Privacy Policy

Last updated: 8 September 2026

This Privacy Policy explains how GitPush L.P. (“we”, “us”, or “our”), Agiou Spiridonos 2, 14121 Athens, Greece, collects, uses, and protects your personal data when you use Iron & Tonic (the “Service”). GitPush L.P. is the data controller.

If you have questions about this policy or want to exercise your rights, contact us at [email protected].

1. Data we collect

We collect only what is needed to run the Service:

• Account identity. Your username, email address, password (stored as a one-way hash — never in plain text), account role (user, trainer, admin), optional avatar selection, and, if you sign in via Google, a Google OAuth subject identifier (google_sub). Optional profile fields: gender, date of birth, height.
• Workout data. Workout sessions, exercises, sets, reps, weight, and custom exercise templates you create.
• Routines. Routines and routine sets you create or that a trainer shares with you through a Club.
• Nutrition logs. Meal entries (name, calorie count, macronutrient breakdown, creation source, and timestamps); favourite meals; macro plans; and per-day calorie adjustments.
• Body measurements and goals. Body measurements you log and progress goals you set.
• Garmin integration (optional). If you connect your Garmin account, you provide your Garmin email address and password. These credentials are transmitted to our server, which uses them to authenticate with Garmin Connect on your behalf. Your Garmin password is not stored. Only the resulting session token (a serialised credential blob) is persisted in our database. We also cache the Garmin metrics you request — such as training readiness and body battery — and any activity import records in our database to avoid redundant API calls. You can disconnect the integration at any time, which removes the stored token.
• Scan history. When you scan a barcode in the food-scan feature, we store a per-user scan record containing the barcode and a timestamp, linked to the cached product data for that barcode.
• Activity import records. When the Garmin integration imports an activity, we store a deduplication record (your user ID, the provider slug, and the vendor-assigned activity ID) to prevent the same activity being imported twice. If you later delete the imported workout, the deduplication record is kept so the activity is not re-imported on reconnect.
• Billing data. We store your Stripe customer ID to link your account to your subscription. We do not store your card number or full payment credentials — those are held exclusively by Stripe.
• Coach conversation content. When you use the Coach feature, your question and relevant context from your account (your active macro plan and your meal log for the last 7 days) are sent to our AI provider. See section 6 for details.

2. iOS waitlist

Before the iOS beta opens, we offer a waitlist on our website. If you sign up for the waitlist, we collect:

• Email address. Used solely to notify you when the iOS TestFlight beta becomes available.
• Product interest. Which product you are interested in — Iron, Tonic, or both.
• TestFlight-tester opt-in flag. Whether you wish to be considered as a TestFlight beta tester.

Lawful basis: consent (Article 6(1)(a) GDPR). Signing up is entirely voluntary.

Storage and sharing: Waitlist data is stored by GitPush L.P. on the same infrastructure that runs the Iron & Tonic service. It is not shared with any third-party mailing-list provider.

Retention: We keep your waitlist entry until the iOS beta publicly launches or until you request deletion, whichever comes first.

Withdrawal and deletion: You can withdraw your consent and request removal of your waitlist entry at any time by emailing [email protected].

3. Meal photos — not stored

When you use the food-scan feature to analyse a meal from a photo, the image is transmitted to our AI provider for nutritional analysis and is never stored on our servers. The photo is processed transiently and discarded immediately after the analysis response is returned. Because photos are not retained, failed photo-based meal entries cannot be retried from the original image — only text-described entries are retryable.

4. How we use your data and legal bases

• To provide the Service (legal basis: performance of a contract with you — Article 6(1)(b) GDPR). This covers creating and maintaining your account, storing and displaying your logs, running the Garmin integration, processing payments through Stripe, and providing AI-powered features.
• To keep the Service secure (legal basis: legitimate interests — Article 6(1)(f) GDPR). This covers logging, fraud prevention, and detecting and blocking abusive activity. Our legitimate interests do not override your rights.
• To send service communications (legal basis: contract performance or legitimate interests). We may send you transactional emails (account changes, billing receipts) but we do not send marketing email without your consent.
• Google sign-in (legal basis: consent — Article 6(1)(a) GDPR). Using “Sign in with Google” is optional; you can register with an email and password instead.

5. Data processors

We share your data with the following processors, each under a data processing relationship and bound to protect your data:

• Stripe (United States) — payment processing and subscription management. Stripe receives your payment information directly and holds billing credentials. We pass your email and a Stripe customer ID; we do not transmit card data to our own servers. Stripe Privacy Policy.
• Google (United States) — optional sign-in via Google OAuth. If you choose this sign-in method, Google authenticates you and we receive a subject identifier and your email address. Google Privacy Policy.
• Garmin (United States) — optional fitness integration. If you connect your Garmin account, your Garmin email and password are transmitted to our server, which authenticates with Garmin Connect on your behalf; see section 1 for how credentials are handled. We call the Garmin Connect API to read your training metrics and push workouts. Garmin Privacy Policy.
• Moonshot AI (Kimi) (China) — AI provider powering the Coach feature, automated meal-photo analysis, and recipe ingredient recognition. Specifically:
  • When you use the Coach feature, your question, active macro plan, and your meal log for the last 7 days are sent to Moonshot AI’s API.
  • When you scan a meal photo for nutritional analysis, the image is sent to Moonshot AI and is not retained by us or, to our knowledge, by Moonshot AI beyond the immediate API call.
  • When you use ingredient recognition from a photo in the recipes feature, the image is sent to Moonshot AI for analysis and is not retained beyond the immediate API call.
  Moonshot AI Privacy Policy.
• Open Food Facts (France/international, open-source project) — nutritional product database. When you scan a food barcode, the barcode number is sent to the Open Food Facts API to retrieve product information. No personal data is included in this request beyond the barcode itself. Open Food Facts Privacy Policy.
• recipeapi.io — recipe search and data provider. When you search for recipes, your search terms and filter parameters are sent to the recipeapi.io API. No account credentials or personal profile data are included. recipeapi.io.
• PostHog (Estonia / European Union) — analytics processor for both the marketing site (ironandtonic.fitness) and the Iron & Tonic app (app.ironandtonic.fitness). Analytics data is ingested exclusively at PostHog’s EU endpoint (eu.i.posthog.com); no data leaves the EEA as part of analytics processing. Analytics are collected only after your explicit consent on each surface (the marketing site’s cookie banner, and the app’s own first-run prompt). The events collected are anonymous usage signals (feature interactions, counts, and categorical properties — never free text, meal photos, or measurement values). On the marketing site, only one event (site_cta_clicked) is sent. A full list of app events is available in our analytics taxonomy document. Identity is linked via the backend’s numeric user ID; no advertising identifier is used. There is no first-party reverse proxy — events are sent directly to eu.i.posthog.com. PostHog Privacy Policy.
• DigitalOcean (United States) — cloud infrastructure and hosting via DigitalOcean App Platform. All application data is stored on DigitalOcean’s servers. DigitalOcean Privacy Policy.

6. International data transfers

The processors listed above — Stripe, Google, Garmin, Moonshot AI, DigitalOcean, Open Food Facts, recipeapi.io, and PostHog — may be based outside the European Economic Area (EEA). Stripe, Google, Garmin, and DigitalOcean are primarily in the United States; Moonshot AI is in China. PostHog is based in Estonia (EU) and processes analytics data within the EEA — no transfer mechanism is required for PostHog analytics. Where personal data is transferred outside the EEA we rely on the transfer mechanisms available under GDPR, such as Standard Contractual Clauses, or the adequacy decisions or derogations that apply to each vendor. If you have questions about the specific mechanisms in place, contact us at [email protected].

7. Data retention

We keep your personal data for as long as your account is active. If you request deletion of your account (see section 8), we delete your data from our systems. Stripe retains billing records as required by its own legal and regulatory obligations; we cannot delete those records on your behalf.

8. Your GDPR rights

If you are in the EEA, you have the following rights under the General Data Protection Regulation:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete data.
• Erasure. Ask us to delete your data (“right to be forgotten”). There is no automated self-service deletion in the app at this time; to request account deletion email us at [email protected] and we will handle it manually. We will comply unless we have a legal obligation to retain the data.
• Portability. Receive your data in a structured, machine-readable format. There is no automated export in the app at this time; to request a data export email us at [email protected] and we will handle it manually.
• Restriction. Ask us to restrict processing of your data in certain circumstances.
• Objection. Object to processing based on legitimate interests. We will stop unless we have compelling grounds that override your interests.
• Withdraw consent. Where processing is based on your consent (e.g. Google sign-in), you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within one month. If you are not satisfied with our response you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) (www.dpa.gr).

9. Cookies and analytics consent

We use cookies for session authentication and essential site operation. The marketing site may also set PostHog Analytics cookies after your consent. For full details of the cookies we set and your options for controlling them, see our Cookies Policy.

The Iron & Tonic app has its own analytics consent choice, separate from the marketing site’s cookie banner. You can revoke the app’s analytics consent at any time in Profile → Settings → Share analytics. Revocation takes effect immediately without a restart. The marketing site’s consent choice (iat_cookie_consent_v1 in localStorage at ironandtonic.fitness) and the app’s consent choice (iat_app_analytics_consent_v1 at app.ironandtonic.fitness) are stored at separate origins and do not affect each other.

10. Children

Iron & Tonic is not intended for people under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has created an account, contact us and we will delete it.

11. Security

We use industry-standard measures to protect your data: passwords are stored as one-way cryptographic hashes, all traffic is served over HTTPS, and access to production systems is restricted to authorised personnel. No security measure is perfect; in the event of a data breach that is likely to affect your rights we will notify you and the HDPA as required by GDPR.

12. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “Last updated” date at the top of this page. Where practicable we will notify you by email. Continued use of the Service after an update constitutes acceptance of the revised policy.

13. Contact

For any privacy-related question or to exercise your rights:

GitPush L.P.
Agiou Spiridonos 2
14121 Athens, Greece
[email protected]