Pressure privacy policy

Effective 2026-11-09

Pressure is a small companion app for an iMessage running-bot. It exists to keep you signed in and to forward your Apple Health workouts to your iMessage club chat, where leaderboards and conversation actually live. This policy describes what we collect, what we do with it, and how to delete your account.

What we collect

• Health & Fitness data. Running workouts you record in any app that writes to Apple Health (Strava, Apple Watch, Nike Run Club, and so on). We read each new running workout's distance, duration, heart rate (if recorded), elevation gain, calories (if recorded), and GPS route polyline. We use this to compute club leaderboard stats and to announce your runs in your iMessage group chat.
• Gym workout heart rate. If you let Pressure read heart rate from Apple Health, Pressure adds the heart rate recorded during a gym workout (for example by an Apple Watch) to that workout: its average, maximum, heart rate chart and time in heart rate zones. It does this on its own for gym workouts you finish in the app, and asks you once before adding it to your earlier gym workouts. A workout's heart rate is shown to anyone who can see that workout.
• Sleep, recovery, and body data. Sleep duration, recovery scores, resting heart rate, HRV, daily strain, body weight, and body measurements, when you log them in Pressure, sync them from Apple Health, or connect a Whoop account. We use them for coaching context and the trends shown in the app.
• Precise location. GPS coordinates from each workout's route, transmitted as a polyline string. You always see your own full route. Before your route is shown to anyone else, our server trims a distance off each end (200 meters by default; you can adjust this, or turn it off, in the app's privacy settings), so other people cannot see exactly where a run starts or ends. If a route passes through a privacy zone you have set up, or is too short to leave a meaningful middle after trimming, other people see no map for that run at all. The separate "hide GPS endpoints" setting also hides the run's start location name from other users.
• Phone number. Collected when you sign up via SMS one-time passcode. Your phone number is your iMessage handle so our bot can message you in your group chat.
• IP address, device identifier, and device details. Read from your request when you ask for a one-time SMS passcode, and passed to Prelude, to deliver the code and fight fraud (see "How your data flows").
• Email address. Collected when you create an account with an email and password. Used to sign you in and recover your account. If you reserve a Pressure Bar, we also store the address you enter, as Pre-order emails below describes.
• Display name. A name you choose. Shown on leaderboards and in run-announcement messages in your iMessage group chat.
• Custom exercise photos (optional). A photo you add to a custom exercise is shown to people who can see your workouts and routines, and you can turn this off for each photo.
• Gender. Chosen at signup (male, female, or other). Used to render the anatomical muscle map on your gym workouts and to personalize fitness features. Never used for advertising.
• Account identifier. An internal UUID that links your data together server-side.
• Strava connection (optional). If you import a Strava archive ZIP, we ingest your historical activities from that file. We do not store your Strava credentials.
• Whoop and Garmin connections (optional). If you connect a Whoop account, Whoop sends us your daily recovery, sleep, and strain data. If you connect a Garmin account, Garmin sends us your running workouts (distance, duration, heart rate, cadence, elevation, and calories). We store the connection tokens encrypted, and you can disconnect either service in the app at any time.
• Group chat membership. When Pressure is added to an iMessage group chat, we record each member's iMessage handle and their membership in that group, even if they have never sent Pressure a direct message. This is the minimum needed to attribute runs announced in the group to club members. Any participant can remove Pressure from the group at any time (Messages → Details → Remove), which stops further recording.
• Streak invites by phone number. If you invite someone to a streak from your contacts, the app sends us the phone number you chose, never the contact's name. We keep it only as a keyed one-way code: for 14 days it lets us deliver the invite if that person signs up for Pressure or adds that number to their account, and after that it lets us confirm the number when they open your invite link, which does not expire. We delete that code when the invite is matched or cancelled, when the streak ends, or when you delete your account, whichever comes first. We never text that number; you send the invite yourself from Messages. Anyone who opens your invite link sees your name and profile photo. When someone accepts your invite, you start following each other.
• When you set a custom stake rule, our AI checks its words, and at the end of each week of that stake it reads both members' logged activity for the week (the day, the kind, distance, minutes, and the exercise, sets, reps and weight of each lift, never your names, notes, places, photos or routes) to decide who won. Both members agree to this when they set or accept the stake, and it covers each repeat week until either member turns Repeat off.
• Referral reward records. If you participate in referral rewards, we record referral attribution, the qualification rule and minimum workout evidence that satisfied it, reward-review transitions, and fulfillment history. Operator review receives the identity-proof type (for example, phone or Apple) but never the raw phone number, Apple identifier, or another user's secret.

Streak proofs

• A proof is a picture you send privately to the streaks you pick. It does not appear on a feed or on your workout.
• Only you and the members of that streak can load it, through the signed-in app. Someone who joins a streak later does not see proofs sent before they joined.
• If someone reports a proof, we can view that reported picture to review the report.
• When you remove a proof, or we take one down, it leaves the streak right away. When you leave a streak, the proofs you sent to it leave it too. A streak that has ended shows its proofs to no one. A stored picture is normally deleted within about a day, once no active streak still shows it.
• A picture someone reported can be kept while the report is open and for 30 days after it closes, even if you remove it, leave the streak or delete your account. If you delete your account, any copy we keep is in a separate area, apart from your account, where only we can view it, to review the report. It is then deleted.

What we don't do

• We do not sell your data to anyone.
• We do not show ads in the app, and we do not run any third-party advertising or behavioral-analytics SDKs. The one third-party SDK we bundle is RevenueCat, which manages Diamond subscriptions (see below).
• We do not track you across other apps or websites.

What we keep after you delete your account

• Deleting your account removes your profile, activities, and messages.
• Referral support identity is made non-recoverable.
• If a referral reward was already sent to you, the exact supporting workout evidence is retained for 24 months after that reward is finalized, and is then minimized by clearing source identifiers, activity type, distance, duration, attribution, and identity-proof type.
• A minimal opaque accounting record for a sent reward (ledger, reward year and slot, attempt, state, amount, timestamps, and review reason) may remain indefinitely, so a reward cannot be paid twice and fulfillment history stays auditable. It does not identify you.
• Database backups are kept for up to 40 days, then deleted.
• A streak proof you sent that someone reported can be kept, apart from your account, while the report is open and for 30 days after it closes, so we can review the report. Only we can view it. It is then deleted.

How your data flows

• The Pressure iOS app reads workouts from Apple Health on your iPhone and uploads each new workout to api.fyt.life (our backend).
• Our backend stores your activity rows and triggers a message to your iMessage group chat through an iMessage relay we operate.
• Twilio's Verify product sends the one-time SMS codes used for signup. Twilio processes your phone number for that purpose only.
• Prelude's Verify product sends and checks the one-time codes used for signup, sign-in, password reset and confirming account changes. Prelude receives your phone number, the code you enter, the IP address of the request, your device identifier and device details, and whether the number already has an account. It uses them to deliver and check the code and, under its own privacy policy, to fight fraud and improve its services.
• Anthropic provides the language model used by the in-chat bot's chatbot replies, the coaching and route-generation features, and the custom stake rule check. Your messages and the context needed to answer them are sent to Anthropic to generate the response. Depending on what you ask, that context can include your display name, club name, recent runs and lifts, and health-derived figures you have logged in Pressure such as sleep duration, recovery and body weight. Anthropic does not train on this data per their commercial terms.
• RevenueCat runs Diamond subscriptions. Its SDK is included in the iOS app and receives your Pressure account identifier, your purchase and renewal state, and device metadata. It does not receive your phone number, your email, or any workout or health data.
• Cloudflare R2 and Backblaze B2 store the photos and videos you attach to activities, club posts, custom exercises and messages, the proofs you send in streaks, plus our exercise-demo media. They hold the files; they do not receive your account details.
• Giphy powers GIF search in chat and comments. When you search for a GIF we send Giphy your search text. We do not send any account identifier.
• Apple delivers push notifications through APNs, and Sign in with Apple verifies your identity if you sign in that way. Apple receives the device token and the notification payload needed to deliver the alert. When you first sign up, we also send Apple's Ad Services attribution API the token your device generates, and store Apple's answer, which tells us whether your install came from an Apple Search Ads campaign and which one. We use that only to measure our own App Store ads; it contains no workout, health, or location data.
• Whoop and Garmin send us data rather than receive it. If you connect one of these accounts, that service delivers the recovery, sleep, and workout data described above through its API. We send it only the sign-in tokens needed to keep the connection working; it receives none of your other Pressure data.
• Open-Meteo returns the weather forecast for the week ahead, which the coach uses when planning your training. We send a coarse coordinate (rounded to roughly 1 km) near where your recent runs start; we send no account identifier.
• Mapbox renders map tiles and the route images shown on run cards and share pages. To draw a route we send Mapbox the route line, with the endpoint trimming described above already applied whenever the viewer is not the run's owner. Mapbox also computes reverse-geocoded location names; for those we send only the coordinates of a route's endpoints to resolve a human-readable place name (for example "Presidio · San Francisco, CA"). We do not send Mapbox any account identifier or phone number.
• GraphHopper computes turn-by-turn route geometries when you ask Pressure to generate a route. We send GraphHopper the start coordinate and a target distance; we do not send any account identifier or phone number.
• The Overpass API serves OpenStreetMap data about crossings and parks, which we use to score candidate routes when generating one. When you generate a route we send Overpass the area around your chosen start point; we do not send any account identifier or phone number.
• Beyond the services listed above, no other third party has access to your data. If that ever changes we will say so here before it takes effect.

How we store and protect your data

• Activity and account data are stored in our managed Postgres database (Neon, us-west-2).
• Our backend runs on Fly.io in the sjc region. Fly is our compute host; it processes data in transit and at rest while our application code is executing, and does not access the database or our object storage independently.
• DNS for our domains is managed at GoDaddy. GoDaddy resolves api.runbot.fit and runbot.fit to our hosts but does not process the data that travels over those connections.
• All network traffic between the app and our backend is encrypted with TLS.
• OAuth tokens (if you connect external services) are encrypted at rest with a per-deployment encryption key.
• The iMessage relay runs on a Mac under our control. Messages it sends and the chat-handle allowlist of who can receive them are scoped to your registered group chats only. The relay reaches our backend over a private network.

Pre-order emails

If you reserve a Pressure Bar on our home page, we store the email address you enter and the time you entered it. We use it for one thing: to email you when the Bar can be bought. We don't use it for ads, and we don't sell or share it. It is kept with the rest of our data, as How we store and protect your data describes, until you ask us to remove it. To remove it, write to support@pressure.bar. Deleting a Pressure account also removes it when the address matches.

Your rights

• Delete your account. Open the app → tap the gear icon → Settings → "Delete account". This permanently deletes your account, all your recorded activities and gym workouts with their photos, and your membership in every club. Clubs you created pass to the next-longest-tenured member; a club with no other member is deleted. Anonymized referral reward audit records may remain as described above; they no longer contain a live link to your account. A streak proof someone reported can be kept while the report is open and for 30 days after it closes, as described above. This action cannot be undone.
• Export your data. Email the address below and we will send you a JSON dump of your account within 30 days.
• Disconnect Apple Health. iOS Settings → Privacy & Security → Health → Pressure → toggle off. After this, we stop receiving new workouts. Historical workouts already uploaded remain unless you delete your account.

Children

Pressure is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete the account.

Changes to this policy

Material changes (collecting new categories of data, adding new third parties, changing how we use existing data) will be posted on this page before they take effect. The effective date at the top of this page reflects the most recent update.