OrderedStrength

Privacy

OrderedStrength Privacy Policy

Last updated: 18 October 2026. This policy covers the OrderedStrength iPhone app. It does not cover any other service.

The short version

Your training lives on your phone. We have no account system, so we do not know who you are. Seven things can leave your device, and one of them should not be there. Point 4 is left over from an earlier version of the app in which the coaching ran on a server: it sent the sets you log, it contradicted what the rest of this page promises, and it was removed from the code rather than kept and explained. It stops on your phone when you next update. It is written here because you should not have to find it in a network log.

What stays on your device

All of this is stored on your iPhone. Nothing here is sent to us except where points 1, 2, 4 and 7 below say otherwise:

  • Your name, age, bodyweight, height and sex, if you enter them. Bodyweight is also read from Apple Health when you grant permission, so it can reach the app without you typing it.
  • Every set you log: exercise, weight, reps, and the reps you had left in reserve. Point 4 explains what happened to this one.
  • Any injury you record, and how you said it felt.
  • What your Apple Watch and AirPods feel during a set. It is worked out on your devices and kept on your iPhone, never sent to us.
  • Everything the coach learns about you: your strength estimates, his estimate of your fatigue, the adjustments he makes as his predictions are checked against what you actually lift, and your history.

If you delete the app, this goes with it. That is why the app offers a backup file you keep yourself, and why, after a completed workout and at most once a day, it also keeps a dated safety copy on the phone and, when iCloud Drive is on, in your own iCloud Drive, where a new install can find it and offer it back. From the day Pro goes on sale, the app also keeps the date your free 28 days began, in your own iCloud storage and in this phone's keychain (the safe place where iOS keeps passwords). iOS keeps the keychain even after an app is deleted, so reinstalling does not restart your 28 days. Some test versions from September 2026 saved this date early. That early date is not used: your 28 days never start before Pro goes on sale. The date in the keychain never leaves the phone. What goes to iCloud goes to your own iCloud account, under Apple's terms, not to us. We hold no copy and cannot read any of it. That is why none of it is in the seven things below.

Apple Health

Only if you grant permission, the app reads: heart rate variability, resting heart rate, heart rate, sleep analysis, active energy, step count, respiratory rate, body mass, your completed workouts, and walking, running, cycling and swimming distance. It writes completed workouts and active energy back to Health so they appear alongside your other activity. The Apple Watch app, if you install it, reads heart rate, active energy and your workouts on the watch, and writes the workouts you log there.

Health data is used on your device to inform recovery and readiness. Raw Apple Health records never leave your phone. The one exception is point 2: if you turn Cloud Answers in Chat on, the training context sent with your question can include a line derived from that data, such as your sleep debt in hours, or how many days of heart-rate variability Jerry has seen. You can revoke access at any time in Apple Health, and the app keeps working without it.

The seven things that can leave your device

1. Jerry's voice · on when the spoken coaching voice is on

To speak in a natural voice rather than the built-in system voice, the text of the sentence Jerry is about to say is sent to our server, which forwards it to Microsoft Azure to turn into audio. Jerry's lines come from a limited set of sentence templates, and each distinct line is fetched once and then stored on your phone and replayed from there, up to 200 MB of lines, after which the ones not spoken for longest are fetched again when they are next needed. The request carries a random number made on your phone, so our server can limit how much one install uses. It is not your name, and it is not the identifier point 3 uses.

Be aware: a spoken line can contain numbers from your session, such as a weight or a rep count, because that is what the sentence says. It never contains your name, and no other part of your training log is sent. Turning the voice off stops this entirely. Or switch off Jerry's natural voice (Microsoft) in Profile / Data & Privacy: he keeps talking in the built-in iPhone voice, and nothing is sent.

2. Cloud Answers in Chat · OFF unless you turn it on

If you enable Cloud Answers in Chat, then when you ask Jerry a question in chat, your typed question and the relevant training context needed to answer it are sent to our server, which forwards them to Anthropic to compose the reply. This is off by default. With it off, Jerry answers using only what runs on your phone, and nothing is sent. With it on, the request carries the same random install number as point 1.

3. A daily usage summary · on by default, and you can turn it off

Once a day the app can send a short summary so we can tell whether the app is actually helping people train. It is tied to a random identifier created on your device, never to your name, and it contains day-level values only:

  • which days you opened the app, and which days you trained;
  • how far you got in setup, and how long it took to log a first set;
  • whether you have seen or bought Pro;
  • whether you have seen the one-time note after a workout that tells you what Pro includes, or the summary of your first 28 days, and whether you kept training after your free days ended without Pro;
  • whether you have seen the explanation of the experiment Jerry can run on your rest times, trying two versions of a session to see which works better for you, and whether such an experiment has started or finished;
  • whether you have copied or shared one of Jerry's sealed predictions;
  • how many times Jerry has greeted you back after a break;
  • how many times the app crashed;
  • which language you use, and which version of the app you are on.

It does not include your sets, your weights, your body data, or anything from Apple Health. You can switch it off in Profile / Data & Privacy, and switching it off stops it completely.

4. Your logged sets · removed from the code, gone the moment you update

This one does not happen any more. The code that did it is gone, nothing in the app reaches it, and no current version sends a set. If your phone is still on an older version it is still in that one until you update, which is why this section is here rather than deleted. It goes when the last version that had it does.

What it was: when you finished a workout where you chose and logged your own exercises, the app sent each set you logged to our server: the exercise, the weight, the reps, and how many more reps you said you could have done. It was tied to a random identifier created on your device and never to your name, and it was not sold, shared or used to advertise to you.

It was left over from an earlier design in which the coaching was computed on a server, and it survived when the coaching moved onto the phone. It contradicted the promise at the top of this page, so it was removed rather than kept and explained away, and it was removed rather than given a switch, because a switch would have meant defending it.

5. A push notification token · not yet, because Apple has not enabled it for this version

To send you a notification at all, Apple has to give the app a device token, and we have to know where to send it. When the app starts it registers with Apple and sends that token, along with the language your phone is set to, to our server. The token identifies a copy of the app on one device, not you: it carries no name, no email and nothing about your training, and Apple reissues it.

In the version you can install today, this does not happen. The app does not yet have Apple's permission to receive notifications sent from a server, so the registration fails and no token is sent to anyone. It is written here because the code for it is already in the app and will start working the day we set those notifications up with Apple, and you should read about it before it does rather than after.

Jerry's notes about your recovery and your weekly report are scheduled on your phone and do not use this. The token is for notifications sent from our side later, and if you never allow notifications, nothing is ever delivered to it.

6. A fingerprint of each sealed prediction · on, and it carries no identifier at all

Before a set, Jerry writes down what he expects of you and seals it: a SHA-256 fingerprint, a kind of cryptographic hash, computed over that prediction together with a 32 byte random number that stays on your phone unless you turn on point 7. That fingerprint, and nothing else, goes to our server, which publishes one combined fingerprint for each day on which seals arrive, to a public repository on GitHub. The date on each entry there is recorded by GitHub rather than by us, which is what turns "he wrote it before the set" from our word into something you can check.

Without the random number the fingerprint cannot be reversed or guessed, so it says nothing about the lift, the weight, the reps or you. It is the only thing this app sends with no identifier attached at all: no name, no email, no account, and not even the random install numbers that points 1, 2, 3 and 5 carry. There is nothing here that can be linked to a person, a device or a session.

This is live in the version you can install. Whenever you open the app or come back to it, it sends the fingerprints it has sealed and not yet seen published, and it keeps each one until it can see that fingerprint inside a published day. That is the only reason it re-sends: so that a prediction cannot go missing from the record without anyone noticing. The request carries no account, no install identifier and no headers of ours at all (the extra labels an app can attach to a request), which is what the paragraph above means literally rather than as a figure of speech.

7. The graded predictions you choose to publish · off unless you turn it on

Point 6 sends a fingerprint, which says nothing about anyone. This sends the prediction itself, and only if you switch it on in Profile. What goes is the prediction Jerry has already graded about you: the lift, the range he stated before your set, the estimated max he started from, when he sealed it, what you actually lifted, and the random number that opens the seal so a stranger can check the fingerprint was already published before the result existed.

With the same switch on, the promises Jerry made you are sent the same way once they are graded: what he promised (the reps for a set and how many you would have left, or the date for a goal), how sure he said he was, and the facts that decide it: the weight and reps of that set and how many more reps you typed that you could have done, or your estimated max on the goal's date. A set logged with a tap, without typing how many reps you had left, never grades a promise, so it is never sent.

It carries no name, no email, no account and no install identifier. It does carry one random number that stands for you and nothing else, made on your phone the first time you turn this on. That number exists so the published record can say how many different athletes it covers, because a hit rate from three people reads like a hit rate from three hundred unless somebody says otherwise. That number is why point 6 still says what it says: the fingerprint remains the only thing sent with nothing attached at all.

Our server holds these until the month is over, and then an automated process in the public repository grades that month and publishes it with every graded prediction beside it, so the percentage can be recomputed by anyone who doubts it. Turn the switch off and whatever is still waiting on your phone is deleted. Nothing already published can be withdrawn, because a record that could be edited afterwards would not be worth publishing.

What we never do

  • No advertising, and no advertising networks.
  • No third-party analytics or tracking SDKs, the ready-made code other companies supply to measure what people do in an app. There are none in the app.
  • No tracking you across other apps or websites, and no Advertising Identifier.
  • No selling or sharing your information with data brokers.
  • No account, so no email list, and no profile of you held on our side.

Your controls

  • Back up everything and restore a backup, in Profile / Data & Privacy. The file is yours.
  • Delete All Training Data, in the same place. It also deletes the safety copies on the phone and, if iCloud Drive is on at that moment, the ones in your iCloud Drive. This is immediate and cannot be undone.
  • Turn off usage sharing, in the same place.
  • Turn off Cloud Answers in Chat and Jerry's natural voice (Microsoft), in the same place, under What Can Leave This Phone.
  • Revoke Apple Health access, in the Apple Health app.
  • Delete the app, which removes the app's own data from your phone. Three things stay. The workouts it saved to Apple Health, if you allowed that: they belong to the Health app. The safety copies in your iCloud Drive: delete them in the Files app, or use Delete All Training Data before you delete the app. The date your free 28 days began, if the app saved one: the phone's keychain keeps it.

Service providers

Where data does leave the device it passes through our own server and then to: Microsoft Azure (speech synthesis) and Anthropic (chat answers, only with Cloud Answers in Chat on). They process it to return the result and we do not authorise them to use it for their own purposes.

Children

OrderedStrength is a strength-training tool intended for adults. It is not directed at children under 13, and we do not knowingly collect information from them.

Changes

If what the app does with data changes, this page changes with it and the date above is updated. The page is written from the app's own source code so that it stays true rather than generic.

Contact

Questions about this policy, or about your data: jeremiah@orderedstrength.com