Privacy Policy

What We Collect

When you use NOWISLIFE we may collect:

• Account information — first name, last name, email address, phone number, and password hash (or passkey credential ID)
• Profile data — optional profile photo
• Fitness data — exercises, workout logs, completion history, personal records, and team challenge contributions
• Profile & social data (optional social features) — your @handle, bio, profile photo, privacy and visibility settings, home gym, and city; the people you follow, your followers and friends, and the people you block or mute
• Content you post — workout posts (a summary of the workout — exercise names, sets, reps, weights, duration, volume, and PR marks — with an optional photo and caption), comments, "spots" (likes), copies you make of others' workouts, and gym check-ins
• Location data (optional; coarse only) — the gym or city you attach to a post or check-in, and the city you set for Nearby. We store the gym's or city's position, never your own coordinates — see Location below
• Contacts (optional) — if you choose to find friends from your contacts, one-way hashes of the email addresses and phone numbers in your address book are matched against our users and then discarded (see Finding Friends below)
• Reports — reports you file about content or users, and reports filed about your content
• Health data — heart rate, daily steps, active calories, and (to personalize coaching) resting heart rate, heart rate variability (HRV), and sleep duration from Apple HealthKit (only when you explicitly authorize access on your device)
• Device & session data — login IP address and the approximate location (country and city) we derive from it, browser user agent, push notification token, and session timestamps (for security monitoring — for example, to record sign-in attempts and flag access from unexpected locations)
• Analytics data — pseudonymous usage events and interactions (see Analytics & Tracking below)
• Communications — support tickets and contact messages you send us, including any screenshots you attach

We do not collect facial-recognition or fingerprint biometric identifiers. Passkey biometrics (Face ID, Touch ID, etc.) are processed entirely on your device and are never transmitted to our servers. Optional Apple Watch motion data, if you choose to contribute it, is treated as sensitive data (see below).

We collect this information from you directly, from your device and app, and — only with your authorization — from Apple HealthKit.

How We Use Your Data

We use your data to:

• Operate and improve the NOWISLIFE service
• Verify your identity and secure your account
• Send transactional communications (email verification, password reset, team invites)
• Power optional features such as the AI Coach, AI support triage, and the social features (feed, profiles, follows, check-ins, Nearby)
• Filter, review, and moderate content and enforce our Terms and community rules
• Send push notifications for workout reminders, team activity, and social activity (configurable in Settings)
• Detect and prevent fraud or abuse
• Comply with legal obligations

AI Coach

NOWISLIFE includes an optional AI Coach you can chat with, plus a short daily message on your Today page.

The interactive chat is powered by a third-party AI provider. To respond, Coach is given your first name, facts Coach has saved about you (such as your equipment, goals, or injuries/limitations — Coach saves these on its own when you mention them, and you can view and delete them in Settings › Coach), notes Coach writes for its own reference about your training patterns (these are not shown to you in the app; you can erase them at any time with "Forget everything" in Settings › Coach), a summary of your current routine, your streak, your most recent completed workout, your most-trained exercises, today's scheduled workout, and the messages you send — including any photos you attach (for example, a whiteboard or program you want parsed into a workout). If you ask Coach about your history, your progress, or a team challenge, the relevant records are shared for that request as well. If you have connected Apple Health and consented to share it, Coach may also be given your recovery summary (resting heart rate, heart-rate variability, and last night's sleep) and workouts recorded by other apps, so it can shade its suggestions — this health data is used only for that request, is never used for advertising, and is never sold. Attached images are sent to a third-party AI provider for parsing and are not stored by NOWISLIFE — they are used only for that chat turn.

The short daily Today message is generated using third-party AI providers, from a summary of your recent workout activity.

Your email, password, phone number, and account credentials are never shared with the AI provider, and Coach never changes your data without your explicit confirmation. You can disable the daily Coach message in Settings and clear your chat history from the Coach menu. Coach also clears the thread on its own: once 24 hours pass with no new messages, the next time you open it the conversation starts fresh.

AI Support Triage

When you submit a support ticket or contact message, the text of your message, your name, and any screenshot you attach may be processed by an AI model to help our support team triage and respond faster. No payment information or passwords are ever included.

SMS Verification

We use a third-party SMS provider to send one-time SMS verification codes to the phone number you provide during account registration. These codes are used solely to verify your identity and secure your account.

• Message content: One-time numeric verification codes only
• Frequency: One message per verification request (registration and password reset)
• Opt-out: Reply STOP to any message to stop receiving SMS. You may also contact us at nowislife.com/contact
• Opt-in: Reply START to resume receiving verification messages
• Message and data rates may apply depending on your carrier and plan
• We do not send marketing, promotional, or recurring messages via SMS

For more details, visit our SMS Consent & Disclosure page.

Apple Health Integration

NOWISLIFE offers an optional integration with Apple HealthKit on iOS devices. This integration requires your explicit, separate consent before any health data is accessed.

When authorized, NOWISLIFE may:

• Read from HealthKit: heart rate, daily step count, active calories burned, workouts (including those you record in other apps), and — to personalize your coaching — resting heart rate, heart rate variability (HRV), and last night's sleep duration
• Write to HealthKit: completed workout sessions (workout type, duration, total volume, and session name)

To power your personalized coaching ("The Read" on Today and your daily coach message), NOWISLIFE stores summaries of certain Apple Health data on our servers, linked to your account — for example, a daily recovery summary (resting heart rate, HRV, and sleep duration) and summaries of workouts you record outside NOWISLIFE (such as type, duration, and calories). Other HealthKit data is processed on your device only.

Important:

• No HealthKit data of any kind is used for advertising or data mining, sold, or shared with any independent third party for its own use — whether it stays on your device or is stored as one of these summaries. Service providers under contract, acting solely on our behalf, are the only outside parties that process it; if you have connected Apple Health and consented, that includes the third-party AI provider that powers Coach, which receives your recovery summary only for the request it is answering
• Aside from the summaries described above, other HealthKit data is processed on your device and is not transmitted to our servers
• Health data is not stored in iCloud by NOWISLIFE
• We retain these summaries only as long as needed for coaching, and in no case longer than 24 months
• You can revoke Apple Health access at any time through your device Settings or within the NOWISLIFE app — revoking stops further collection and deletes the health summaries previously stored on our servers
• Deleting your account also deletes this data
• NOWISLIFE is a consumer fitness app, not a healthcare provider — HIPAA does not apply to this data; it is protected by this policy and consumer-health-data laws instead
• You must provide separate, affirmative consent before any health data is collected (see Consumer Health Data Rights below)

Movement Sensor Data (Optional Contribution to Improve Auto-Tracking)

Separately from the Apple Health integration above, you can optionally choose to contribute raw movement-sensor data from your Apple Watch to help us improve NOWISLIFE's automatic set and rep tracking. This is off by default and requires your separate, affirmative consent.

This is distinct from rep counting itself. Your Apple Watch counts reps and detects sets on your device whether or not you turn this on. Turning it on additionally lets us collect and store the underlying raw sensor readings so we can train and improve that feature.

When you opt in, during a workout we collect:

• Raw motion-sensor readings from your Apple Watch (accelerometer, gyroscope, and device-motion values) recorded during a set
• Labels describing the set — the exercise, your confirmed rep count, set timing, which wrist the watch is on, and your handedness

This data is uploaded to our private cloud storage and linked to your account so it can be used as labeled training data.

Important:

• Contributing this data is optional and off by default — you must turn it on in Settings and provide separate, affirmative consent
• It is used solely to train and improve NOWISLIFE's own automatic-tracking features — never for advertising, data mining, marketing, or any unrelated purpose
• It is never sold to or shared with third parties
• Raw sensor recordings are retained only as long as needed to train our models and are then deleted; in no case are they retained for more than 24 months
• You can withdraw consent at any time in Settings — doing so stops all further collection and deletes the raw movement data you previously contributed
• Deleting your account also deletes this data
• Because this is health-related data, it is covered by the consent, withdrawal, and deletion rights described under Consumer Health Data Rights below

Push Notifications

NOWISLIFE collects and stores a push notification token from your device to deliver notifications. Notification categories include:

• Routine reminders — scheduled alerts for your daily exercises
• Follow-up reminders — check-ins after a workout window
• Team updates — activity from your teams
• Challenge alerts — team challenge notifications
• Goal milestones — personal achievement celebrations
• Social activity — spots, comments, copies of your workouts, PRs, and a Monday weekly recap of your own week
• Follows — follow requests and accepted requests
• Live Activity — during a workout, your current exercise and set progress can show on your Lock Screen and Dynamic Island

Social pushes include the other person's name and the workout name — never a comment's text or your photo. You can enable or disable each category individually in Settings. Routine reminders are scheduled locally on your device. Push tokens are stored securely and used solely for delivering notifications.

Workout Sharing

You may share workout templates via a link. Anyone with the link can view the shared workout data (exercise names, sets, reps, and targets). You control what you share — sharing is always initiated by you and can be revoked. Making a workout public on your profile also creates such a link.

Social Features & Public Content

The social features are optional, and privacy is the default: new accounts are private (people must request to follow you), new posts default to friends-only, your stats default to friends-only, and you are not shown in Nearby unless you turn it on.

• What a post contains — a summary of the workout you completed (exercise names, sets, reps, weights, duration, total volume, distance/time for cardio, and PR marks), an optional photo (we strip all photo metadata, including any GPS location, before storing it), an optional caption, and — if you choose — a gym or city.
• Who can see it — the audience you pick per post: Everyone, Friends (accepted followers), or Only me. Everyone content is public: any user can see it (including in Nearby), it appears on your public profile page (nowislife.com/@handle) and post pages on nowislife.com without an account, it can be previewed when links are shared (the preview can include the photo, your name, handle, caption, and workout summary), and search engines may index it. A public post from a private account is still public. Comments are shown only to signed-in users. Individual check-ins are shown only to your friends; your aggregate "Top gym" stat (gym name and visit count) follows your Stats Visibility setting.
• What others can do — users who can see a public workout or a posted session can copy it into their own account ("Run it"); we show how many people ran it. Copies stay with them if you later delete the post or make the workout private.
• Your controls — private account, per-post audience, stats visibility, location default, Nearby discoverability, auto check-in, blocking (hides you from each other everywhere in the social features and removes any follow), muting (hides someone from your feed), and deleting posts or comments — all in the app.

Location

Location in NOWISLIFE is coarse and optional, and we never store your own coordinates:

• Posts and check-ins point at a place (a gym) or a city. We store the gym's or city's position, and for Nearby a city-sized grid cell (roughly 5 km) derived from it — never your own fix.
• If you allow location access, your device's location is used transiently — to rank nearby gyms in the picker, to check you in automatically when a workout starts near a gym you use, to set your city, and to power Nearby. It is sent to our server as a search parameter for that request and is not stored. Location access is "while using the app" only; we never track you in the background.
• Gyms you add manually are stored at a coarse grid position (roughly 1 km), never your exact coordinates. Gyms found through map search are stored at the position the map provider reports for that business.
• Gym search, place names, and city labels use Google Maps Platform; the search text or coordinates for that request are sent to Google under the Google Privacy Policy.
• Location on new posts is off by default (you can change the default in Settings › Social); gym-level is always an explicit choice you make on the post. Location is never attached to Only-me posts.

Finding Friends (Contacts)

If you choose Find friends from contacts, the app reads the names, email addresses, and phone numbers in your address book on your device, converts each email address and phone number into a one-way SHA-256 hash, and sends only those hashes to our server to see which ones belong to NOWISLIFE users. Names and raw contact details never leave your phone, the hashes are used only for that request and are not stored, and we do not build a copy of your address book. Matches are shown to you as suggestions; nobody is followed automatically.

Content Moderation

To keep the community safe and to meet our obligations under app-store rules, content you post is checked before it is shown publicly. Photos (by their address) and text (captions, comments, and the workout and exercise names in a post) are sent to a third-party content-moderation AI provider, which returns a safety verdict and does not store the content. Content the filter flags — or that our filter could not check — is held from public view until a person on our team reviews it. Anyone can report a post, comment, or user; reports (including who filed them, which we do not disclose to the reported user) are reviewed by our team, who may look at the reported content, remove it, or remove the user. We keep reports and moderation decisions for a limited time (see Retention) to handle appeals and repeat abuse.

Analytics & Tracking

We use the following analytics services to understand how the app is used and to improve the experience:

• Product analytics — pseudonymous event tracking to understand feature usage, on the website and in the app. A pseudonymous user ID (not your name or email) is associated with events, and only aggregate profile facts (such as how many workouts you have logged) are attached — never your name, email, phone number, or health data. On the website, and in the app during our beta period, our analytics provider may also record session replays of what is on screen (which can include workout names, coach messages, and values you type; passwords are never recorded). Replays are used only to diagnose problems and improve the app, are kept for a limited time, are never used for advertising, and are deleted when you delete your account. In the app we additionally use a mobile-app analytics service for pseudonymous usage events (screen views and feature use).
• AI coaching analytics — to monitor the quality, safety, and accuracy of the AI coach, the content of your coach conversations (the messages you send and the coach's responses) is processed by our analytics provider. These messages can include personal information you choose to share with the coach — for example your goals, training, or how you are feeling. This content is used only to evaluate and improve the coaching feature; it is never used for advertising and is never sold.
• Update diagnostics — when an over-the-air app update fails to launch, a per-installation identifier, your user ID (if signed in), and the update channel and version are reported so we can fix it.
• Error monitoring — a third-party service for error and performance monitoring. On our website, when an error occurs it may capture a short diagnostic session replay; all text is masked and all media is blocked, and replays are recorded only on errors, never during normal use. In the mobile app, only error and crash diagnostics are captured, with personal data scrubbed before transmission — no session replay is recorded.

We do not respond to browser Do Not Track (DNT) signals. We honor Global Privacy Control (GPC) and other recognized opt-out-preference signals as valid opt-out requests; a GPC signal disables analytics for that visit. We do not disclose personal data for money or other valuable consideration, and we do not use it for cross-context behavioral or targeted advertising — so we do not "sell" or "share" your personal data as those terms are defined under state privacy laws.

We use strictly necessary session cookies (HttpOnly, Secure) to maintain your authenticated session. We do not use third-party advertising cookies.

Service Providers

We share data with the following service providers solely to operate the NOWISLIFE service, under data processing agreements:

| Category | Purpose | |----------|---------| | Cloud infrastructure | Database hosting, private file storage, and content delivery | | AI processing | AI Coach chat, generated daily messages, and AI support triage | | Communications | SMS verification and transactional email delivery | | Rate limiting & bot protection | Abuse prevention on registration, login, and API endpoints | | Analytics | Pseudonymous product and website analytics | | Error monitoring | Error, crash, and performance diagnostics | | Push & app updates | Push notification delivery and over-the-air app updates | | Content moderation | Automated safety checks on posted photos and text (third-party AI provider) | | Maps & places | Gym search, place names, and city labels — Google Maps Platform (named because Google's terms require it) |

We do not sell your personal data. Beyond these service providers, we share data only:

• When required by law, court order, or to protect the rights and safety of NOWISLIFE or its users
• In connection with a merger, acquisition, or sale of assets (users will be notified)

Data Retention & Deletion

You may delete your account at any time from within the app. Account data is permanently deleted after a 7-day grace period. We keep each category of data only as long as needed for its purpose:

| Category | Retention | |----------|-----------| | Account, fitness logs, profile photo | Life of your account; deleted after the 7-day grace period | | Posts, photos, comments, spots, check-ins, personal records, follows, blocks | Until you delete them, or your account; deleted after the 7-day grace period. A deleted post's photo is removed at once; copies of a public workout that other users already made stay in their accounts | | Photos uploaded but never posted | Removed by our daily cleanup once they are more than 24 hours old (so within about 48 hours) | | Reports and moderation decisions | Up to 24 months after resolution (appeals, repeat-abuse handling) | | Coach chat conversations | Cleared automatically once 24 hours pass with no new messages — the next time you open Coach it starts fresh, and anything Coach had drafted but you had not saved goes with it. You can also clear the chat yourself at any time | | Coach's own notes about your training patterns | Life of your account, until you erase them with "Forget everything" in Settings › Coach | | Session replays (analytics) | Up to 90 days | | Apple Health recovery summary | Until you disconnect Apple Health; no longer than 24 months | | Optional movement-sensor data | Until you withdraw consent; no longer than 24 months | | Login & SMS-consent IP, user agent, session timestamps | Up to 12 months, for security | | Push notification token | Until you disable notifications or delete your account | | Support tickets | Up to 24 months after resolution |

Aggregated or de-identified data that can no longer be linked to you may be retained longer for analytics.

Security

We implement industry-standard safeguards including encrypted connections (HTTPS), hashed passwords (argon2id), access controls, third-party bot protection during registration and login, and rate limiting on authentication endpoints. No method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and enable passkey authentication.

Data Breach Notification

If a breach affects your personal information, we will notify affected users without unreasonable delay and no later than 60 days after discovery, by email and in-app notice. We will also notify the U.S. Federal Trade Commission as required by the FTC Health Breach Notification Rule — at the same time as users if 500 or more are affected, and otherwise through the FTC's annual reporting — and will notify prominent media outlets where a breach affects 500 or more residents of a single state. We will also comply with applicable state breach-notification laws.

Children

NOWISLIFE is intended for users 18 years of age and older. During registration, you must separately confirm that you meet this age requirement. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will terminate the account and delete the associated data.

App Updates

NOWISLIFE may receive over-the-air updates without requiring a new download from the App Store. These updates may include bug fixes, performance improvements, and minor feature enhancements. Major feature changes will be communicated through the app. If an update fails to launch, a per-installation identifier and (if you are signed in) your user ID are reported with the update version so we can fix it — see Analytics & Tracking.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, or sell
• Delete your personal information (subject to certain exceptions)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share personal data)
• Limit the use of sensitive personal information (including health and fitness data)
• Non-discrimination for exercising your privacy rights

We honor Global Privacy Control (GPC) browser signals as a valid opt-out request.

To exercise any of these rights, submit a request through nowislife.com/contact. We will respond within 45 days.

Privacy Rights in Other U.S. States

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or Montana, you have the right to confirm and access your personal data, correct it (except in Utah), delete it, obtain a portable copy, and opt out of sale, targeted advertising, and significant profiling. We do not sell personal data, run targeted advertising, or profile you in those ways. We process sensitive data — including health and fitness data — only with your consent and never for advertising.

To exercise these rights, contact us through nowislife.com/contact; we respond within 45 days (extendable once where allowed). If we deny your request, you may appeal by replying to our response, and if the appeal is denied you may contact your state Attorney General. You may use an authorized agent to submit a request on your behalf.

Consumer Health Data Rights (Washington, Nevada, Connecticut)

If you use NOWISLIFE's health or fitness features, your consumer health data is also governed by our separate Consumer Health Data Privacy Policy, which controls if it conflicts with this section. Under the Washington My Health My Data Act and the similar Nevada and Connecticut laws, you have the right to:

• Give separate, affirmative consent before any health data is collected, and withdraw it at any time in the app
• Confirm and access the health data we hold, and request deletion — when you delete it, we also direct our service providers to delete it
• Not be discriminated against for exercising these rights

We never sell your health data, we never share it with independent third parties for their own use, and we never track your precise location or tie any location to your health data. Consumer health data here includes data derived from Apple HealthKit, fitness data you log, raw motion-sensor data you contribute, and the recovery and readiness inferences we generate for your coaching.

Privacy Requests

To submit any privacy request — including data access, correction, deletion, a CCPA request, or a Washington MHMDA request — contact us through nowislife.com/contact. Please include your name and the email address associated with your account so we can verify your identity.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and notify you through the app. Continued use of NOWISLIFE after the effective date constitutes acceptance of the updated policy.

Contact

Questions about this Privacy Policy? Contact us at nowislife.com/contact.

NOWISLIFE is currently available to U.S. users only.