You sign in with Apple, with Google, or with an email address and password, all handled by Firebase Authentication. Heft keeps your email address and the name you choose, to sign you in and recover your account. With Sign in with Apple you can hide your real email. Heft and Nibble, its sister app for food, share this account: the same sign-in works in both, and each app keeps its own data in it.
The workouts you log (exercises, sets, weights, reps, times, distances and notes), your routines, custom exercises, training preferences such as your weekly target and units, and a workout in progress are stored in your account and on your device. They are private to your account. Anything you log offline waits on your device until it can sync. Records, streaks and progress are worked out from your workouts and are not stored separately.
Video exercises play through YouTube's embedded player, which is provided by Google and subject to Google's privacy policy (https://policies.google.com/privacy). Heft saves only the link, title and length you add.
04
Progress photos and videos
Progress photos and videos you take or pick in Heft are kept only on your device, in Heft's own storage. They are never uploaded to our servers or to your account, and videos are recorded without sound. Deleting a photo removes it; deleting your account removes them all from that device. Your device's own backup may include them.
Plus is sold through the App Store, and Apple handles payment; Heft never sees your card. One Plus covers Heft and Nibble. RevenueCat keeps a record of what you bought, linked to your account id, so your purchase works in both apps and on all your devices.
If you connect an assistant such as ChatGPT or Claude to Heft over MCP, it can read or log only what you approved, and Heft keeps only a hashed record of that access so it can be revoked. What you ask the assistant, and what it shows you, is handled by that assistant's own privacy policy. Disconnecting removes Heft's record.
Heft uses Google Analytics to count, anonymously, which screens and features get used, so we can see what helps and fix what doesn't. It records things like finishing a workout, setting a record, reaching a streak milestone, or starting Plus, with a random id for your browser or device. It never includes your name, email, account id, the exercises you log, or the weights you lift. On the website nothing is measured until you choose Allow, and you can say no thanks. In the app it's on unless you turn off Share anonymous usage on the You tab, which also forgets that id. Advertising features and Google Signals are off, the data isn't used for ads or sold, and Google keeps it for 14 months.
Heft sends email to your account address when your account needs it: a welcome when you join and a link when you reset your password. The weekly streak email and news arrive only if you turn them on, and every one of those emails has a link to unsubscribe. Email is sent through Brevo, which receives your address and the message. Messages you send from the support page reach us through Brevo too.
09
Notifications and reminders
Workout reminders and the rest timer are scheduled on your device and never pass through our server. Push notifications such as news are off unless you turn them on; while they are on, Heft keeps your device's push token to send them, and deletes it when you turn them off or sign out.
On iPhone you can connect Heft to Apple Health; it stays off until you turn it on. Heft then saves the workouts you finish (type, time, distance, and energy, which Heft estimates when you don't enter it) and the weigh-ins you log to Health, and reads your workouts, active energy, and weight. Today's active energy and your weight stay on your device and in Apple Health: they are never sent to our servers. Cardio sessions from other apps, such as runs from Apple Watch, come in only while Import cardio is on, and then become ordinary workouts in your Heft account, private to you like everything else you log. Health data is never used for advertising or marketing, and never shared or sold. You can change what Heft reads and writes at any time in the Health app, or turn it off on the Apple Health screen in Heft.
Your data is stored with Google Cloud and Firebase in the United States and is encrypted in transit and at rest.
You can delete your account from the Account screen in the app. Because Heft and Nibble share one account, deleting it removes it for both apps: your profile, workouts, routines, custom exercises and settings in Heft, and everything you logged in Nibble. Purchase records are kept by Apple and RevenueCat as required for billing.
Heft isn't directed at children under 13 and doesn't knowingly collect their data.
Heft is not a medical device and doesn't give medical advice. Records, one-rep-max estimates, and training hints are approximate. Talk to a doctor before starting a new exercise program, especially if you are pregnant, injured, or have a medical condition.
Ask anything about your data through the form on the
support page. If this policy changes, the date at the top will change with it.