Privacy policy.

Your camera

TrueForm does not record, store or upload camera video or still images. Ever.

During a set, the app reads frames from your camera, extracts the positions of 12 body joints from each one, and discards the frame. Those joint positions are held in memory in a rolling window of about one second — long enough for the models to judge movement rather than a snapshot — and then they are discarded too. Nothing is written to disk and nothing is sent to a server.

All the machine-learning models involved — pose landmarking, exercise classification, muscle-group classification, form correction and hand-gesture recognition — run on your iPhone using Apple's Core ML. There is no inference server. The coaching loop works with no network connection at all, including in aeroplane mode.

What leaves your phone is only the result: that you did a set of a named exercise, how many reps, and the scores. Numbers and labels, not pictures.

What we hold

Account

• Your email address, and a password hash if you signed up with one
• Your display name, and an avatar if you set one

Profile and preferences

• Training goals and experience level, from onboarding
• Optional body details you chose to enter — height, weight, date of birth — which you can skip, and which exist only to make the stats and charts more useful to you
• Settings: units, coaching style, cue frequency, rest defaults, reminders

Training records

• Your routines: exercises, sets and rep targets
• Completed sessions and sets: the exercise, the muscle group, the rep count, the Form, Reps and Overall scores, the date and duration
• Derived figures: streaks, weekly totals, personal bests, trends

Subscription

• Your subscription status. Payments are handled by Apple and, where applicable, Stripe — we never see or hold your card details.

Technical

• App version and device model, when you send feedback or when a crash report is submitted
• Standard server logs at our hosting and database providers, including IP address, held for a short period for security and debugging

What we never hold

• Camera video or photographs, in any form
• Raw pose or joint-position data
• Your location
• Your contacts, photo library, health records or HealthKit data
• Card or bank details

Why we hold it

Under UK GDPR we need a lawful basis for each use. Ours are:

• Performing our contract with you — running your account, syncing your routines and results between your devices, and managing your subscription. Without this the app can't do what you installed it for.
• Our legitimate interests — keeping the service secure, diagnosing crashes, and understanding in aggregate which features are used so we know what to build. We use the least data that answers the question.
• Your consent — camera access, notifications, and the optional body details. You can withdraw any of these at any time in iOS Settings or in the app, and the rest keeps working.
• Legal obligation — tax and accounting records for paid subscriptions.

We do not sell your data, we do not share it with advertisers, and we do not use it to build advertising profiles. We do not use your training records to train our models.

Who processes it

We use a small number of providers, each under a data-processing agreement, and only for what's listed:

• Supabase — database, authentication and sync for your account, routines and results. Our project is hosted in the EU (London region).
• Vercel — hosting for this website.
• Apple — the App Store and TestFlight, app distribution, crash reporting and subscription payments, under Apple's own privacy policy.
• Stripe — card payments for subscriptions taken outside the App Store, if and when we offer them.

Where any provider processes data outside the UK or EEA, that transfer relies on an adequacy decision or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Camera frames and pose data — about a second, in memory, then gone. Never stored.
• Account, profile and training records — for as long as your account exists. Delete your account and they go.
• Beta waitlist email addresses — until the beta ends, or until you ask us to remove yours.
• Server and security logs — a short rolling window at our providers, typically days rather than months.
• Billing records — six years, as UK tax law requires.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another service. You can also withdraw a consent you gave.

Two of these you can do yourself, immediately, in the app:

• Export — Settings → Privacy & data → export your data as JSON.
• Delete — Settings → Privacy & data → delete account. This removes your synced account, profile and training records.

For anything else, email yasine.tawfeek@true-form.uk and we'll respond within one month. If you're unhappy with how we've handled it you can complain to the UK Information Commissioner's Office at ico.org.uk.

Website analytics

This website sets no cookies.

We use Vercel Web Analytics, which is cookieless and does not store or share any identifier that can follow you between sites. It counts page views and a handful of events — which buttons get clicked, how far down the page people read — in aggregate. There is no Google Analytics, no advertising pixel, no cross-site tracker and no fingerprinting.

Web fonts are served from this domain rather than a third-party font CDN, so loading the page doesn't tell anyone else you visited.

If you join the beta waitlist, we store the email address you typed and nothing more — no IP address against it, no referrer. We use it once, to send you a TestFlight invite.

Children

TrueForm is not intended for children under 13, and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll remove it.

Changes to this policy

If we change this policy we'll update the date at the top, and for anything significant we'll tell you in the app or by email before it takes effect. This policy is the binding document: if it and anything else we've published ever disagree, this policy is the one to go by.

Contact

TrueForm is the data controller for the data described here. Reach us at yasine.tawfeek@true-form.uk.