Privacy Policy — Pagoda
Last updated: 8 September 2026
Pagoda is a training log. This policy describes what it stores, what leaves your phone, and what happens when you ask for it back.
It is written to be read rather than to be defensible, so it says what actually happens. Where something is a limitation rather than a feature, it says that too.
The short version
- An account is required to use the app. You sign in when you first open it, and your training is stored both on the device and on our server so it is on every device you use.
- There is no tracking of any kind. No analytics, no advertising, no crash-reporting service, nothing profiling you or following you between apps.
- If you subscribe, our payments provider is involved and nothing else is. Membership is handled by Apple and by RevenueCat, who check with Apple that a subscription is real. They are told which account is subscribing and what was bought. They are not told anything you log — not a workout, not a meal, not a single number. Apart from those two, the app makes no network requests except to its own sync server, and only when you are signed in.
- We still collect as little as possible. An email address, the training you choose to record, and whether you are a member. Nothing else.
- You can delete your account and everything in it from inside the app.
What is stored on your device
Everything you record, in a database on the phone: workouts, sets, weights and reps, routines, personal bests, recipes, meal plans, grocery lists, pantry items, stretch and meditation sessions, and your settings.
The app reads and writes this local copy first, which is why it keeps working with no signal once you are signed in.
What is sent to the server
The app requires an account, so the records listed above are copied to a Supabase database so other devices signed into the same account can read them. Each row is stored against your account identifier and protected by row-level security, which means the server refuses to return your rows to anyone else's session.
Your training data is not read by us for any purpose — not to build aggregate statistics, not to improve recommendations, not to train anything.
Account information
If you create an account, we store:
- Your email address, and a password hash if you signed up with a password. We never see the password itself.
- If you sign in with Apple: the identifier Apple gives us, and your email address and name if you choose to share them. If you use Apple's *Hide My Email*, we only ever receive the relay address, and that is fine — the app works identically.
Authentication is handled by Supabase Auth on our behalf.
The Tribe waitlist
If you tap Join the Pagoda Tribe and give an email address, that address is stored so we can tell you when membership opens. It is stored with the tab you tapped it from, and the time.
- It is used for that one purpose and is not sold, shared, or added to any other list.
- The list cannot be read by the app on your phone — the database refuses read access to it entirely, which is deliberate, because it is a list of other people's email addresses.
- Deleting your account deletes your waitlist entry too. You can also ask us to remove it on its own, at the address below, without deleting anything else.
Notifications
Rest timers and training reminders are local notifications, scheduled by your phone and delivered by your phone. The app never requests a push token and no server can send you a notification. Nothing about your training is transmitted in order to deliver one.
What we do not do
- No analytics or usage tracking of any kind.
- No advertising, and no advertising identifiers.
- No crash or performance reporting service.
- No selling or sharing of personal information.
- No profiling, and no automated decision-making.
- No third-party services beyond hosting, authentication, and — only if you subscribe — the payments provider named below.
If you subscribe
Membership is an auto-renewable subscription sold through Apple. Two parties other than us are involved, and only these two:
- Apple takes the payment. We never see your card, and no payment details reach the app or our server at any point.
- RevenueCat confirms with Apple that a subscription is genuine and tells our server the result. They receive the account identifier the subscription belongs to and details of what was purchased and when.
What neither of them receives is anything you have logged. No workout, no routine, no meal, no weight, no note. The subscription system knows that an account pays; it does not know what that account trains.
On our own server the result is a single row recording that your account is a member and when that expires. That row is what opens the Food and Unwind tabs, and it is deleted with the rest of your data if you delete your account.
Deleting your data
Profile → delete account. This removes your rows from every synced table and then deletes the account itself. It is immediate and cannot be undone.
Deleting your account does not cancel an App Store subscription. Apple controls that, and it is cancelled in your Apple Account settings — deleting the account here would otherwise leave you paying for something you can no longer reach, so the two are kept separate deliberately. Cancel first, then delete, if you are doing both.
Children
Pagoda is not directed at children and does not knowingly collect information from anyone under 13.
Changes
If this policy changes in a way that affects what is collected, the date at the top changes and the change is described here rather than replaced silently.
Contact
Questions, deletion requests, or anything else: