever you like, and your coach is told it was removed but not why.

Booking a session works the same way as the rest of your coaching relationship: your coach sees the sessions you book with them, including a request that's still waiting on their answer, and when and how you cancel. If a coach has switched on "approve each booking", your request holds the slot until they answer or it expires; nobody else sees that it was requested. If you cancel inside your coach's notice period, that's recorded against the booking, never blocked and never charged, since there's no payment involved. After a session's time has passed, your coach can mark it attended or no-show; those counts are visible only to that coach, never shared with other coaches or other clients, and are deleted with the rest of your bookings if you delete your account.

If your coach approves each booking and you ask for a time less than two hours away, the request is refused straight away: nothing is saved, and your coach isn't told you tried.

If you add your Interdependence calendar to Outlook, Google Calendar or Apple Calendar, that calendar service fetches your sessions and planned workouts from a private address and keeps its own copy under its own privacy terms. The address is a secret: anyone who has it can seethose entries, so make a new one from the You tab if it gets shared. Making a new address stops future updates to the old one, but the copy your calendar service already holds stays with that service until you remove the calendar there.

If you're a coach and list yourself in the app's Find a Coach directory, anyone using the app who searches near you sees the profile info you choose to list: your name, bio and general location. That's the point of a directory. Don't list anything there you wouldn't want a stranger to see.

If you allow notifications, your phone gets a short alert when something is waiting for you: a coach has sent you a plan, suggested new targets or a goal, asked you to fill in a form, or asked to connect, or a friend has sent you a routine. Each one is a fixed sentence, such as "Your coach sent you a plan". It never carries a name, anything about your health, or the text of anything you've been sent, because a notification shows on your lock screen and anyone holding your phone can read it. Open the app to see the detail.

We use Firebase Cloud Messaging, from Google, to deliver them, and Google handles it on our behalf as our processor. Google receives your phone's push token (a code that identifies your phone to Google), the fixed sentence, a short label saying what kind of notification it is and, sometimes, a random reference number for the plan or request it's about. Google is a US company, so that may happen in the United States. We keep the token against your account so we know where to send things, and we send no more than 30 notifications an hour to any one person. A notification is only ever a nudge: everything it mentions is also in the app.

To turn them off, switch notifications off for the app in your phone's settings. Nothing else about the app changes. To stop us using the token as well, log out: the app tells our server to stop using it, so the next person to sign in on that phone doesn't get your notifications. Deleting your account deletes every push token on it, including ones we had already stopped using.

Notifications on iPhone aren't switched on yet. When they are, they'll reach your phone through Apple's push service in the same way, with the same fixed sentences, and this page will say so.

If you're connected to a coach, the two of you can message each other. It's text only, and only the two of you can read it. A coach can't message you until you've turned messages on for them, either by saying yes to their request or by starting the conversation yourself, and you can pause it whenever you like. A message never changes anything in your account: a plan, new targets or a goal from a coach still arrive as an offer you choose to accept.

Messages aren't end-to-end encrypted. They're stored in our database like everything else you log, and we don't read them, though someone with direct access to the database could technically see them. The one time we do read a message on purpose is when one of you reports it: then an administrator reads that message and the few before it, to decide what to do, and nobody else does. Messages never go to the AI features. If you mention something about your health, that goes to your coach only, and ticking the note before your first message is you choosing to send it to them.

Messages stay for as long as you and your coach are connected. If either of you ends the connection, the conversation closes: you can both still read it and export it for 30 days, then it's deleted. If either of you deletes their account, the whole conversation goes for both of you. You can delete a message you wrote at any time, and it goes for both of you too. If a message was reported, we keep our copy of it, and of the few before it, so we can deal with the report even if the message is deleted afterwards; we delete a report 90 days after we've dealt with it, or sooner if either of you deletes your account. Our backups hold a copy until they age out, within 90 days, the same as everything else. Your messages are included when you export your data from your account.

Coach Community in the app is one shared room for approved coaches, and only approved coaches can see it or post in it. It isn't a private chat like messages with a coach, and members aren't in it. Your message shows your public name, or your account name if you haven't set a public one, and never your email. There's no extra encryption on it beyond the secure connection everything uses, and it never goes to the AI features.

You can delete a message you wrote at any time. A message is also deleted 12 months after it was posted. Anyone in the room can report a message: an administrator reads the report, and we keep a copy of the reported message and who wrote it so we can deal with it, which means deleting the message afterwards doesn't remove that copy. We delete a report's copy 12 months after we've dealt with it. Community messages are not in your data export, and deleting your account removes the ones you wrote, along with any report you made or that was made about one of your messages.

We don't sell your data, full stop, and we don't hand it to third parties for advertising or marketing; there's no ad network here to sell it to anyway. The outside services the app talks to are Open Food Facts for food lookups, Anthropic's Claude API for anything AI, and Google's Firebase Cloud Messaging for notifications. Each one is covered above.

You can export everything tied to your account as a JSON file at any time from the app's account menu. It's your data; you should be able to walk off with a copy.

You can delete your account yourself, from the You tab in the app: open Help, legal and about, scroll to the red Danger Zone and tap Delete my account. It removes your data straight away rather than putting it in a queue. If you would rather a person did it, or you cannot get into your account, email us and we will sort it out within a month. The steps, and exactly what is deleted and what is kept, are on the delete your account page.

If you go 24 months without signing in or opening the app, we delete the account and everything in it, the same as if you'd deleted it yourself. Before that we email you a warning 90 days ahead, then again at 30 and 7 days, each giving the date. Signing in or opening the app at any point cancels it and the clock starts again. We never delete an account this way if you're a paying member, an approved coach, or a client of an approved coach.

This app and website aren't intended for children under 16.

If this policy changes in a way that matters, it'll be noted here and in the app's in-app changelog rather than buried and hoped you don't notice.