Privacy Policy

Last updated: 2026-11-15

The short version: RawLift stores what you enter so the app can work for you — in a database that belongs to your account alone. We do not sell your data, we do not share it for advertising, and we do not use analytics or tracking tools. You can export or delete everything from Settings at any time.

1. Who we are

RawLift is operated by ELVISION LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801 (“we”, “us”). Questions or requests: privacy@rawlift.app.

Information about your bodyweight, nutrition and training is consumer health data. How we collect, use and share it is described in detail in our Consumer Health Data Privacy Policy, which is part of this policy.

2. Information we collect

Account information: email address and password (stored only as a bcrypt hash), sign-up and last sign-in time, and the policy versions and time of your consents.
Sign in with Apple or Google (optional): if you sign in this way, Apple or Google tells us your email address (with Apple, possibly a private relay address), whether it is verified, your first name, and a random account identifier that lets you sign in again. We never receive your Apple or Google password.
Waitlist: if you join the waitlist, your email address, when you joined and confirmed it, your consent to waitlist emails (time and wording version), your invite code, and who invited you (so referral rewards can be credited). The person who invited you sees only how many of their invitees joined, never who.
Content you enter: workouts, exercises, sets, weights and notes; food diary entries, products and nutrition targets; bodyweight; optional profile data (name, sex, birth year, height, activity level, preferred units).
WHOOP (optional): if you connect your WHOOP account in Settings, we read your recovery, heart-rate variability, resting heart rate, sleep, day strain, calories burned, steps and workouts from WHOOP and keep a copy with your account to show on Today, Food, Trends and your sessions. We store the access tokens WHOOP issues, never your WHOOP password. Disconnecting revokes our access and deletes the tokens; the copied data stays until you delete your account.
Device and technical information: when you use the service, our server processes your IP address, browser type and the pages requested. IP addresses are held briefly in memory to stop abuse (for example, limiting sign-in attempts) and are not stored in our databases. For each signed-in session we keep the browser’s user-agent string so you can recognize your devices. We count visits to the homepage as a plain number per day (and whether they came from an invite link), without storing who visited.
Camera: the barcode scanner uses your camera only while it is open, and reads barcodes on your device. A photo leaves your device only if you choose to read a product's label with AI (below).
AI estimates (optional): if you describe a meal, snap a photo of a meal, or read a product's nutrition label from a photo, the text or photo you submit is sent to our AI provider to produce an estimate. Photos are downsized and stripped of location data on your device first, and we do not store them. The estimate is shown to you to check and edit; only what you then save is kept, and saved meal estimates are marked as estimates in your diary.
Purchases (optional): if you subscribe to RawLift Pro in the iOS app, Apple handles the payment. Apple sends us a signed record of the subscription — product, purchase and expiry dates, renewal status, refunds, a transaction number and whether it was a test purchase — and we store it with your account to unlock Pro, including on the web. We also give each account a random identifier that the app attaches to its purchases, so a subscription finds the right account. We never receive your name, card or Apple Account details.
Profile photo (optional): if you add a profile photo in Settings, we store a square, downsized copy (location and other metadata removed) with your account until you remove it or delete your account. It is shown only to you, in the app.
Background photo (optional): if you choose your own photo as the app background, we store a downsized copy (location and other metadata removed) with your account until you remove it or delete your account. It is shown only to you.

We do not collect precise location, contacts or payment card data (Apple processes payments), and we keep no photos other than a profile or background photo you choose.

3. How we use information

to provide the service: store your logs, show trends, suggest targets and training weights;
to secure the service, prevent fraud and abuse, and fix problems;
to communicate with you about your account (for example, password reset emails);
with your consent, to email you about the launch, your early-access invite and product news. Every such email has an unsubscribe link;
to comply with law and enforce our Terms of Service.

We do not use your information for targeted advertising, we do not build marketing profiles, and we do not use your content to train AI models.

4. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose information only:

to service providers that process it on our behalf under contract — hosting (Hostinger, servers in Frankfurt, Germany) and account emails (Cloudflare). Emails you send to our @rawlift.app addresses are forwarded by Cloudflare's email routing to our inbox;
to Open Food Facts, when you search for or scan a product that is not in your own list: our server sends only the barcode or search term — never your account, IP address or health data;
to WHOOP, only if you connect it: our server sends WHOOP the access token you granted, to read your data. We send WHOOP nothing else about you;
to our AI provider, Anthropic, PBC, only when you use an AI estimate: our server sends the meal description or photo you submitted and nothing else (no account details, no other logs). Anthropic processes it under its commercial terms as our service provider, may keep it for a limited time for safety and abuse monitoring, and does not use it to train its models;
to Apple, when you subscribe in the iOS app: the purchase runs through your Apple Account and Apple's terms. We send Apple nothing about you; our server only receives Apple's signed purchase records (above);
to Apple or Google, when you sign in with them: the sign-in runs on their pages under their terms, and they learn that you signed in to RawLift. We send them nothing else;
if required by law, subpoena or court order, or to protect rights, property or safety;
in a merger, acquisition or sale of assets, subject to this policy, with notice to you.

5. Cookies and similar technologies

We use only strictly necessary cookies: a session cookie that keeps you signed in (up to 90 days), a cookie that remembers your color theme, a cookie with your time zone (so “today” is your day), and, when you open someone’s invite link, a cookie that remembers their invite code for 30 days so the referral can be credited. A service worker caches the app’s code in your browser so it loads faster. There are no advertising, analytics or third-party cookies. Because we do not track you across sites, “Do Not Track” and Global Privacy Control signals do not change anything — we already treat every visitor as opted out.

6. Retention

We keep your information while your account exists. When you delete your account, your account and your entire database are deleted immediately; copies in our backups, which stay on our server, are deleted within 30 days. Password reset links expire after one hour; sign-in sessions expire after 90 days without use. Subscription records are deleted with your account, except where tax or accounting law requires us to keep a record of a purchase. Waitlist entries are kept until launch and then for as long as an unredeemed reward is open, at most 3 months; you can ask us to delete yours at any time.

7. Security

All traffic is encrypted with TLS. Passwords are hashed with bcrypt. Each account’s data is kept in its own separate database. No method of transmission or storage is perfectly secure, but if a breach affecting your health data occurs we will notify you and the authorities as required by law, including the FTC Health Breach Notification Rule.

8. Your choices and rights

Everyone, wherever they live, can:

access and export their data (Settings → Export my data, as JSON);
correct it (most data can be edited directly in the app);
delete their account and all data (Settings → Delete account);
withdraw consent to processing of health data by deleting the account.

California residents (CCPA/CPRA) have the right to know what personal information we collect, use and disclose; to delete and correct it; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only to provide the service you request); and not to be discriminated against for exercising these rights. In the last 12 months we collected the categories listed in section 2, from you and your device, for the purposes in section 3, and disclosed them only to the recipients in section 4. We have not sold or shared personal information, including of consumers under 16.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have similar rights, including the right to appeal a decision on a request. Residents of Washington, Nevada and Connecticut have additional rights for consumer health data, described in our Consumer Health Data Privacy Policy.

To make a request, use the in-app tools or email privacy@rawlift.app from the address on your account. We respond within 45 days. You may use an authorized agent; we may ask for proof of authorization. To appeal a decision, reply to our response with “Appeal” in the subject line; if we deny your appeal you may contact your state attorney general.

9. Children

RawLift is not directed to children under 13, and we do not knowingly collect personal information from them. Users under 18 need permission from a parent or guardian. If you believe a child under 13 has created an account, contact us and we will delete it.

10. Users in the European Union, the EEA, the UK and Switzerland

If you live in the EU, the EEA, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR, or the UK GDPR and the Swiss Data Protection Act) applies, and this section adds to the rest of this policy.

Controller. ELVISION LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, represented by Jan Elvers, Managing Member. Contact for all data protection matters: privacy@rawlift.app. See also our imprint.

Why we may process your data (legal bases):

To provide the service you signed up for (Art. 6(1)(b) GDPR): your account, your logs, your subscription, account emails such as password resets, and connections you choose (Sign in with Apple or Google, WHOOP).
Health data — bodyweight, nutrition, training and WHOOP data — only with your explicit consent (Art. 9(2)(a) GDPR), which you give when you create your account. You can withdraw it at any time by deleting your account; this does not affect processing before the withdrawal. Without this consent we cannot provide the service, because logging this data is what it does.
Waitlist and product emails only with your consent (Art. 6(1)(a) GDPR); every email has an unsubscribe link.
Security and abuse prevention (briefly held IP addresses, sign-in limits, device names for your sessions) on the basis of our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
Legal obligations (Art. 6(1)(c) GDPR), for example keeping purchase records for tax law.

Recipients. The service providers in section 4 process data on our instructions under data processing agreements. We make no automated decisions with legal or similarly significant effects; calorie targets and training suggestions are estimates you can change at any time.

Where your data is. Your account and everything you log is stored on our servers in Frankfurt, Germany. We are a US company, and some service providers (for example Cloudflare, Apple, Google, WHOOP and our AI provider) may process data in the United States and other countries. Where these countries do not have an adequacy decision, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.

Your rights. You have the right to:

access your data and receive a copy (Art. 15; Settings → Export my data gives you everything);
correct it (Art. 16) and have it deleted (Art. 17; Settings → Delete account);
restrict processing (Art. 18) and receive your data in a portable format (Art. 20, the JSON export);
object to processing based on our legitimate interests (Art. 21);
withdraw any consent at any time, with effect for the future (Art. 7(3));
lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work (Art. 77).

To exercise a right, use the in-app tools or email privacy@rawlift.app. We answer within one month. Retention follows section 6. You must be at least 16 to give consent yourself (or the lower age your country sets, but never under 13); otherwise a parent or guardian must consent for you.

Users elsewhere: RawLift is intended for the United States, the EU/EEA, the United Kingdom and Switzerland. If you use it from another country, your information is processed where our servers and service providers are located.

11. Changes

If we make material changes, we will update the date above and notify you in the app or by email before they take effect. We will not use previously collected health data in a materially new way without your consent.