You sign in with Apple, with Google, or with an email address and password, all handled by Firebase Authentication. Heft keeps your email address and the name you choose, to sign you in and recover your account. With Sign in with Apple you can hide your real email. A profile photo is optional: if you add one from your camera or your photo library, it is squared to 512 pixels and stored in your account (Firebase Storage), private to you. Removing it deletes it, and so does deleting your account. Heft and Nibble, its sister app for food, share this account: the same sign-in works in both, the profile photo included, and each app keeps its own data in it.
The workouts you log (exercises, sets, weights, reps, times, distances and notes), your routines, custom exercises, training preferences such as your weekly target and units, and a workout in progress are stored in your account and on your device. They are private to your account. Anything you log offline waits on your device until it can sync. Records, streaks and progress are worked out from your workouts and are not stored separately.
Video exercises play through YouTube's embedded player, which is provided by Google and subject to Google's privacy policy (https://policies.google.com/privacy). Heft saves only the link, title and length you add.
04
Progress photos and videos
Progress photos and videos you take or pick in Heft are kept only on your device, in Heft's own storage. They are never uploaded to our servers or to your account, and videos are recorded without sound. Deleting a photo removes it; deleting your account removes them all from that device. Your device's own backup may include them.
A photo you add to one of your own exercises is kept on your device. Without Plus it stays there and is never uploaded. With Plus it is also stored in your account (Firebase Storage), private to you, so your other devices can show it. Removing the photo or deleting the exercise deletes it from your account too; deleting your account deletes all of them.
Plus is sold through the App Store, and Apple handles payment; Heft never sees your card. One Plus covers Heft and Nibble. RevenueCat keeps a record of what you bought, linked to your account id, so your purchase works in both apps and on all your devices.
If you connect an assistant such as ChatGPT or Claude to Heft over MCP, it can read or log only what you approved, and Heft keeps only a hashed record of that access so it can be revoked. Heft also counts how many times your assistant calls it each day, and which tools it used, so the Assistants screen can show you how much you use it; that is counts and tool names only, in your own account, never what you asked or what the assistant replied. Nibble, the sister app on the same account, counts its own the same way, and both are shown there side by side. What you ask the assistant, and what it shows you, is handled by that assistant's own privacy policy. Disconnecting removes Heft's record, and deleting your account removes the counts with everything else.
Heft uses Google Analytics to count, anonymously, which screens and features get used, so we can see what helps and fix what doesn't. It records things like finishing a workout, setting a record, reaching a streak milestone, or starting Plus, with a random id for your browser or device. It never includes your name, email, account id, the exercises you log, or the weights you lift. Each batch of events does carry your device’s IP address to Google, which uses it to work out an approximate location — the country — and does not store it; nothing finer than that is kept, and the address is not used to identify you. On the website nothing is measured until you choose Allow, and you can say no thanks. In the app it's on unless you turn off Share anonymous usage on the You tab, which also forgets that id. Advertising features and Google Signals are off, the data isn't used for ads or sold, and Google keeps it for 14 months.
Heft sends email to your account address when your account needs it: a welcome when you join and a link when you reset your password. A weekly summary and news arrive only if you turn them on, and every one of those emails has a link to unsubscribe. Email is sent through Brevo, which receives your address and the message. A message you send from the support page is emailed to us through Brevo and also kept in our own database: the address, topic and text you wrote, the name if you gave one, the user-agent string your browser or app sent, and your account id when you were signed in, so a question about your account can be answered. Nothing can read those messages back through the form. They are not deleted on a timer: one carrying your account id goes when your account is deleted, and one sent without signing in stays until we remove it.
10
Notifications and reminders
Workout reminders and the rest timer are scheduled on your device and never pass through our server. While you allow notifications, Heft keeps your device's push token, so a workout you or your assistant planned can remind you at its time even when the app is closed. News is never sent unless you turn it on. The token is deleted when you sign out or turn notifications off.
On iPhone you can connect Heft to Apple Health; it stays off until you turn it on. Heft then saves the workouts you finish (type, time, distance, and energy, which Heft estimates when you don't enter it) and the weigh-ins you log to Health, and reads your workouts, active energy, weight, and sleep. Today's active energy and your weight stay on your device and in Apple Health: they are never sent to our servers. Cardio sessions from other apps, such as runs from Apple Watch, come in only while Import cardio is on, and then become ordinary workouts in your Heft account, private to you like everything else you log. Health data is never used for advertising or marketing, and never shared or sold. You can change what Heft reads and writes at any time in the Health app, or turn it off on the Apple Health screen in Heft.
On iPhone you can turn on Show in Calendar; it stays off until you do. Heft then asks for access to your calendars, adds a calendar named Heft, and keeps each workout you or your assistant planned in it as an event: its name, its time, the exercises, and a link back to the plan in Heft. Heft reads and changes only that Heft calendar, never your other calendars or their events. Which event belongs to which plan is kept on your device and never sent to our servers. If your calendars sync through iCloud or another account, that account keeps the Heft calendar like any other. Turning the switch off removes the Heft calendar and its events.
Sleep is read from Apple Health and never written to it: Heft has no way to record a night, and asks only for permission to read. It has its own switch on the Apple Health screen, and reading stops the moment you turn it off. The sleep samples themselves stay on your device. What leaves it is a short summary of each of the last two weeks of nights — the date of the night, minutes asleep, minutes in bed, minutes napping, when the sleep started and ended, and the minutes of light, deep and REM sleep when your watch recorded them — kept in your own Heft account so that an assistant you have connected can answer questions like “how did I sleep this week?”. It is private to you, like everything else in your account, and turning the Sleep switch off stops the reading and takes those nights back out of your account. Heft shows how long you slept and whether the week is up or down on the one before; it does not score your sleep, set a target, or tell you what it means for your training.
Focus mode and Bedtime use Apple's Screen Time on your iPhone to block apps while you train and between lights out and waking. Choosing which apps stay open happens inside Apple's own picker, which runs outside Heft: Heft is given anonymous tokens and never learns which apps you chose, or which apps you use. When a blocked app is opened, Heft’s blocking screen checks whether it is a music, workout or map app so it can stay open, and keeps that app’s name on your phone to tell you once. Nothing about it leaves your phone — your bedtime, the nights you picked, the apps kept open, and the times you used “I need my phone” are kept on the device and are not in your account or on our servers.
Your data is stored with Google Cloud and Firebase in the United States and is encrypted in transit and at rest.
If your account is free and there has been no activity in Heft or Nibble for 90 days, it is deleted, together with its data in both apps. We email your account address 30 days and 7 days before, and opening either app keeps your account. Accounts with a Plus subscription, a lifetime purchase, or Plus from a friend code are never deleted for inactivity. Sparks you earned expire after 90 days without activity; Sparks you bought never expire. Purchase records stay with Apple and RevenueCat. You can delete your account yourself at any time from the Account screen.
You can delete your account from the Account screen in the app. Because Heft and Nibble share one account, deleting it removes it for both apps: your profile, workouts, routines, custom exercises and settings in Heft, and everything you logged in Nibble. Purchase records are kept by Apple and RevenueCat as required for billing.
Heft isn't directed at children under 13 and doesn't knowingly collect their data.
Heft is not a medical device and doesn't give medical advice. Records, one-rep-max estimates, and training hints are approximate. Talk to a doctor before starting a new exercise program, especially if you are pregnant, injured, or have a medical condition.
Ask anything about your data through the form on the
support page. If this policy changes, the date at the top will change with it.