Privacy policy
CMAX is built local-first. Your training log lives on your phone. Sessions, sets, weights and records are stored on the device and are not sent anywhere unless you turn on a feature that needs them, and each of those is described below.
What we collect, and when
- Account. If you sign in, we store the identifier and email address provided by Apple or Google, and the username you choose. Sign in with Apple's Hide My Email works; we store the relay address Apple gives us. CMAX requires an account to use. What the account does not hold is your training: sessions, sets, weights and records live on the device and are not uploaded unless you turn on a feature that needs them, each described below.
- Groups. When you are in a group, each finished session uploads a day summary: the date, how many sessions, how many sets, total volume, and whether you declared a rest day. Not the exercises, not the weights. People in your groups can see these summaries. Nobody else can.
- Trainer. If you pair with a trainer and approve them, the categories you tick are uploaded for that trainer to read: routines and sessions, sets, reps and weights, records and streak. Unticking a category, or ending the link, deletes those rows from the server rather than hiding them. Nothing is uploaded for a trainer you have not approved.
- Gym records. If you pick a gym and post a record, we store the lift, the weight, the reps, the date, the gym, and the video you chose. These are visible to every CMAX user who has picked the same gym. When you post, the app takes one location reading to check you are near the gym you picked. The reading is compared on your phone and discarded; no location is stored, and the app has no background location access.
- Notifications. If you allow notifications, we store a device token so a trainer request, a suggested routine or an accepted suggestion can reach you. Nothing else is sent.
- Apple Health. With your permission the app writes finished sessions to Health and reads your body weight for an energy estimate. Health data stays in Health on your device and is never sent to us.
What we do not do
- No advertising, no analytics SDKs, no tracking across apps or sites, no selling or sharing of data with data brokers.
- No reading of your contacts, photos beyond the single video you choose for a record, or location beyond the single check described above.
- No messaging. CMAX has no inbox and no direct messages.
Who processes it
Data you upload is stored with Supabase (database, storage and functions), which hosts the CMAX backend. Sign-in is handled by Apple and Google, and push notifications by Apple. Each acts as a processor for CMAX; none of them receives your training data for their own purposes.
Who can see what
Your username and day summaries: people who share a group with you. Your uploaded log: only trainers you have approved, only the categories you ticked. Your gym records and videos: users at the same gym. Anyone can report a record; a record reported by three different people is hidden, and you can block a person so neither of you sees the other.
Deleting your data
Settings → Delete account removes your account and everything on the server attached to it: memberships, trainer links, the shared log, records, videos, reports and device tokens. It cannot be undone. Your training log on the phone is not touched; it was never the account's. Delete the app to remove that, or use Settings → Export to keep a copy first.
Children
CMAX is not directed at children under 13 and does not knowingly collect information from them.
Changes
If what the app collects changes, this page changes with it and the effective date above moves.
Contact
Support, or email support@cmaxlifting.com.