Privacy Policy

This English text is a reference translation. The Japanese version is authoritative, and where the two differ, the Japanese version prevails.

Lightforce.tech ("we", "us" or "our") handles the personal information of users ("you") of the training log app Totem Lift (the "App") as set out in this Privacy Policy. We comply with the Act on the Protection of Personal Information of Japan, other applicable laws, and the guidelines issued by the Personal Information Protection Commission. For the personal data of users in the European Economic Area (EEA) or the United Kingdom, we also comply with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and other applicable laws.

1. Information We Collect

We collect the following information in providing the App, and do not collect it by deception or other improper means.

• Account information: the identifier issued through Sign in with Apple, your display name, and your email address where Apple provides it
• Training records: exercises, weights, repetitions, dates, and the names of places
• Settings: units of weight and height, time zone, display theme, and other settings
• Optional profile information: height, age, sex, and body weight entered manually when Apple Health is not linked
• Profile photo: an image you choose to set
• Body weight from Apple Health: read from Apple Health only if you allow it
• Purchase information: the information needed to confirm subscription purchases and their validity periods
• Technical information: the identifier of the device used for syncing, the identifier of the device used to deliver push notifications (a "push token") and the App's display language on that device, and the minimum information needed to operate the App and investigate faults
• Performance information: how long the App takes to launch and display screens, rendering smoothness, memory usage, records of errors and crashes, the device model, the OS and App versions, and an identifier assigned to each installation (this does not include your account information or training records)
• Information recorded by trainers: the names, nicknames, places, notes and session records that users of the trainer features register about their clients

The App may use your device's location to suggest places. Location is used only temporarily for that purpose and is not stored.

Providing optional profile information, a profile photo and body weight from Apple Health is optional. If you do not provide them, some features may not be available.

The App does not deliver advertising, and does not use technology that tracks your behaviour for advertising purposes.

2. How We Use Information

We use the information we collect for the following purposes.

• To provide the App, authenticate you, and sync your data between devices
• To aggregate training records, display graphs, and forecast progress
• To provide sharing with people you choose and the trainer accompaniment features
• To tell you, in the App and by push notification, about events in your sharing, such as a friend or trainer connecting with you or a trainer logging sets for you
• To provide analysis by the AI features you choose to use
• To confirm subscription purchases and manage their validity periods
• To respond to inquiries
• To prevent misuse of the App, investigate faults, improve the App's speed and stability, and keep the App secure

Legal Bases for Processing

Where the GDPR or the UK GDPR applies, we process personal data on the following legal bases.

• Providing the App, authenticating you, and syncing your data between devices: performance of a contract
• Aggregating training records, displaying graphs, and forecasting progress: performance of a contract
• Sharing with people you choose, and the trainer accompaniment features: performance of a contract
• Notifications in the App: performance of a contract
• Push notifications: consent (given by allowing notifications in your device settings)
• Analysis by the AI features (sending records to third parties): consent
• Reading body weight from Apple Health, storing manually entered body weight on our servers, and sharing body weight with trainers: explicit consent (Section 3)
• Confirming subscription purchases and managing their validity periods: performance of a contract
• Responding to inquiries: legitimate interests (answering your inquiries properly), or performance of a contract for inquiries about the contract
• Preventing misuse of the App, investigating faults, improving the App's speed and stability (including measuring performance with EAS Observe), and keeping the App secure: legitimate interests (providing the App safely and reliably)
• Aggregating browsing on the Website and protecting it against unauthorised access (Section 13): legitimate interests (improving the Website and delivering it securely)
• Showing Instagram posts on the Website (Section 13): consent (given by pressing the button that shows them)
• Keeping information as required by law, and responding to lawful requests from public authorities: legal obligation

Where processing is based on consent, you can withdraw your consent at any time. Where processing is based on legitimate interests, you can object to it (Section 12).

3. Where Information Is Stored

Training records, account information, settings and optional profile information are stored on your device and, for syncing, on servers of Cloudflare, Inc. that we use. Syncing to the cloud takes place whether or not you subscribe.

Profile photos are stored on servers of Cloudflare, Inc.

As a rule, body weight from Apple Health is only read on your device and is not sent to our servers. Only if you allow a trainer to see your body weight, we send to and store on our servers the body weight needed for that sharing (at most one value per day). If you share your body weight with no trainer, or withdraw that permission, we delete the body weight stored on our servers. The App does not write any information to Apple Health.

Because body weight is health information, we read body weight from Apple Health, store manually entered body weight on our servers, and share body weight with trainers only on the basis of your explicit consent. Body weight is read from Apple Health only if you choose to link Apple Health in the App and allow reading on your device's permission screen. Manually entered body weight is stored on our servers only if you turn on the setting that saves body weight to the cloud; otherwise it is stored only on your device. Body weight is shared with a trainer only if you allow it for that trainer and choose how much to share, and this is off by default. You can withdraw these consents at any time in the App's settings or your device settings, and when you do, we delete that body weight from our servers.

API keys you register for the AI features, and your consent setting for sending records, are stored only in the secure storage on your device (the Keychain) and are not sent to our servers.

Cancelling a subscription does not delete the information stored on our servers. Without a subscription, the App does not show records older than the most recent year, but those records are kept, not deleted. Even then, you can export your records for the whole period in CSV format. If you want your information deleted, please close your account as described in Section 10.

4. Visibility of Profile Photos

Your profile photo is served, after the App confirms who is signed in, only to you and to the people you share with in the App (people connected with you as a friend, a trainer or a trainee). People you do not share with cannot retrieve your photo, even if they know your user identifier. Once a sharing relationship ends, the other person can no longer retrieve your photo from that point on.

Because the other person's device may keep a temporary copy, it may take some time before a changed or deleted photo, or the end of a sharing relationship, is reflected on their screen.

Setting a profile photo is optional.

5. Sharing with Other Users

The information in this section is not provided by us to third parties. It is shared by you with people you choose. Sharing starts only by your action and can be stopped at any time.

Sharing with Friends

While sharing is on, friends who have accepted your invitation can see the following.

• Your display name and profile photo
• Your heaviest weight over the last 3 months (90 days) for each muscle group and exercise
• The date of your last training session

Individual sets, places and notes are not shown to friends. Once you turn sharing off or end the friendship, this information is no longer shown.

Sharing with Trainers

When you connect with a trainer, the following features are available only to the extent you allow.

• History sharing: the trainer can view your training history.
• Proxy logging: the trainer can enter training records for you, for dates within one day before or after the day of the session.
• Body weight sharing: the trainer can view your Apple Health body weight to the extent you choose (your latest body weight only, or its trend over the last year). This permission is given separately from history sharing and is off by default.
• Other trainers' records: the trainer can view records that other trainers entered for you and sessions they coached, together with those trainers' display names. This permission is given per trainer and is off by default. Without it, those records are shown as your own and other trainers' display names are not shown.

Place information is not shown to trainers, and trainers cannot run AI analysis on your behalf. You can withdraw either permission at any time.

Information Recorded by Trainers

Information that users of the trainer features register about their clients can be viewed only by that trainer, and is not shown to the client, to friends, or to other trainers.

6. AI Features

Consent to Send Records

AI analysis is performed only while you have consented to "sending records to third parties". This consent is required both when using the AI we provide and when using your own API key. You can withdraw it at any time in Settings, and no records are sent from that point on.

AI We Provide

When you use the AI we provide, the exercise name and muscle group, your set-by-set records for the exercise being analysed over roughly the last three months (date, weight and repetitions), and a summary of those records and indicators calculated from them are sent to an AI service provided by Cloudflare, Inc. This information does not include your body weight, age or sex. Results may be stored for a short time so that identical requests can be answered.

AI Using Your Own API Key

If you register an API key for OpenAI, Google or Anthropic and give the consent above, the App sends the following directly from your device to that provider.

• Exercise names and muscle groups
• Your set-by-set records for the exercise being analysed over roughly the last three months (date, weight and repetitions)
• A summary of weights, repetitions and dates, and indicators calculated from them

The following are not sent.

• Your display name
• Your body weight, age and sex
• Place names or any other place information
• User and device identifiers, your profile photo, and any credentials other than the API key

Any charges from the provider are borne by you under your own agreement with that provider.

7. External Services

We use the following external services to provide the App, and entrust them with handling information to the extent needed for the purposes in Section 2. We choose providers that handle personal information properly, and supervise them as necessary and appropriate. Each provider handles information in accordance with its own privacy policy.

• Apple Inc.: sign-in through Sign in with Apple, the sale of subscriptions on the App Store, and the delivery of push notifications
• Cloudflare, Inc.: servers, database and photo storage, the AI we provide, and delivering the Website, its analytics and protection against unauthorised access (Section 13)
• 650 Industries, Inc. (Expo): delivering push notifications. We provide your push token and the text of each notification (including the display name of the other user it is about). Push notifications are sent only if you allow them in your device settings. We also provide the performance information described in Section 1 to measure how the App performs (EAS Observe); that information is handled without being linked to your account.
• RevenueCat, Inc.: confirming subscription purchases and managing their validity periods. Besides the purchase information needed to confirm a purchase and the App's internal user identifier, we provide the email address on your account, where there is one (for an Apple private email, its forwarding address), so that purchasers can be identified and inquiries answered.
• OpenAI, L.L.C., Google LLC and Anthropic PBC: AI using your own API key (only with the consent described in Section 6. Information is sent directly from your device under your own agreement with that provider, and is not entrusted to it by us.)

Provision to Third Parties in Foreign Countries

All of the providers above are located in the United States, and your personal data is handled in the United States or other countries.

The United States has no comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information; personal information is protected by sector-specific federal laws and by state laws. Details of the US system are available on the website of Japan's Personal Information Protection Commission. Each provider takes measures to protect personal information under its own privacy policy.

By signing in to the App, you consent to the provision of personal data to third parties in foreign countries as set out in this Section.

When we transfer the personal data of users in the EEA, the United Kingdom or Switzerland to the United States, we rely on the following safeguards for each provider. We have not signed separate data processing agreements with these providers; each provider's data processing terms are incorporated into its terms of service or other standard terms and form part of the agreement between us and that provider.

• Apple Inc.: the Standard Contractual Clauses set out in its privacy policy
• Cloudflare, Inc.: its participation in the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. Data Privacy Framework), and the Standard Contractual Clauses (including the UK Addendum) set out in the data processing terms incorporated into its terms of service
• 650 Industries, Inc. (Expo): its participation in the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. Data Privacy Framework), and the Standard Contractual Clauses incorporated in its terms of service
• RevenueCat, Inc.: the Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss addendum set out in the data processing terms incorporated into its terms of service

For the AI features that use your own API key, information is sent to OpenAI, L.L.C., Google LLC and Anthropic PBC directly from your device under your own agreement with that provider, and the safeguards for that transfer are those set by each provider.

You can ask for a copy of these safeguards, or for information on where to obtain them, by contacting us as set out in Section 15.

8. Provision to Third Parties

Apart from the cases in Sections 6 and 7, we do not provide personal information to third parties except with your consent or where required by law.

9. Security Measures

We take the following measures to prevent leakage, loss or damage of personal information.

• We limit the people who can access personal information stored on our servers to our representative and others to the minimum necessary.
• Communication between the App and our servers is encrypted.
• Information on our servers can be viewed only by you, once authenticated, and by the people you have allowed to see it (except for the profile photo described in Section 4).
• We take measures to prevent theft, loss of and unauthorised access to equipment used to handle personal information.
• The handling of personal information in foreign countries is as set out in Section 7.

10. Retention and Deletion

We keep information to the extent needed for the purposes of use, and delete it without undue delay once those purposes are achieved, unless the law requires us to keep it.

If you close your account, we delete your information stored on our servers. However, information about who made an entry that remains in other users' records is kept in a form that no longer identifies you.

When you close your account or sign out, the API keys and the consent setting for sending records stored on your device are deleted, and the push token for that device stored on our servers is deleted. Notifications in the App are deleted 90 days after they are created. When you close your account, we also ask Apple to revoke your Sign in with Apple credentials.

We keep each type of information on the following basis.

• Account information, training records, settings, optional profile information and profile photos: kept until you close your account, and deleted from our servers immediately once closing your account is complete. If deleting a profile photo fails, we retry automatically until it is deleted.
• Automatic backups of the database on our servers: information deleted when you close your account remains in backups for up to 30 days. We do not use this information for any purpose other than recovering from failures.
• Body weight shared with a trainer: only the range you choose (the latest value, or the most recent year) is kept, and it is deleted when you withdraw the permission or end the connection with the trainer.
• Results of analysis by the AI we provide: not used once 30 days have passed since they were generated, and deleted the next time you use the AI features or when you close your account.
• Records of notifications about subscription purchases that we receive from RevenueCat, Inc.: deleted 90 days after they are received.
• Records of the operation of our servers (logs): kept for up to 7 days.
• IP addresses used to prevent unauthorised access: used only to count requests over a short time (one minute), and not stored.
• Information kept by providers of external services (such as purchase information kept by RevenueCat, Inc. and performance information kept by 650 Industries, Inc.): kept for the periods each provider sets.
• Information about the Website (Section 13): aggregated browsing information is kept for 6 months and information on the use of buttons and links and on the app the visit came from for 3 months, and the cookie that remembers the display language is valid for 1 year.

11. Minors

People under 13 may not use the App. If we learn that we hold personal information of a person under that age, we delete it.

Minors must obtain the consent of a parent or other legal guardian before using the App and agreeing to the handling of personal information under this Policy.

Where the law of the country you live in sets an age below which a legal guardian's consent is needed for the handling of personal information (in member states of the European Union, an age each state sets between 13 and 16; in the United Kingdom, 13), we handle the personal information of users under that age only with the consent of a legal guardian.

12. Requests Concerning Your Information

You may ask us to notify you of the purposes of use of your retained personal data, or to disclose it; to correct, add to or delete it; to stop using or erase it; to stop providing it to third parties; or to disclose records of its provision to third parties (together, "requests").

Please send requests by email to the contact in Section 15. After confirming that the request comes from you, we will explain the procedure and respond without undue delay and in accordance with the law.

You can also correct and delete your training records, stop sharing, and close your account from within the App.

In addition, under applicable law (including the GDPR and the UK GDPR), you have the following rights.

• Right to data portability: the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You can receive your training records for the whole period at any time by exporting them in CSV format from the App. For other information, please make a request to the contact in Section 15.
• Right to object: the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests
• Right to withdraw consent: the right to withdraw your consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn. You can withdraw consent to sending records to the AI features, to reading body weight from Apple Health and sharing it with trainers, and to push notifications in the App's settings or your device settings.
• Right to lodge a complaint with a supervisory authority: the right to lodge a complaint with the data protection supervisory authority of the country where you live or work, or where you believe an infringement took place (in the United Kingdom, the Information Commissioner's Office). In Japan, you can consult the Personal Information Protection Commission.

We respond to requests under the GDPR or the UK GDPR as required by law, as a rule within one month of receiving the request.

13. The Website

On the website that introduces the App (lp.totem-lift.com, the "Website"), we collect the following information to improve the Website. We use it only in aggregate, in a form that does not identify the people who visit the Website ("visitors").

• Browsing: aggregated information from the web analytics provided by Cloudflare, Inc. on the pages viewed, referring sites, country or region, types of device, browser and operating system, and the time pages took to load. This analytics does not use cookies and does not track individual visitors.
• Use of buttons and links: the number of times the button to join the beta test, the links to our Instagram account and posts, and the link to the section for personal trainers were pressed, recorded with the date and time for each kind and position of button or link, the page's display language, the status of beta test recruitment and the app the visit came from (below).
• App the visit came from: the number of times the Website was opened inside the Instagram or LINE app, recorded with the date and time for each of those apps, the page's display language and the status of beta test recruitment. The app is determined on the visitor's device from the information the browser sends about its type (the user agent); the user agent itself is neither sent nor recorded.

These records of the use of buttons and links and of the app the visit came from do not include IP addresses, cookies or any other information that identifies visitors.

The Website is delivered through the services of Cloudflare, Inc. To deliver the Website and prevent unauthorised access, Cloudflare processes visitors' IP addresses and other information about their connections, and sets a cookie that distinguishes automated access. We do not record this information.

To show prices as they are on the App Store in the visitor's country or region, the Website uses the country or region that Cloudflare, Inc. determines from the visitor's IP address. When the App opens the Website's pricing table, the App passes the country or region of the user's App Store to the Website. We use these countries or regions only to show prices, and we do not record them.

The Website uses a cookie to remember the display language a visitor has chosen. This cookie is used only to show that language.

The Website may show posts from our Instagram account using the embedding feature provided by Meta Platforms, Inc. The posts are loaded only if the visitor presses the "Show Instagram posts" button, and the browser does not connect to Meta's servers before that. When the button is pressed, the visitor's browser connects to Meta's servers, and the visitor's IP address, browser information, the URL of the page being viewed and other information about the connection are sent to Meta. Meta may read or set its own cookies, for example when the visitor is logged in to Instagram. This information is handled under Meta's privacy policy, and we do not collect it.

The Website does not deliver advertising, and does not use technology that tracks visitors' behaviour for advertising purposes.

14. Changes to This Policy

We may change this Policy in response to changes in law or as otherwise needed. The changed Policy takes effect when it is posted on this page. If we change the scope of information sent by the AI features, we will ask for your consent again.

15. Complaints and Inquiries

For inquiries, complaints or consultations about this Policy or the handling of personal information, please contact us at the following. We will endeavour to respond appropriately and promptly.

• Operator: Lightforce.tech
• Contact: [email protected]

We are the controller under the GDPR and the UK GDPR (the party that decides the purposes and means of processing the personal data handled in the App). Our contact details as controller are as follows.

• Name: Lightforce.tech
• Email: [email protected]