Privacy Policy

Overview

Eldrulf Fitness is a privacy-focused workout tracker: GPS-based outdoor workouts, camera-based rep counting for bodyweight exercises, manually-logged strength training, guided multi-exercise circuits, and an optional Apple Watch companion for live heart rate. It has no account system, no ads, and no telemetry of any kind.

1. Data We Collect and How We Use It

1.1 Workout data

Depending on the workout type, recording a session may create the following:

The app does not require an account, a login, or a password of any kind. Nothing you enter is tied to an identity beyond the devices you use it on.

1.2 Apple Health (HealthKit)

If you have a paired Apple Watch and choose to enable heart rate during onboarding, the app does two distinct things with Apple's HealthKit framework, and it's worth being precise about the difference:

• It reads your live heart rate from the Watch during a workout, to show it in real time and calculate your session average.
• It writes a bare workout entry (type and duration only, no route, no reps, no other detail) into the Health app.

The write is not a separate choice made to duplicate your data into Health. It's a consequence of how watchOS works: getting live heart rate on the Watch requires an active workout session, that's the only mechanism Apple provides for it, and properly ending that session is what writes this bare entry. The app does not request permission to write your heart rate samples, distance, calories, or any other Health data type, only the workout entry itself, and it never reads anything from Health beyond the live heart rate stream during an active workout. Your real, detailed workout history lives only in the app's own encrypted storage described in Section 2, the Health app entry is a minimal byproduct, not the source of truth.

1.3 Location and GPS

For GPS-based workout types, the app uses your device's location to record your route, distance, and pace. This is stored locally (encrypted, as above) and is never transmitted anywhere, with one narrow, opt-in exception covered in Section 3: Live Map Tiles.

1.4 Camera and pose detection

For camera-based exercises, the camera is used to detect your body position and count reps. This processing happens entirely on your device using an on-device pose detection model. No image, video, or camera frame is ever saved, stored, or transmitted anywhere, by this app or to anyone else.

1.5 App preferences

Settings such as theme, distance units, and feature toggles (Live Map Tiles, Weather, Spoken Pace, Watch Haptics, biometric app lock) are stored locally on the device.

1.6 Data we do not collect

The app does not collect, access, or process any of the following:

• Any account credential, username, or password
• Your name, email address, or any other contact information
• Contact list or address book
• Photos or media library (only live camera frames during an active camera-based exercise, per 1.4)
• Browsing history
• Device advertising identifiers (IDFA, IDFV, Android Advertising ID)
• Crash logs, analytics, or usage telemetry of any kind
• Biometric data itself, the optional app lock only ever receives a yes/no answer from iOS, see Section 9
• Payment or financial information
• Social network credentials

2. How Data Is Stored

Workout history and settings are stored in an AES-256 encrypted local database (Hive). The encryption key itself is generated on your device and held separately, in the platform's own secure hardware-backed storage:

• iOS and watchOS: the iOS Keychain, via flutter_secure_storage.
• Android: the Android Keystore system, hardware-backed where the device supports it.

The key is never included in the encrypted database files themselves, and it never leaves your device.

If you're signed into iCloud and have iCloud Drive enabled for this app, the encrypted database syncs across your own devices through your own Apple iCloud account, governed entirely by your own iOS Settings, not by Azimos Labs, LLC. This company does not operate any server of its own and cannot see, access, or store a copy of your iCloud data; only Apple's iCloud infrastructure and your own signed-in devices can. If iCloud isn't available, your data simply stays local to that one device, still fully encrypted.

No backend server, database, cloud storage, or third-party data processor operated by Azimos Labs, LLC receives any data from this app.

3. Data Transmission

Aside from the operating system's own iCloud sync (Section 2), this app makes exactly two kinds of outbound network connection, and neither happens unless you explicitly turn it on in Settings. Until you do, this app makes zero network requests of any kind.

Live Map Tiles uses each platform's own native map framework, Apple MapKit on iOS and the Google Maps SDK on Android, never a separate third-party tile service and never a tile relay this company operates or has any relationship with. These two destinations don't handle that request identically once it reaches them, and we think that's worth knowing plainly rather than glossing over. Apple states it does not retain personal data tied to Maps usage, and ties that usage to an identifier that rotates multiple times per hour rather than to your Apple Account. Google's Maps Platform data, by contrast, is retained for varying lengths of time based on Google's own business needs, and falls under Google's overall privacy policy, the same one governing its account and advertising data elsewhere, not a Maps-only policy. Both are documented here so you can decide for yourself whether to turn this feature on, on either platform.

No analytics, no crash reporting, no advertising network, and no "phone home" of any kind, ever, at any time, regardless of these settings. The app does not make any background network requests.

4. Data Sharing and Disclosure

We do not sell, rent, license, or share any user data with any third party, including advertisers, data brokers, analytics providers, or any other entity. There are no third-party SDKs, advertising networks, or tracking frameworks integrated into this app. This app uses several open-source libraries to do its job (map rendering, on-device pose detection, text-to-speech, secure storage, and similar), all of them run entirely on your device, none of them are analytics, advertising, or tracking libraries, and none of them transmit your data anywhere on their own.

5. How This App Is Funded

Eldrulf Fitness is NOT monetized (a hobby project), free with no monetization at this time, but will move to a paid onetime upfront purchase at somepoint, but no subscriptions or etc. However, whatever the model, it does not involve the sale, rental, licensing, or exchange of any user's personal data in any way.

6. Children's Privacy

This app does not knowingly collect data from children, and since it has no account system, no data is ever tied to an identity that could reveal a user's age. Contact [email protected] if you have concerns.

7. Face ID / Touch ID (Optional App Lock)

If you turn on the optional app lock, the app asks iOS to verify your identity using Face ID, Touch ID, or your device passcode. This verification happens entirely within iOS itself, the app only ever receives a yes/no answer ("this is the device owner" or not). It never sees, receives, or stores any biometric data itself.

8. User Control and Data Deletion

You have full control over all data stored by the app.

To delete an individual workout:
Open it in History, or from the results screen right after finishing it, and use the delete button.

To delete everything at once: Uninstall the app. This removes all local data. If iCloud sync was active, you can also turn off "Eldrulf Fitness" under Settings → [your name] → iCloud → Manage Storage on your device to remove the synced copy. There is no account to deactivate and no server-side deletion request is necessary or possible, because no server holds a copy in the first place.

9. Security

Your workout data is protected by two layers: the app's own AES-256 encryption (Hive) around the data itself, and the device's native secure storage (iOS Keychain, Android Keystore) holding the encryption key separately. Neither layer depends on the other for its own security, and the key is never stored alongside the data it protects.

The app does not require a login, does not issue session tokens, and does not maintain any authenticated session with any server.

10. Changes to This Policy

If this app's data practices ever change, this document will be updated to match before that change ships, not after. The updated version will be posted at the same location this policy is currently hosted, and the effective date above will be updated.

11. Contact

This app does not monetize your data in any way, does not display ads, and does not use analytics or tracking of any kind.