Privacy policy
Your data belongs to your CMAX account. Your training log (sessions, sets, weights, records, rest days, routines and plans) and everything you record in Body (weights, measurements and progress photos) are saved to your account, so they follow you to any phone you sign in on. Your phone keeps a working copy so logging works with no signal, and syncs it when it can.
Signing out takes it off the phone, once everything has been saved to your account, so the next person to sign in on that phone sees their own data and not yours. Anything that could not be saved before you signed out (with no signal, for example) waits on that phone, unreadable in the app, until you sign in there again.
It is stored on our servers, and that is a change. Until September 24, 2026 the log lived on your phone and backed up to your own iCloud account, which we could not read. It is now stored with our database provider, protected by access rules that let only your account read it, encrypted in transit and at rest. It is not end-to-end encrypted, which means it is not technically impossible for us to read; we do not look at it, except to fix a problem you ask us about. If you used CMAX before that date, an older copy may still sit in your iCloud; CMAX no longer reads or writes it, and you can remove it in the Settings app under your name, iCloud, then Manage Storage.
What we collect, and when
- Account. If you sign in, we store the identifier and email address provided by Apple or Google, and the username you choose. If you add a profile picture, we store it, cropped to a square and re-saved without its location or camera details; you can change or remove it at any time in Profile, and a removed or replaced picture is deleted. Sign in with Apple's Hide My Email works; we store the relay address Apple gives us. CMAX requires an account to use.
- Your training and Body. Everything described at the top of this page, stored in your account and readable by your account alone. Progress photos are kept in private storage that only your account can open. Nobody in your groups and no trainer can see any of it unless you share it as described below.
- Groups. When you are in a group, each finished session uploads a day summary: the date, how many sessions, how many sets, total volume, and whether you declared a rest day. Not the exercises, not the weights. People in your groups can see these summaries. Nobody else can. Unless you switch off Share records with my groups in Settings, your best set on each exercise (the weight, the reps or the length of a hold, and the day you set it) is also uploaded, so it can appear on your groups' record boards; switching it off deletes those from our servers. A weekly story card of a group shows only counts and exercise names, never anybody's username.
- Friends and gym pics. A friend is somebody who accepted your request, or whose request you accepted; nobody can follow you. People can find you by your username to send a request. When you post a gym pic at the end of a workout, we store the photo, the workout you choose to put with it (its length, total volume and the top set of each exercise) and the song you pick, if any. You choose who sees it: your friends, any of your groups, or both. They can see it, with your username and your current streak, for 24 hours; then it is deleted. A group sees it only while you are still in that group. The photo is taken with the camera at that moment or chosen from your photos, and is re-saved without its location. A friend can report a gym pic, which hides it from them and keeps a record of the report for us to review; a reported photo is kept for 30 days so it can be reviewed, even if the post is deleted or expires, and then it is deleted like any other. Either of you can block the other, which ends the friendship.
- Trainer. If you pair with a trainer and approve them, the categories you tick are uploaded for that trainer to read: routines and sessions, sets, reps and weights, records and streak. Unticking a category, or ending the link, deletes those rows from the server rather than hiding them. Nothing is uploaded for a trainer you have not approved.
- Gym records. If you pick a gym and post a record, we store the lift, the weight, the reps, the date, the gym, and the video you chose. These are visible to every CMAX user who has picked the same gym. When you post, the app takes one location reading to check you are near the gym you picked. The reading is compared on your phone and discarded; no location is stored, and the app has no background location access.
- Notifications. If you allow notifications, we store a device token so things other people do can reach you: a trainer request or approval, a suggested routine, a friend request, a nudge from your group, a gym pic from a friend or a group mate, somebody passing your gym record, or somebody joining your group. Requests somebody is waiting on always come through; everything else is at most one push a day, and gym pics, records and group joins can each be switched off in Settings. Your settings for those three are stored with your account. The rest timer, the streak reminder and the comeback reminders are scheduled on your phone and are never sent to us.
- Apple Health. With your permission the app writes finished sessions to Health and reads your body weight for an energy estimate. If you also allow it from Body, the weight, body fat and waist readings you log are written to Health. If you choose to bring weights in from Health, they become Body readings in CMAX and are kept with your account, like any weight you type in.
- Apple Watch. When the CMAX Watch app is following a workout, with your permission it measures your heart rate and the calories you burn. CMAX keeps the workout's calorie total with that workout on your phone, shows it on the workout summary, and puts it on a story card only if you choose to share one. Your heart rate and calories are never sent to us. Other than these and your body weight, CMAX reads nothing from Health.
- Body. Weights, measurements and progress photos are saved to your account as described at the top of this page. They are never shared with your groups or with a trainer. On the phone, progress photos are protected while it is locked, and the location a photo was taken at is removed before it is saved.
What we do not do
- No advertising, no analytics SDKs, no tracking across apps or sites, no selling or sharing of data with data brokers.
- No reading of your contacts, of photos beyond the ones you pick yourself (a record video, a story background, a progress photo, a profile picture), or of location beyond the single check described above. The camera is used only when you take a gym pic or a profile picture.
- No messaging. CMAX has no inbox and no direct messages.
Who processes it
Data you upload is stored with Supabase (database, storage and functions), which hosts the CMAX backend. Sign-in is handled by Apple and Google, and push notifications by Apple. Songs on gym pics come from Apple Music: the words you type to find a song are sent to Apple's search, and the 30 second preview and the album art are played and shown straight from Apple. No Apple Music account is needed and none is connected. Each acts as a processor for CMAX; none of them uses your data for their own purposes.
Who can see what
Your training log, your Body readings and your progress photos: you, and nobody else. Your username, your time zone (stored so that "today" means your today rather than the server's) and day summaries: people who share a group with you. Your gym pics, with the workout and song you put on them, and your current streak: your friends, the groups you send them to, or both, for 24 hours. Your best set on each exercise: people who share a group with you, unless you switch it off. Your totals, worked out from those day summaries (streak, sessions, sets, total volume, rest days and the month you started, never the sets themselves): your friends and people who share a group with you. Your username and your profile picture: anyone who can see your username in CMAX (friends, group mates, people searching for you, your gym's board, a trainer), except people you have blocked or who have blocked you. Your uploaded log: only trainers you have approved, only the categories you ticked. Your gym records and videos: users at the same gym. Anyone can report a record; a record reported by three different people who train at that gym is hidden, and you can block a person so neither of you sees the other.
Deleting your data
Settings → Delete account deletes your account and everything in it: your training log, your Body readings and progress photos, memberships and your bests on group record boards, friends and gym pics, your profile picture, trainer links, the shared log, gym records, videos, reports you made and device tokens, from our servers and from the phone. The one exception: a gym pic somebody reported in the last 30 days, and the report about it, are kept until that review period ends, so deleting an account cannot erase what was reported. It cannot be undone. Use Settings → Export data first to keep a copy of your training.
Children
CMAX is not directed at children under 13 and does not knowingly collect information from them.
Changes
If what the app collects changes, this page changes with it and the effective date above moves.
Contact
Support, or email support@cmaxlifting.com.