Pump⚡︎Lab Privacy Policy

Last updated: August 1, 2026

Overview

Pump!Lab ("we", "our", "the app") is a workout tracking application. We are committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

• Account information: Your chosen display name, email address, and optional password (stored as a one-way hash).
• Workout data: Exercises, sets, reps, weights, cardio activities, and related workout metrics you enter.
• App preferences: Settings such as text size, unit preferences, and display options.
• Apple Health data (iOS only): With your permission, the app reads and writes workout data (exercise type, duration, calories burned, distance) to Apple HealthKit. The app also reads (but does not write) heart rate, resting heart rate, and heart rate variability (HRV), and — only when you choose "Download from Apple Health" in Personal Metrics — your most recent body weight. Heart rate and HRV are used on your device to display workout intensity zones and recovery readiness and are not uploaded to our servers. Imported body weight is used to calculate your Pump!Score and is saved as your profile weight, which syncs to your account like other profile data (see How Data Is Stored below). Other Apple Health data stays on your device and in Apple Health and is not uploaded to our servers. If you consent to Coach Max / Coach Maxine, workout and heart rate data may be sent to Google Cloud for processing (see Coach Max / Coach Maxine section below).
• Location data (iOS only): With your permission, the app accesses your location during outdoor workouts (running, cycling, hiking) to track distance and route. Location data is used only during active workout tracking and is not stored on our servers.
• Motion data (iOS only): With your permission, the app accesses motion sensors to track steps and distance during treadmill workouts. This data is not stored on our servers.
• Date of birth (optional): Collected only if you opt in to the Personalized Avatar feature, to verify you are 18 or older. Not collected if you do not use Personalized Avatar.
• Face photo and biometric data (optional, Premium feature): Collected only if you opt in to Personalized Avatar. See the "Personalized Avatar and Biometric Data" section below.

How Data Is Stored

• Locally on your device: Workout data and preferences are stored in your browser's local storage for offline access.
• Cloud sync: Data is synced to Google Firebase (Firestore) to enable access across devices and group features. Data is transmitted over encrypted (HTTPS) connections.

How We Use Your Data

• To provide and improve the workout tracking service.
• To sync your data across your devices.
• To enable group and social features (leaderboards, shared workouts) with users you choose to connect with.
• To send password reset emails if you request one.

Subscriptions

If you subscribe to Pump!Lab Premium, your subscription is processed by Apple through standard StoreKit. We receive your subscription status (active, expired, refunded, trial) from Apple via App Store Server Notifications. We do not receive or store your payment method or financial details — these are handled entirely by Apple.

Your subscription status is stored on your user account so that premium features are available to you across your devices.

Coach Max / Coach Maxine (AI Training Assistant)

If you consent to Coach Max / Coach Maxine, your workout history, heart rate data (if available from Apple Health), muscle scores, profile data (gender, age, weight, height, fitness goals), and pump metrics may be sent to Google's Vertex AI service to generate personalized training conversations.

These requests are sent from the app to a Pump!Lab server, which forwards them to Google's Vertex AI and returns the reply to you. We do not store your Coach Max conversations or the data sent with them on our servers; the request is passed through and not retained. To prevent abuse, our server keeps a short-lived count of requests per network address, which is not linked to your conversations.

Google does not use this data to train AI models. Logs may be retained transiently for safety and abuse review, then deleted. Google Cloud maintains industry-standard privacy and security protections.

You must explicitly consent before any data is sent, and you can revoke consent at any time in Settings.

Coach Max / Coach Maxine is a feature of Pump!Lab Premium for unlimited use. Free tier users may have up to 3 conversations per rolling 7-day period.

Trainer Mode (Sharing With a Trainer)

Pump!Lab includes an optional Trainer Mode that lets you connect with a personal trainer inside the app. Nothing is shared with any trainer unless you explicitly connect to that trainer by entering their invite code and accepting the consent screen shown at that time.

• What a connected trainer can see: your display name, Pump!Score (current, 7-day, and trend), workout log (exercises, sets, reps, weights, and cardio activity details), Muscle Map, goal tier, streak, and recent activity. Where your workout history includes entries imported from Apple Health (for example workouts or daily steps), those entries and the scores derived from them are part of what you share.
• Optional extras (off by default): your height & weight and your age are shared only if you turn on their separate toggles — on the consent screen or later in Settings → My Trainer. Turning a toggle off removes those values from what trainers can see. If you share these while connected to more than one trainer, all of your connected trainers can see them.
• What trainers can never see: your GPS route maps, your Rack activity, your body type, your email address, or your password.
• Routines and messages: a connected trainer may send you workout routines and programs — including prescribed weights and reps — which you can accept or decline, and may message you through the app’s existing messaging. You can flag or report messages and disconnect from a trainer at any time.
• Disconnecting: you may disconnect from a trainer at any time in Settings → My Trainer. A disconnected trainer immediately loses access to your shared data, and when you disconnect your last trainer your shared training summaries are deleted from our servers.

If you enable Trainer Mode as a trainer, clients who connect to you see your display name, and routines or programs you send become part of the recipient’s account data.

Personalized Avatar and Biometric Data (Premium Feature)

If you opt in to the Personalized Avatar feature, you may capture or upload a photo of your face. Your photo is sent once, through a Pump!Lab server, to Google Vertex AI (Gemini) to generate a personalized illustrated avatar. The original photo is passed through and is not stored on Pump!Lab servers. Google may briefly retain the photo for safety review per Vertex AI commercial terms; it is not used to train AI models.

The data extracted from your photo to generate the avatar is biometric information and sensitive personal information under privacy laws including the California Consumer Privacy Act.

Your generated avatar is stored on your device by default. If you enable Avatar Sharing, your avatar is also stored on your Pump!Lab account so it can appear to other Pump!Lab users — next to your name on the Leaderboard, your posts in The Rack, and your messages in Chat — and sync across your devices. Disabling Avatar Sharing deletes the account-stored copy.

Personalized Avatar is restricted to users 18 and older. Biometric privacy laws place special requirements on collecting this data from minors, and we've chosen to limit the feature to adults. We collect your date of birth at opt-in to verify age. We do not retain DOB for users who do not opt in.

Personalized Avatar is not available to users in Illinois due to Illinois Biometric Information Privacy Act (BIPA) compliance.

You can revoke consent and delete your avatar at any time in Settings → Personalize Avatar. Deleting your avatar removes it from both your device and our servers (if previously uploaded for Avatar Sharing). You may also exercise your rights to know, delete, and limit the use of sensitive personal information by contacting us at info@pump-lab.com.

Data We Do NOT Collect

• We do not collect your phone number or real name (unless you choose to use it as your display name).
• We do not use advertising or ad tracking.
• We do not sell, share, or transfer your personal data to third parties for marketing purposes.
• We do not use analytics tracking services.

Apple HealthKit (iOS App)

The Pump!Lab iOS app integrates with Apple HealthKit to read and write workout data and to read heart rate, resting heart rate, HRV, and — only when you tap "Download from Apple Health" — your most recent body weight. This integration is entirely optional and requires your explicit permission. Health data read by the app is processed locally on your device and is not sent to our servers, sold, or shared with third parties, with two exceptions: (1) body weight you import is saved as your profile weight and syncs to your account like other profile data; and (2) if you separately consent to Coach Max / Coach Maxine, workout and heart rate data may be sent to Google Cloud's Vertex AI for processing (see Coach Max / Coach Maxine section above). We do not use HealthKit data for advertising or marketing purposes. Workout entries derived from Apple Health data are shared with a personal trainer only if you explicitly connect to that trainer through Trainer Mode (see the Trainer Mode section above); nothing is shared with any trainer without your consent. You can revoke HealthKit access at any time in your device's Settings > Health > Data Access.

Third-Party Services

We use Google Firebase for cloud data storage and hosting. Firebase's privacy policy can be found at firebase.google.com/support/privacy.

We use Capgo (capgo.app) to deliver over-the-air updates of app content (JavaScript, HTML, CSS) to the iOS app. For this purpose, Capgo receives a per-install device identifier (stored on your device and not linked to your identity) along with app and OS version metadata. This data is used solely to route the correct update bundle to your device. Capgo's optional analytics telemetry is disabled.

Data Retention & Deletion

Your data is retained as long as you use the app. You may request deletion of your account and all associated data at any time by contacting us at info@pump-lab.com.

Children's Privacy

Pump!Lab is not directed at children under 13. We do not knowingly collect data from children under 13.

The Personalized Avatar feature is restricted to users 18 years of age or older.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact Us

If you have questions about this privacy policy or your data, contact us at info@pump-lab.com.