Liftual Privacy Policy

DRAFT FOR REVIEW — this is not legal advice. Text prepared for review and approval by Maxime (Noriven) before any publication, ideally also by a Québec lawyer. Passages marked [TO CONFIRM: …] are facts or choices that still need a decision. Do not publish as is.

Version: 1.0 (draft) · Working draft dated: October 10, 2026 · Effective date: [TO CONFIRM: date]

1. Introduction

Liftual is published and operated by Noriven, a company established in Québec, Canada [TO CONFIRM: exact legal name and NEQ]. Noriven is responsible for your personal information. This policy explains what we collect, why, where it is kept, who it is shared with and how to exercise your rights, in accordance with Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

It covers the Liftual application for iPhone, iPad and Apple Watch (“the App”), the liftual.app website, including the online personal space (“the Site”), and the optional connection of an AI assistant. It is part of our [Terms of Use](/terms).

The essentials:

• We do not sell your information and we do not run any advertising.
• The App contains no third-party analytics, crash reporting, advertising or tracking tools.
• You can use Liftual without an account: your data then stays on your device.
• Your Apple Health data is never used for advertising and never sold.
• An AI assistant accesses your data only if you connect it, with the permissions you choose.
• You can delete your account and your data at any time in the App.

You can reach us at contact@liftual.app with any question about this policy.

2. Information we process

2.1 Account and identity (Noriven Auth)

When you create an account, Noriven Auth, Noriven’s identity service, processes:

• your email address and your password (kept only as a hash, never in plain text);
• your language, your device’s platform (iOS), your email verification status and the dates of creation and last activity;
• if you sign in with Apple or Google: the provider’s stable identifier and the email address it gives us, which may be a private relay address hidden by Apple;
• your sessions (session tokens kept as hashes, device type, browser or user agent, dates);
• a security log (sign-up, sign-in, failed sign-in, sign-out, email verification, password reset, account deletion) with the date, IP address and device;
• the version and date of acceptance of the Terms and of this policy;
• the AI assistant connections you authorize (assistant name, permissions granted, dates);
• temporary codes (email verification, password reset) and anti-abuse counters.

Your Liftual account is separate from any account you may have with other Noriven products, even with the same email address.

2.2 Training data (on our servers, if you have an account)

• your session templates and their exercises (sets, repetitions, loads, notes);
• your completed sessions (sets completed, start and end times, calories);
• your programs, plans and scheduled sessions (optional dates, status, progress);
• your cardio workouts and cardio activities: type, date, duration, distance, calories, average heart rate, cadence, intervals and GPS route (2.4);
• activities done in other apps and imported from Apple Health: type, name, source app, date, duration, calories, average heart rate;
• your settings: language, units, time zone, start of week, day rollover hour and, if you enter them, your shift work rotation, maximum heart rate, reference paces and nutrition targets.

We also keep technical keys that prevent duplicates during a sync.

This information relates to your physical fitness and your health: it is sensitive. We process it only to provide the service, with your express consent: by creating an account, by choosing to sync and by granting the device permissions described below.

2.3 Welcome answers

At first launch, the App asks for your first name and a few preferences: goal, level, number of sessions per week, duration, equipment and preferred cardio. They are used to set up the App on your device. They stay there and are not sent to our servers [TO CONFIRM: checked in the app code; to revalidate if the welcome flow changes]. The welcome flow does not ask for medical information.

2.4 Location and GPS routes

When you record an activity that uses GPS (a run, for example), Liftual uses your precise location to measure distance and pace and to record your route. If you allow it, location continues with the screen off during the activity so that the end of the route is not lost. Liftual does not track your position outside the screens and activities that need it.

The route is kept on your device and, with an account, in your history on our servers. The map is displayed with Apple Maps, which receives map requests from your device under its own policy. You can withdraw the location permission at any time in your iPhone settings.

2.5 Nutrition journal (optional)

If you turn on the nutrition journal, we record each meal (name, meal type, energy, protein, carbohydrates, fat, “estimated” flag, date) and your daily targets. This information is stored in your account. A photo analyzed by an assistant is not kept by Liftual.

2.6 Technical data

Our servers log technical requests (date, IP address, requested route, response code) and service failures, for operation, security and abuse prevention [TO CONFIRM: log retention period]. Service failures are also reported to an internal Noriven dashboard (error type, route, response code), without the content of requests.

2.7 AI assistant connections

Each call by a connected assistant is logged: assistant, tool used, required permission, date, success or failure. This log is used for security and to let you check what an assistant does.

2.8 Coach (if you invite one)

[TO CONFIRM: this section applies only if the coach space is offered at launch.] A coach is a Liftual user who has access to your data only if you accept their invitation. You choose the level of access (read only, or read and write) and can remove it at any time. We log the actions they take in your account, and you can view them. Your data is shared with them, at your request, for that purpose only.

3. Why we use this information

• Providing the service: signing you in, recording and displaying your sessions, programs and activities, syncing them across iPhone, Apple Watch and the Site, computing your progress and indicators.
• Security and abuse prevention: protecting accounts, detecting suspicious sign-ins, limiting abusive requests.
• Essential communications: verification codes, password resets, security notices, notices of changes to the Terms or this policy, account deletion confirmation. You cannot unsubscribe from these.
• Support: answering your requests and fixing errors.
• Legal obligations and defending our rights in an identified dispute.

We do not do marketing without separate, revocable consent. To date, the App offers none.

We do not use your information to train AI models. Liftual makes no decision about you based solely on automated processing. Indicators and suggestions (load, recovery, progress) help you decide, and you are free to ignore them.

4. Apple Health (HealthKit)

Access to Apple Health is optional. Permission is granted data type by data type, on Apple’s screen, and can be changed at any time in the Health app (Profile › Apps › Liftual). In the App, two settings also let you turn sending to Apple Health and importing into Liftual on or off (Settings › Apps and devices › Apple Health).

4.1 What Liftual reads

• workouts and their routes;
• heart rate and active energy;
• distances (walking and running, cycling, swimming, wheelchair, downhill snow sports).

Liftual only asks for what it uses. It does not read your sleep, your weight or your recovery measures.

4.2 What Liftual writes

• workouts done in Liftual and their routes;
• active energy and distances for those workouts;
• if you use the nutrition journal: dietary energy, protein, carbohydrates and fat from your meals.

4.3 What it is used for

To import activities done in other apps so your history is complete, to record your Liftual sessions in Apple Health, to measure your effort during a session (heart rate, energy) and to display your history. Imported activities are copied into your Liftual account (type, name, source app, date, duration, calories, average heart rate and, for cardio types, distance and route). The other measurements read from Health stay on your device [TO CONFIRM: I found no code sending these measurements to our servers].

4.4 Our commitments

• Apple Health data is never used for advertising, marketing or data mining unrelated to your use of Liftual, and is never sold.
• We do not disclose it to any third party, unless you ask us to yourself (for example by authorizing an AI assistant to read your account, section 5) or the law requires it.
• Liftual does not use iCloud and does not store Health data in iCloud.
• Liftual does not read the clinical health records in Apple Health.
• Deleting your Liftual account does not delete data in Apple Health: you manage it in the Health app.

5. AI assistants

This feature is optional and off until you connect an assistant. When you connect Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google) or another compatible assistant, you go through an authorization page from Noriven Auth where you choose the permissions: dashboard, strength sessions, cardio, programs and plans, nutrition, settings, each for reading and for writing.

With these permissions, the assistant reads, and if needed modifies, the data in your Liftual account, including the Apple Health activities copied into it. What it reads goes to its provider, which processes it under its own terms and policy. We do not control that processing. Liftual sends nothing to an AI provider on its own initiative and does not itself run any AI model.

You can remove an assistant’s access at any time (Settings › Apps and devices › AI assistants). Also remove Liftual from the assistant’s own connections and check what it kept with its provider.

6. Where data is kept

• On your device: sessions, programs, activities, settings, welcome answers, routes and the sync queue. Without an account, nothing leaves your device except what you share yourself.
• On our servers (with an account): the Liftual API, its database (the Supabase software, self-hosted by Noriven) and Noriven Auth run on Noriven’s infrastructure, a virtual private server [TO CONFIRM: hosted with Servarica in Montréal, Québec, like Glutax’s].
• Apple Health: on your device, under Apple’s rules.

Not all processing takes place in Québec. Apple (Sign in with Apple, Apple Maps), Google (Google sign-in, when offered), the AI assistant providers you connect and our email provider may process information elsewhere in Canada or abroad, including in the United States, and may be subject to the laws and lawful requests of those jurisdictions. We have no guarantee of a single country for these services. Before a transfer outside Québec, we assess the risks and put appropriate safeguards in place.

7. Retention

We keep information as long as needed for the stated purposes, then destroy it.

• On your device: until you delete it, delete your account (the last step erases local data) or uninstall the App.
• Training data on our servers: as long as your account exists. When you delete your account, we erase your sessions, programs, activities, nutrition entries, settings and the log of assistant calls.
• Noriven Auth account: on deletion, your email address is erased and replaced with an anonymous identifier, the password and Apple and Google links are removed, sessions and connected assistants are revoked, and the IP addresses in the security log are erased. Only an anonymous record remains, showing that an account existed and was deleted.
• Temporary items: verification and reset codes, 7 days at most; expired session tokens, purged the day after they expire; anti-abuse counters, 24 hours; sent emails, 24 hours, and failed emails, 30 days.
• Backups: [TO CONFIRM: frequency, rotation (Glutax: 14 days) and location]. Residual copies may remain during the rotation. They are used only to restore the service, and deletions are reapplied after a restoration.
• Server technical logs: [TO CONFIRM: duration].
• Exceptions: a specific legal obligation or an identified dispute may suspend a destruction, for only the information needed, with a documented reason and a review. We then explain the reason and the duration to you.
• Copies outside our control: exports, copies held by an AI assistant, data in Apple Health.

8. Sharing and service providers

We do not sell or rent your information. We disclose it only:

• to providers that help us operate the service, for what they need: the host of Noriven’s infrastructure [TO CONFIRM: Servarica], Apple (Sign in with Apple, Apple Maps), Google (Google sign-in, when offered) and our email delivery provider [TO CONFIRM: Amazon SES, as with Glutax];
• to an AI assistant or a coach, when you connect or invite them (sections 2.8 and 5);
• with your explicit consent;
• to authorities, in response to a legally binding request. We first try to inform you within a reasonable time, unless prohibited by law or in exceptional circumstances;
• to protect our rights in a dispute;
• in a business transfer (merger, acquisition, asset sale), after informing you by email at least 30 days in advance where possible; the acquirer must comply with this policy or obtain your consent to a new one, and you can delete your account before the transfer.

We use no analytics, crash reporting, advertising or tracking service in the App or on the Site.

9. Security

• Transmissions: encrypted with HTTPS/TLS between the App, the Site and our servers.
• Passwords: kept as a hash, with an algorithm designed for this purpose. Session tokens are stored in the iPhone’s secure keychain, and token rotation detects reuse of a stolen token.
• Data access: training tables are accessible only through the Liftual service, after authentication. Each request is tied to your account.
• Assistants: OAuth connection, specific permissions, revocation at any time, call log.
• Abuse prevention: temporary rate limits and access controls.
• Internal access: limited to Noriven’s lead developer [TO CONFIRM: taken from Glutax], with access monitoring and regularly applied security patches.

No measure guarantees zero risk. Protect your device and your password.

10. Your rights

You may, by writing to contact@liftual.app (suggested subject: “Personal information protection — Liftual”):

• access the information we hold about you. Most of it is visible in the App; we provide the rest on request;
• have inaccurate information corrected (you can also edit it in the App);
• obtain your computerized information in a structured, commonly used technological format (portability): the App gives you a JSON file of all your training data at any time (Settings › Export my data). We can also send it to a person or organization you designate;
• request deletion of your information, or do it yourself in the App (Settings › Delete my account);
• withdraw a consent: withdraw an Apple Health or location permission in your device settings, turn off Apple Health sending or import, revoke an assistant, or delete your account. Withdrawal may make a feature unavailable and does not affect earlier lawful processing;
• object to any non-essential communication, and ask us for details about how we process your information.

We verify your identity in a proportionate way and respond within 30 days. Third-party rights and exceptions provided by law apply. Do not send your password.

Complaints. If you believe your rights have not been respected, you may write to us first, then contact the competent authority:

• In Québec: Commission d’accès à l’information du Québec, cai.gouv.qc.ca, 1-888-528-7741
• In Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca, 1-800-282-1376

11. Minors

Liftual is intended for people aged 18 and over [TO CONFIRM: age taken from Glutax; see Terms, section 3.1]. We do not knowingly collect information about younger people. If you know a minor has provided information, write to us. If we discover that a minor has created an account, we delete their data.

12. Privacy incidents

We assess each incident, take reasonable steps to reduce harm and prevent recurrence, and keep the register required by law. Where an incident presents a risk of serious injury, we promptly notify the people concerned and the Commission d’accès à l’information, as applicable. Where federal law applies and its real risk of significant harm threshold is met, we send the required notices as soon as possible. Notices describe the incident, the information involved, the steps taken and those you can take.

13. Device, permissions and technologies

• Permissions: Apple Health, location (while using the app, or “always” to keep the route with the screen off during an activity) and notifications. A refusal limits the feature concerned; manual entry remains possible. You change them in your iPhone settings.
• Notifications: Liftual’s notifications (rest timer, ongoing activity) are local to the device. We do not use remote notifications.
• Apple Watch: it records the session, including offline, and transmits it through the iPhone.
• Tracking: Liftual does not use the device’s advertising identifier and does not follow your activity across apps or other sites.
• Site: no tracking cookies or analytics tools. The personal space keeps your session in your browser’s local storage, only to keep you signed in.
• Widgets and Live Activities: they display data already on your device.

14. Changes to this policy

When we publish a new version, the App shows a page before giving access to your account. It gives the version number, lists what changed and links to the full text. You must accept it to keep using your account. If you decline, you can export your data and delete your account.

For a major change (new use of your data, new sharing with a third party, a change to your rights), we also email you before it takes effect, at least [TO CONFIRM: 30 days, as with Glutax] when possible. For a minor correction or clarification, [TO CONFIRM: 7 days]. Any new consent needed for a processing activity is requested before that processing.

If you use the App without an account, the acceptance page is not shown; the version in force remains available on the Site and in the App. The most recent version always carries its date.

15. Person responsible for the protection of personal information

Responsible function: Noriven’s management, as the person with the highest authority in the company, is responsible for the protection of personal information. Service concerned: Liftual, operated by Noriven. Email: contact@liftual.app Address: [TO CONFIRM: Noriven’s postal address; the address on the glutax.ca Contact page is 40 rue Strasbourg, suite 1002, Candiac, Québec J5R 0B4]

This policy is governed by the laws of Québec and the federal laws of Canada that apply in Québec. It is available in French and English; in case of discrepancy, the French version prevails.