Privacy policy.

Pathlete is made by Form Studios, LLC (“we,” “us”). This policy covers the Pathlete app on iPhone and Android and the website at formstudios.so.

You can use email and a password, Apple, or Google to sign in. Your profile, training, photos and Ask Tyler chats are saved to your account on our server in Canada, so they come back when you sign in on another phone. A few other services we rely on receive some data, and every one of them is listed below. We don’t sell your data or show ads, and we don’t track you across other apps or websites.

You can create an account with email and a password on iPhone or Android, or sign in with Google on either platform or Apple on iPhone. Email sign-in is handled by Supabase Auth, which stores a protected password hash rather than a readable password. Apple or Google gives us your email address and an ID for your account with them. With Apple you can hide your email behind a relay address, and you choose whether to share your name. Google shares your name and a link to your profile picture.

Before you sign in, the app can create a guest account to save your progress and associate a purchase. When you sign in, that progress and membership can move to your account. Guest accounts are covered by this policy and our deletion process.

Your account holds your profile (name, birth year, sex, height, body weight, goal, experience and how you heard about us), your settings (such as units, training days, reminders and time zone), the muscles you want to focus on, your program and progress, your workouts (weights, reps, reps in reserve, cardio minutes, ratings and notes), changes you make to upcoming workouts, the swaps and rest times you keep, which tips you’ve seen, your Ask Tyler questions and answers, and your progress and profile photos. If you cancel Premium from the app, it also keeps the reason you pick and any note you add.

It’s stored with Supabase, our hosting provider, in Canada. Each account can only access its own data. Progress photos and your profile photo are stored securely, in private storage that other users can’t see.

To keep you signed in, we store a session for each phone you use, with its IP address and device details, until you sign out. For notifications we also keep each phone’s platform, time zone, app version and, if you allow them, its push token, plus a record of the notifications we send you.

The app keeps a copy of your data on your phone, so it works offline and syncs when you’re back online. A workout in progress is saved locally until you finish it; if you ask an AI question, its current details are included in that request. If you sign out, the phone keeps its copy for when you sign back in.

Pathlete doesn’t read Apple Health, Health Connect, your location, your contacts or your microphone. It only sees photos you take or pick yourself, and it saves share cards to your library only when you ask it to.

Hosting (Supabase). Supabase hosts your account, our database and photo storage in Canada, and runs our server code. It processes standard request data, such as IP addresses, to run and protect the service. See Supabase’s privacy policy.

Ask Tyler (Anthropic and Google). These services help generate automated coaching answers and find relevant Tyler videos. The AI sharing section below explains exactly what they receive and how you control it.

Product analytics (Mixpanel). We record how the app is used so we can make it better: screens opened, onboarding answers (goal, experience, sex, an age range rather than your birth year, height and weight ranges rather than your measurements, training days, focus muscles and where you heard about us), workouts started and finished, set counts, streaks, program progress, search words entered in the exercise library, the topic of Ask Tyler questions (not the chat text), purchases and settings changes. These events are tied to a random identifier from your sign-in, plus basic device information and an approximate location derived from your IP address. We don’t send your name, email, photos, workout notes or chat messages to Mixpanel. The “Other” answer to how you heard about us includes the text you enter in that onboarding field. AI permission and report events use categories, not question or answer text. See Mixpanel’s privacy policy.

Subscriptions (Superwall, Apple, Google). Superwall shows our paywall and checks whether your subscription is active. It receives the same sign-in identifier, device information and purchase events. It also tells our server when your subscription starts, renews, changes or ends, so your membership follows your account. Payment itself is handled by the App Store or Google Play; we never see your card details. See Superwall’s privacy policy.

Notifications (Expo, Apple, Google). Workout reminders are scheduled on your phone. Our server sends a reminder before a free trial ends and a notice if a payment fails. These go through Expo’s push service to Apple or Google, with your phone’s push token. See Expo’s privacy policy.

Sign-in (Supabase, Apple, Google). Email sign-in uses Supabase Auth. Apple and Google sign-in use their respective services. The details are listed under Your account.

Website. formstudios.so is hosted by Vercel, which processes standard request data (IP address, browser, page and time) to serve and protect the site. The website has no analytics, ad pixels or marketing cookies.

AI sharing is off until you give permission. Agreeing to our Terms or creating an account alone does not enable it, and you can use the rest of Pathlete without it. Ask Tyler shows “Before Tyler answers” before sending your first question. “Not now” sends nothing; “Agree and ask” saves your permission and sends the question you just chose to ask. We save the permission version, your choice and when it changed with your account.

Anthropic’s Claude API receives your question, earlier messages in that conversation, and the training context supplied with the request: your goal, experience and units, training schedule and focus muscles, current plan and week, recent training, the live or upcoming workout and completed sets, the selected exercise and its targets, warm-up, rest times, substitutions, cues, muscle and resistance-profile information, exercise notes and coaching FAQs. It uses that context to write an answer and, when source search is available, to work out what to search for and select relevant videos. The source-selection step also includes candidate video captions and transcript excerpts. We don’t add your name, email or account ID to these requests, but information you include in a question or note is part of the content sent.

Google’s Gemini API receives a search query derived from the conversation and training context. It turns the query into a numerical representation to find relevant videos in our library. We don’t send it your account identifiers or the full chat, but the query can reflect details you supplied. We use Google’s paid API service.

Anthropic’s commercial API terms exclude model training by default. Google’s paid-service terms exclude using prompts and responses to improve its products. Both providers may retain data for security, abuse prevention or legal requirements; this is not a promise of zero retention. See Anthropic’s commercial data-use policy, its API retention policy and Google’s Gemini API terms.

You can withdraw permission in Settings → AI sharing. This stops new AI requests, including later stages of a request in progress; requests already sent to a provider cannot be recalled. You can still read saved conversations. Withdrawal doesn’t delete them: chats remain until you delete your account.

You can report a completed AI answer using a reason and optional details. We store the chosen reason and any details you provide, your account ID, the answer reference, the time, and the review outcome. Authorized staff can review the reported answer and relevant conversation to investigate and improve safety. Report details are not sent to AI providers or included in analytics. Reports are private and are removed when the associated answer or account is deleted.

If you email support, we receive your email address and the information you choose to send. We use it to help you, verify account or data requests and resolve problems.

To run the app and build your program (your height, body weight, age, sex and experience set the starting weights of lifts you haven’t logged yet), keep your training backed up and in sync across your phones, answer your Ask Tyler questions, handle your subscription and tell you about it, fix bugs and figure out what to improve, reply when you contact us, and meet legal obligations. We don’t build advertising profiles, and we don’t sell or share your data for cross-context behavioral advertising.

Where privacy law needs a legal basis, we rely on performing our agreement with you (running the app, your account and your subscription), our legitimate interest in understanding, improving and protecting Pathlete, and legal obligations. We rely on your consent for the AI sharing described above; you can withdraw it without affecting processing that already occurred.

We keep account and training data while your account is active, unless you delete it sooner. Saved AI conversations remain until you delete your account; withdrawing AI permission alone does not erase them. A guest account is kept the same way, until you delete it or save its progress to an account. Deleted data in our database backups expires within 7 days. Server request logs, including IP addresses, are kept for up to 7 days.

Deleting your account cleans up the data associated with it. AI providers follow their own retention policies linked above; withdrawal or account deletion cannot recall content already sent to them.

We keep the minimum identifiers needed to finish an open deletion request, then remove them once it’s done. A limited completion record, without those identifiers, remains for 30 days after deletion finishes. Minimal billing records separated from your account expire 90 days after the latest billing event or subscription period end, whichever is later.

We retain a restricted, non-readable matching record only while delayed billing events could otherwise recreate deleted identifiers. It is used to prevent that reintroduction, not for analytics or marketing. If a guest purchase moved to an active account, the link needed to maintain that membership and later erase its data remains until that account is deleted.

Support emails are kept as long as needed to resolve your request and any related legal obligation. We may retain only the records necessary for a specific legal obligation or dispute for the required period, with access restricted to that purpose.

Data is encrypted in transit and at rest. No system is perfectly secure, but we collect only what’s listed here.

Open Settings → Delete account, including if you’re using a guest account. The app saves a deletion receipt before sending the request, and you can check Deletion status from the welcome screen after sign-out. If the request needs Apple sign-in again, follow the reauthorization prompt so deletion can proceed.

Deletion removes your account, profile, training, photos, saved AI chats, permission and report records, and cleans up the data associated with your account. The app clears its training and photo copies on the phone used to delete the account, keeping a minimal deletion receipt for status checks. Copies previously saved on other phones or in your own photo library are not remotely erased; remove the app from those phones to remove its local copies. Signing out alone keeps a local training copy for your next sign-in.

To request deletion by email, or delete selected photos or past analytics while keeping your account, follow our delete your data page.

Deleting your account doesn’t cancel a subscription. Use Manage subscription in the app or the official store links to cancel separately.

Depending on where you live, you can ask to access, correct, delete or get a copy of your data, or object to how it’s used. Email support@formstudios.so and we’ll respond within the time the law requires. We may need to confirm the request is really from you. You can also complain to your local data protection authority.

Pathlete is for people 16 and older. We don’t knowingly collect data from anyone younger. If you think someone under 16 has used Pathlete, email us and we’ll delete what we can find.

Your account, training and photos are stored with Supabase in Canada. Our server code can run in the Supabase region closest to you, and the other services listed above may process data in other countries, including the United States. Where the law requires safeguards for international transfers, we rely on the ones our providers offer, such as Standard Contractual Clauses.

If we change what we collect, we’ll update this page and the date at the top, and tell you in the app when the change matters.

Questions or requests:

Form Studios, LLC
support@formstudios.so