6-Pack App Sign in

Privacy Policy

Effective 2 November 2026

This policy explains what personal data 6-Pack App (the app and the website) collects, why, who we share it with and what choices you have. Imperial AI Ltd ("we", "us") is the controller of your data.

1. What we collect

Account data

  • Your email address and name.
  • A password hash (we never store your password itself), or, if you sign in with Google, your Google account identifier and the email Google gave us.
  • Passkeys (a public credential and its name, never your fingerprint or face) and, if you turn on two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
  • Your role (member, personal trainer or administrator) and whether your email is verified.
  • Sign-in sessions (hashed refresh tokens) and a security log of account events such as sign-ins and password changes, including the IP address and browser or device description.

Fitness, nutrition and health-related data

  • Your programme enrolment: start date, diet variant (for example vegetarian), weekly session target and any habit targets you changed.
  • Workout logs: which workouts and exercises you completed, repetitions achieved, notes you wrote and start and finish times.
  • Habit logs, such as daily water, reps or done / not done.
  • Your meal plan, which meals you marked as eaten, and your shopping lists and ticked items.
  • Progress summaries (streaks and weekly totals) that we calculate from the above. The app does not ask for your weight, height, body measurements or progress photos, and it does not read data from Apple Health, Health Connect or other health platforms.
  • Your timezone and settings (for example weekly summary notifications), and the reminders you set (label, days and time).

Recordings

  • If you choose to record yourself exercising, the app asks for camera and microphone access and uploads the video (with its sound), plus duration, size, an optional note, the related workout or exercise and whether you starred it.
  • Recordings are private to you. If you link to a personal trainer and share a recording, that trainer can watch it and leave feedback (comments, timestamps, a rating).
  • Unstarred recordings are deleted automatically after 90 days. You can delete any recording at any time.

Personal trainers

If you accept a trainer invite, that trainer can see your name, email, programme progress and the recordings you share with them. You can unlink at any time.

Subscriptions and purchases

Subscriptions are bought through the Apple App Store or Google Play and managed by RevenueCat. We receive your subscription status (active, expiry date, product, store and whether it renews). We never see your card or payment details; those stay with Apple or Google.

Push notifications

If you allow notifications, we store a device push token and platform (iOS or Android) and use Firebase Cloud Messaging to deliver messages such as trainer feedback, subscription reminders and weekly summaries. Reminders you set are also scheduled on your device.

Data on your device

The app keeps your sign-in tokens in the secure storage of your device (Keychain or Keystore) and remembers your appearance and biometric-unlock choices. Face ID or fingerprint unlock is handled by your device; we never receive biometric data.

Not collected

We do not use advertising or analytics SDKs, do not track you across other apps or websites, and do not use crash-reporting services that send data to third parties.

2. Why we use it, and our legal basis

  • To provide the service you asked for: your account, programme, tracking, recordings, trainers and subscription (performance of a contract).
  • To keep the service secure and prevent abuse: sessions, rate limiting, the security log (legitimate interests).
  • To send service messages and notifications you have enabled (contract / consent; you can turn notifications off in your device settings or the app).
  • To meet legal obligations, such as tax records of purchases held by the stores.
  • Fitness and nutrition information can be health-related. We process it only to provide the features you use, based on your explicit consent when you choose to log or record it. You can withdraw consent by deleting the data or your account.

We do not sell your personal data and we do not show ads.

3. Who we share data with

These providers process data for us, only to run the service:

  • Our server host: runs the API and database that hold your account and tracking data.
  • Cloudflare: serves this website and the API traffic (CDN, security) and runs R2 object storage for recordings and app media.
  • Google / Firebase: Firebase Cloud Messaging for push notifications, and Sign in with Google if you use it (we receive only your identifier, email and name).
  • RevenueCat: manages and validates subscriptions across the stores.
  • Apple and Google: the App Store and Google Play process your purchases and provide the app.
  • An email delivery provider: sends verification, password reset and security emails.
  • Your personal trainer, only if you link to one (see above).

We may also disclose data if the law requires it. Some providers are outside the UK / EEA; where that is so we rely on approved transfer safeguards such as standard contractual clauses.

4. How long we keep it

  • Account and tracking data: until you delete your account.
  • Recordings: 90 days unless you star them, or until you delete them.
  • Sign-in sessions: refresh tokens expire after 30 days, or earlier when you sign out or change your password.
  • Security log entries: kept only as long as needed to protect the service.
  • Purchase records are also held by Apple, Google and RevenueCat under their own policies.

5. Deleting your data

You can delete your account in the app (More > Delete account) or on the web at /delete-account. This permanently removes your profile, tracking data, meal plans, shopping lists, reminders, devices, trainer links and recordings. Cancelling a store subscription is a separate step you do in the App Store or Google Play. If you cannot sign in, email support@imperialai.ai.

6. Security

Passwords are stored as salted hashes, authenticator secrets are encrypted, traffic uses HTTPS, sessions are short-lived and can be revoked, and recordings are kept in a private bucket with time-limited links. We offer two-factor authentication and passkeys. No system is perfectly secure, so please choose a strong, unique password.

7. Children

6-Pack App is not directed at anyone under 18. The app does not currently check your age, and you must be at least 18 to create an account. If you believe a child under 18 has given us personal data, contact us and we will delete it.

8. Your rights

Under UK GDPR / GDPR you can ask us to give you access to your data, correct it, delete it, restrict or object to its use, and give you a portable copy; you can withdraw consent at any time. You can edit your name in the app. For other requests, email support@imperialai.ai. You also have the right to complain to your data protection authority (in the UK, the Information Commissioner's Office).

9. Changes

We may update this policy. The effective date above shows when it last changed; for significant changes we will notify you in the app or by email.

10. Contact

Imperial AI Ltd
support@imperialai.ai