Iron U is a training app for a first IRONMAN 70.3. This page says what it collects, where it is kept, who else sees it, and how to delete all of it.
Who runs Iron U
Iron U is made by Fabrique Futur LLC, a Wyoming (USA) limited liability company. Write to dev@fafutur.com with any question about your data.
What Iron U collects
Your account. Your email address, and a password if you set one. Supabase Auth stores the password as a hash. We never see it. You can sign in with a one-time email link instead and never set a password at all.
Your profile. Name, date of birth, sex, height, weight, time zone, your race and its date, and your maximum and resting heart rate. You type these when you sign up. They are what the plan is built from.
Your training. Workouts (time, duration, distance, sport, heart rate), sleep, resting heart rate, heart-rate variability, VO2 max, step count and body mass. This comes from whichever source you connect:
- Apple Health, read from your iPhone: workouts with their heart-rate and distance samples, heart rate, heart-rate variability, resting heart rate, VO2 max, steps, body mass and sleep — the same list the permission prompt shows. Iron U asks for read permission only, so it cannot change your health record.
- Health Connect, read from your Android phone: workouts with their heart-rate and distance samples, heart rate, resting heart rate, weight and sleep — the same list the permission screen shows. Iron U asks for read permission only, so it cannot change your health record.
- Strava, once that connection is offered — it is not in the current beta — and only if you connect it. Iron U will read your activities and their heart-rate streams.
- Garmin, through a program you run on your own computer, using your own Garmin login. Your Garmin password is never typed into Iron U and never reaches our servers. For a ride, Iron U also stores its GPS track (the points of the route, with time and elevation). Explore uses where your rides start to suggest routes near you, and a ride you repeat is recognised from its track.
Photos of food and drink. If you photograph a meal or a drink, the photo is stored and an estimate of what was in it is stored beside it.
Photos of plates. If you add a plate from a photo of it on a kitchen scale, the photo is stored with your meal photos and sent to the AI provider, which reads the scale and describes the plate. The weight is kept only after you confirm it.
Form-check frames. If you ask Iron U to check your technique, the app cuts six to eight still frames from a clip of at most 15 seconds, on your phone, and sends only those frames to the AI provider you allowed (see below), together with the skill you are practising. The video itself never leaves your phone. The frames are not stored by us and are not added to your library; the answer (up to three faults and a drill) is shown to you and not kept.
What you tell it. Your daily check-in (ache, illness, effort), a weight typed into a notification, questions you ask the coach, and how a session went.
Breaks. The dates you mark as ill or away, and the dates Iron U asked you about — with the heart-rate readings or empty days that made it ask, and your answer.
What an AI assistant can read and change. Only if you connect one (Claude, ChatGPT or Gemini), and only after you sign in and approve it. It can read today's session and your plan, your recent workouts (date, sport, duration, distance, heart rate, elevation and power) with how each was judged against the plan, and your readiness (its state, its score and the reasons that fired, such as heart-rate variability or an ache you reported). When you ask, it can skip a session, move one to another day and add a note to a day. It can also read the plates you saved (name and empty weight) and today's food log: each meal with its calories and macros, and the day's total and target. When you ask, it can log a meal: you send the assistant a photo or a description, it estimates the meal, and Iron U stores that estimate (the description, calories, macros, time and, if the photo showed a kitchen scale, the reading) as a meal marked as logged from chat. On this route the photo stays with the assistant; Iron U does not receive or store it. The assistant can delete a meal only if it logged that meal itself. It cannot read GPS tracks, meal photos, weight, your profile or your account details, it cannot change a calorie target, and it cannot delete anything else.
AI usage. For every request to the AI model: which function called it, the model name, the number of tokens and the cost in US dollars. Not the content.
Settings. The times you want the morning and evening notifications.
Explanations you have read. When you dismiss one of the app's short explanations, its name (such as door.fuel) is stored with your account, so your other devices do not show it again. Only the names: not when, not how often, not what else was on screen. "Replay explanations" in Settings clears the list.
Iron U has no advertising identifier and no analytics tool. There is no analytics or tracking library in the app or on the website. It does not read your location in the background; a coordinate is used for weather only if you give one.
Crash reports
If the app crashes, hangs, or is stopped by the phone's operating system for using too much memory, disk or processor, the system (iOS or Android) records a report and hands it to the app on the next launch. Iron U sends that report to your own account. It contains the app's own call stack — binary names, addresses and offsets, not readable code — or, on Android, the reason the system gave for stopping the app, with the device model, the operating-system version and the app version. It contains no training data, no photograph, no location and nothing you typed. It is kept in your own rows under the same row-level security as everything else, it is deleted with your account, and nothing is collected or kept at all if you switch off Share diagnostics in the app's Settings.
Where it is stored
In a Postgres database hosted by Supabase in the EU (region eu-west-1, Ireland).
Every table has row-level security switched on, and every policy is written against your own user id. One account cannot read another account's rows — that is enforced by the database, not by the app.
Photos go into private storage buckets, in a folder named with your user id, under the same rule. No photo has a public address; when the app shows you one, the link expires.
Who else sees it
Supabase hosts the database, the sign-in system, the photo storage and the server functions, and keeps normal server logs. Supabase keeps those logs, and a daily backup of the database, for up to seven days. A row you delete can therefore survive in a backup for at most seven days; photos are not part of database backups.
OpenAI (its GPT models) and Anthropic (its Claude models) are the two companies that handle your AI requests once you have allowed them (see "You allow it first" below). Which of the two handles a request is set on our server, feature by feature, and can change without an app update. On the date at the top of this policy it is OpenAI. That company receives, for a single request and only when you use that feature: the bytes of a meal, drink or plate photo with a short instruction; or the already-calculated numbers of one session, so it can write one sentence about them; or summaries of your training, sleep and heart-rate data, so it can write a debrief or the morning brief; or your question to the coach together with your own recent training numbers. Photos are sent as data inside the request — neither company receives a link that could read your storage.
OpenAI is always the one used for a photo format Claude cannot read, when Anthropic is not available to our server, if you entered your own OpenAI key in Settings (then our key is not used at all), if you allowed OpenAI only, and for the voice coach below.
Data sent to either company's API is processed under that company's API terms, which say it is not used to train its models. OpenAI keeps API inputs and outputs for up to 30 days to detect abuse; for how long Anthropic keeps them, see Anthropic's own terms.
You allow it first. Nothing is sent to Anthropic or OpenAI until you allow it. The app asks once, saying what would be sent, to whom and why; until you tap Allow, our server refuses every AI request before it reaches either company, including requests made with your own key. The server records which question you answered: version 1 named OpenAI only, version 2 names both OpenAI and Anthropic. Your data goes only to the company or companies named in the version you allowed — if you allowed version 1, nothing is sent to Anthropic. If you allowed OpenAI earlier, the app offers you Anthropic once, at your next AI request; Not now keeps OpenAI exactly as it was, and you can add it later under Settings → AI. The Iron U web app still asks about OpenAI only, and an answer given there is a version 1 answer. You can withdraw your permission at any time in the app under Settings → AI → Use AI. From then on nothing more is sent, and a feature that needs AI asks you again instead of working. Withdrawing does not recall what either company already received; the retention in their own terms (OpenAI: up to 30 days, above) still applies.
The voice coach (iPhone app only). During a strength workout you can start a voice session. While it runs, your microphone audio is streamed to OpenAI in real time, together with the exercises of that workout, so the coach can listen and answer out loud. The audio goes from your device to OpenAI over an encrypted connection; it never passes through our servers, and Iron U does not record or store it or a transcript of it. The microphone is used only while a voice session is running.
The AI assistant you connect (Claude from Anthropic, ChatGPT from OpenAI or Gemini from Google) receives the training, workout, readiness, plate and food-log data its tools return when you ask it a question, and the text of any note you ask it to save. Iron U sends nothing to an assistant by itself: the assistant asks, and only after you approved the connection. How long it keeps what it received, and whether it trains models on it, is set by that assistant's own terms and your settings there, not by Iron U. You can disconnect it at any time in the assistant's connector settings; deleting your Iron U account removes the data on our side.
Open-Meteo receives a latitude and longitude to return the weather and sea temperature. It gets no name, no account and no identifier.
Strava sees only the connection itself, if you make one.
Apple and Google distribute the app (TestFlight and the App Store; Google Play) and report installs and crashes to us. Notifications are built and scheduled on your device by the operating system. They are not sent from a server, and Iron U uses no push notification service.
A test build also has a feedback form: see Test builds below. Nobody else. Iron U does not sell your data, does not share it with advertisers and does not use it to advertise anything. Health and fitness data is never used for advertising, marketing or data mining, as the rules of Apple HealthKit and Google Health Connect require, and health data is not stored in a cloud backup of your phone (iCloud, or Android's backup to Google Drive).
How long it is kept
Until you delete it. There is no automatic expiry: a training history is the point of the app.
Test builds
This section applies only to test builds, handed out through TestFlight. An App Store build has none of this.
A test build has a feedback form. You open it yourself, by shaking the phone or from Settings. It sends nothing until you have read a notice and, each time, ticked a box and pressed Send. A report holds a picture of the screen as you saw it, what you wrote or said, the place you pointed at, and the app version, device class and system version. The most sensitive values (body weight, sleep, heart rate, injury notes) are painted black in the picture. Anything else on the screen goes as it is, so a report can show training data.
A report goes to a drop box we run on a DigitalOcean server, and from there to the computer of the person who runs Iron U, usually within the hour. The server copy is then deleted, and any copy not collected is deleted after 24 hours. The computer's copy is deleted 30 days after the report is closed, or 90 days after it arrived if nobody opened it. Reports are read to improve the app. They are not used for anything else and are not sold or shared.
To have a report removed sooner, write to dev@fafutur.com.
Deleting your data
Delete a single meal or drink and its photo is deleted with it.
Delete your account in Settings, behind one confirmation. That removes every photo, every row we hold about you, any key you stored with us, and the account itself. It cannot be undone, and we keep no copy for ourselves beyond the seven-day backup window above.
Your rights
You can see your data in the app, correct it in Settings, ask us for a copy of it, and delete it. Write to dev@fafutur.com. If you are in the EU or the UK you can also complain to your national data protection authority.
Children
Iron U is not for anyone under 16, and we do not knowingly collect data from anyone under 16.
Changes to this policy
The version and date at the top of this page change when the policy changes. If a change matters to you, the app will say so before it takes effect.