Ascendant Privacy Policy
Last updated 16 September 2026 · Effective 16 September 2026 · Ascendant is a product of Mistiq LLC, an Illinois limited liability company, United States.
Ascendant helps you track lifting and see your progress. This policy explains what we collect, why, and the choices you have. We keep it short because we collect little.
What we collect
- Account. You sign in with Apple, Google, or an email and password through Firebase Authentication. You can also start without an account. If you provide a name or email, we store them encrypted.
- Training data you enter. Your workouts, sets, bodyweight, measurements, nutrition logs, and any progress photos you add. Progress photos never leave your phone. There is no upload and no sync for them, so we never receive one and there is nothing of theirs on our servers to delete.
- Profile basics. Sex, height, age, bodyweight, and your chosen training path, used to place your rank and estimate calories. You can change these any time in the app.
- Subscription status. If you subscribe, your subscription is billed through the Apple App Store, Google Play, or Stripe if you buy on the web. We never see or store your card details; we store only whether your subscription is active and the customer or subscription reference the store or Stripe gives us.
- Training history you import. If you import an export file from another tracker such as Strong, Hevy or Fitbod, we read the workouts in it and store them as your training history: exercise names matched to our catalogue, load, reps, effort, timestamps, workout titles, and which app the file came from. We do not keep the file itself, and we do not read its notes or any other column.
- Where you train, if you tell us. An optional country and region, used only to compare your lifts against meet results from the same place. Both are blank unless you set them.
- Usage events. We record what parts of the app get used, so we can see where people get stuck. Each event carries an install identifier, your account id once you sign in, the event name, when it happened, the app version and platform, and a small fixed set of values such as which onboarding step you reached, how many lifts you entered, a bucketed workout length, or which setting you changed. We never record the setting's value, your loads, your bodyweight, your rank, food names, or any free text. The install identifier is a random number we generate, never an advertising or hardware id, but it is pseudonymous, not anonymous: on iPhone it is kept in the Keychain, which can survive deleting and reinstalling the app, and once you sign in it is linked to your account. You can turn this off in Settings under Privacy, which stops collection and clears anything queued on your device. If your phone is set to a country in the EEA, the UK or Switzerland it is off until you turn it on.
- Video you record for verification. Only if you choose to verify a lift. See the section on verified lifts below.
How your data is protected
Your name and email are never stored in plain text. They are encrypted on our servers using envelope encryption with a key we control through our cloud provider's key service. Your training data is stored in your account and transmitted over encrypted connections.
Third parties we use
- Firebase Authentication (Google LLC, United States) for sign-in. It receives your sign-in identity: the email or the Apple or Google account you sign in with, and the device and IP details any sign-in carries.
- Apple App Store, Google Play and Stripe for subscription billing. Stripe (Stripe, Inc., United States) is used only if you buy on the web; it receives your payment details directly and gives us back a customer reference and whether the subscription is active.
- Google Cloud Vertex AI (Google LLC, United States) or OpenAI (OpenAI, L.L.C., United States) write the coaching text you read in the app and estimate a meal from a food photo or a description. Which one runs depends on how the server is configured. What they receive is listed under "What the AI provider sees" below. Under both providers' API terms what we send them is not used to train their models.
- USDA FoodData Central and Open Food Facts for nutrition lookups when you search foods. Your searches are sent to these services to return results.
- Health Connect (Android), optional. If you turn it on, we read the workout and weight data you allow, and write back the sessions you log. This is off unless you enable it.
- Motion & Fitness (iOS), optional. On iPhone, if you enable it, the app reads your step count through Apple Core Motion to show your daily activity. The count stays on your device and is off unless you allow it.
- Apple Health (iOS), optional. If you allow it, the app reads your workouts and your bodyweight, and writes back the workouts, bodyweight, food and water you log, so your other apps can see them. It is off until you grant permission, and you can withdraw it in the Health app at any time. Apple Health data is used inside the app; nothing extra is sent to our servers beyond the workouts and bodyweight you already sync.
We also download a public file of competition results from OpenPowerlifting each week to build the comparison used on your placement card. That is a download to our server. Nothing about you is sent to them.
What the AI provider sees
Two features in the app call an AI provider, and nothing else does. Your name, your email and your progress photos are never part of either.
- Coaching text. Your training path, the goal you typed if you typed one, a short summary of recent training, the names of the exercises the engine has prescribed for today and whether each is a warmup or a working set, your tier and whether you have just been promoted or levelled up, how far you have climbed, the equipment you said you have, and whether you flagged a set as painful and on which lift, so the reply can offer a gentler movement instead of pushing through. The prescribed loads, reps and effort targets themselves are not sent.
- Food estimates. If you photograph a meal, that photo is sent to the AI provider to estimate what is in it. If you describe a meal in words instead, that text is sent. The answer comes back for you to confirm or change before anything is logged.
This is the whole list. It does not include your bodyweight, your measurements, your body fat, your progress photos, your nutrition history, your verification clips, or anything you have written in a report.
What we do not do
We do not sell your data. We do not share it with advertisers. We do not run third-party ad tracking in the app.
Your rank and other lifters
Your rank is private by default. Nothing about you appears on a leaderboard unless you turn boards on yourself.
- If you join the boards, these become visible to other lifters: the display name you choose, your emblem, your rank and score, your sex, your weight class, your age class, your country if you set one, which of your lifts are video verified, and your membership of a gym board if you join one by code. Your logs, your bodyweight, your photos, your food and your email are never shown. You can leave at any time in Settings, and leaving removes you from the boards straight away.
- Verified lifts. If you choose to verify a lift, the app records a clip in the app, and we store it on our server so other lifters can judge it against a checklist. Judges see the clip, the lift, and the load and reps you claimed. They do not see your name unless it is on your board profile, and the clip is served only through short lived links tied to that viewer. We delete a clip one day after an abandoned upload, seven days after a rejection, and thirty days after approval, and immediately if you delete your account.
- Reports and blocks. If you report a clip or a lifter, we store your report, including any note you write, so we can act on it. If you block someone, we store that so the two of you stop seeing each other.
- Share cards and videos. When you share your character sheet the image is made on your device. When you share a rank up video we render it on our server and put it at an unguessable link for seven days, then delete it. It shows your rank and score only, never your name or email.
How long we keep your data
We keep your account and your training data for as long as your account is open. We do not expire it on a timer, because the whole point of the app is to show progress over years.
- If you delete your account, your profile, workouts, sets, bodyweight, measurements, nutrition and cardio logs, saved meals, custom foods, programs and rank history are erased from our live systems immediately. They are purged from our encrypted backups within 30 days. If you ask us by email instead, we complete it within 30 days, because we verify first that the request came from the account holder.
- Server access logs record requests to our servers: the time, the path, the response code, how long it took, and the network address the request came from. They hold no training data, no food, no photos and no free text you have written. They are written to our server's standard output and kept by our host for operational troubleshooting only. We do not copy them into a database, we do not build a profile from them, and we do not promise a fixed deletion window for them, because we would rather not state one than state one we do not enforce.
- Usage events are kept for at most 400 days and then deleted automatically. A job inside the API itself deletes anything older every hour, so the window does not depend on anyone remembering to run it. Deleting your account also deletes the events recorded before you signed in from the same install.
- Verification clips follow the windows above: one day abandoned, seven days after a rejection, thirty days after approval. Deleting your account deletes the files as well as the records.
- Shared rank up videos are deleted seven days after they are made. The same hourly job deletes them, so the file goes whether or not anybody renders another one, and the link stops working at seven days regardless.
- Billing records are held by Apple and Google for as long as tax and financial law requires. We never receive or store your card details.
Apart from those logs, we keep nothing of yours once your account is deleted.
Your choices
- Edit your data any time in the app.
- Delete your account from Settings. This erases your profile and training data from our servers.
- Turn off Health Connect or Apple Health at any time in your device settings or in the app.
- Turn off usage events in Settings under Privacy. The app keeps working exactly as before.
- Leave the boards in Settings. You come off them straight away, and your display name is released.
- Take your data with you. Settings can export your full training, nutrition, bodyweight and measurement history as files you keep.
- Reminders are scheduled on your device from your own log. They are not push messages, and nothing about them is sent to us.
If you are in the UK, the EEA or Switzerland
Who is responsible. The controller of your personal data is Mistiq LLC, a limited liability company formed in Illinois, United States. Write to privacy@mistiq.org for anything in this section, including a request for our postal address for formal correspondence, which we will answer in writing.
Why we are allowed to use each thing.
| What we use | What for | Lawful basis |
|---|
| Your account: sign-in identity, name and email if you give them | To give you an account and keep your training attached to it across devices | Performance of a contract, Article 6(1)(b) |
| Your training, bodyweight, measurements, nutrition and cardio logs, and your profile basics | To run the app: compute your sessions, place your rank, estimate your targets | Performance of a contract, Article 6(1)(b). Because this is health data, we also rely on your explicit consent under Article 9(2)(a), given when you choose to log it |
| Health Connect, Apple Health and Motion & Fitness | To read and write the health app you already use | Explicit consent, Articles 6(1)(a) and 9(2)(a). You grant it in your system settings and can revoke it there |
| Boards, verification clips and judging | To show your entry to other lifters and let them review a clip | Explicit consent, Articles 6(1)(a) and 9(2)(a). All of it is off until you turn it on, and leaving takes you off straight away |
| Coaching text and meal estimates sent to the AI provider | To write the coaching line and estimate what is in a meal you photograph or describe | Explicit consent, Articles 6(1)(a) and 9(2)(a), given by using the feature |
| Usage events | To see where the app loses people | Consent, Article 6(1)(a). If your phone is set to a country in the EEA, the UK or Switzerland this is off until you turn it on in Settings |
| Subscription status | To unlock what you paid for | Performance of a contract, Article 6(1)(b) |
| Reports, blocks and moderation records | To act on abuse and keep a record of what we did | Legitimate interests, Article 6(1)(f): keeping the community safe for everyone using it |
| Server access logs, rate limiting and abuse prevention | To keep the service up and to stop attacks | Legitimate interests, Article 6(1)(f) |
Where your data goes. Our servers and database are in France, at OVH. Four of the services above are in the United States: Firebase Authentication and Google Cloud Vertex AI (Google LLC), OpenAI, and Stripe. Those transfers are made under the European Commission's Standard Contractual Clauses and the UK Addendum to them, which are part of each provider's data processing terms, together with the technical measures described above: your name and email are encrypted before they are stored, everything travels over encrypted connections, and the AI provider receives only the fields listed under "What the AI provider sees". Google and Stripe are additionally self-certified under the EU-US Data Privacy Framework, its UK extension and the Swiss-US framework. OpenAI is not on that list, so that transfer rests on the Standard Contractual Clauses alone.
How long we keep each category.
| Category | Kept for |
|---|
| Account, profile, training, bodyweight, measurements, nutrition, cardio, programs, rank history | As long as your account is open. Erased from live systems immediately when you delete it, and from encrypted backups within 30 days |
| Progress photos | Never sent to us. They live on your phone until you delete them |
| Verification clips | 1 day after an abandoned upload, 7 days after a rejection, 30 days after approval, immediately on account deletion |
| Shared rank up videos | 7 days from when they are made |
| Usage events | 400 days at most |
| Reports, blocks and moderation records | As long as your account is open, so a repeat pattern is still visible. Erased on account deletion |
| Server access logs | Kept by our host for operational troubleshooting. We do not copy them anywhere and we do not state a fixed window, because we do not enforce one |
Your rights. You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form; the app can already export the whole training history itself. Where we rely on your consent you can withdraw it at any time, and that does not affect what we did before you withdrew it. Ask at privacy@mistiq.org; we answer within one month.
Complaining. If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to your data protection supervisory authority without going through us: in the UK the Information Commissioner's Office at ico.org.uk/make-a-complaint, in the EEA the authority in the country where you live, work or where the problem happened (the list is at edpb.europa.eu), and in Switzerland the Federal Data Protection and Information Commissioner.
Children
Ascendant is not for children. You need to be at least 13 to have an account, and the app asks your age during setup and refuses to create one below that. Boards, verification clips and judging, which are the only parts other people can see, open at 16. If you tell us an account belongs to someone younger than 13, write to privacy@mistiq.org and we will delete it and everything attached to it.
Contact
Questions about your data: privacy@mistiq.org.
Consumer health data
Washington, Nevada and similar laws require a separate policy for consumer health data. Ours is here: Consumer Health Data Privacy Policy. It lists exactly what health data we hold, who receives it, and confirms we do not sell it.