Privacy Policy

Invite a friend and the monthly draw

If you use Invite a friend, our server keeps a ledger with a pseudonymous identifier for your phone (the App Attest key id, which does not identify you). While you are signed in, the ledger uses your account's identifier instead, which is linked to your account (your Apple user ID, email and name); after Delete Account the row keeps only that pseudonymous key. The ledger also holds your invite code, the code you entered if any, how many days the app was opened while an invite was pending (for a friend who joined through a challenge, the days their challenge progress went up and, after the first such day, also the days they opened the app), the time zone used to count those days, and the draw tickets you hold. The organizer reviews entries and keeps a record of ticket selections, announcements and shipping actions. We do not collect your date of birth. This is what makes the tickets and the avatars work. It is stored with Supabase in the EU (Stockholm). If you win the monthly draw and claim the prize, we ask for your name, postal address, country and email, keep them until the prize is marked as shipped, and delete them within the following 24 hours. Apart from those days of challenge progress, nothing from Apple Health enters this ledger. The rules of the program are at incredible-app.com/referral-rules.

If you allow notifications, our server stores your phone’s Apple push token to let you know when a friend uses your code, joins your challenge or cheers you. Apple receives the token and notification text, without invite codes, names or health data. You can turn notifications off in iPhone Settings. Delivery records are deleted after seven days, and unused push tokens after 90 days.

Who Is Responsible

Incredible is operated by Incredible AS, the controller for the personal data described here. Contact options are available at incredible-app.com/contact.

Data We Use

Incredible uses data you choose to provide or allow:

• Apple Health data, such as workouts, activity, heart rate, HRV, resting heart rate, sleep, respiratory rate, blood oxygen, temperature, body measurements, mobility, daylight, and related fitness metrics.
• Age and biological sex from Apple Health, when available, to calculate heart-rate zones.
• App data you create, such as workouts, routines, plans, exercise progress, optional check-ins, settings, imports, and preferences.
• Apple Watch workout and dashboard data when you use the Watch app.
• Messages, attachments, and the training summary that travel with each chat if you turn on the optional AI coach, as described in the AI Coach section.
• The coach reply, your last message to the coach, and any notes you write, when you rate a coach reply as unhelpful and send the feedback form.
• Location only for features that need sunrise and sunset times.
• Limited product analytics, such as app launches, onboarding completion, Health access requested, selected tabs, and general interaction events.
• Limited crash diagnostics, such as app version and build, device model and architecture, operating system version and build, crash type, and technical stack information.
• On our website, anything you type into the public request board, such as a bug report or a feature request and an email address if you choose to leave one, plus a random identifier stored in a cookie so your votes are counted once each.

Why We Use It

• App features: to provide daily training context, Fitness, Training Load, sleep, vitals, and workout insights.
• Sync: to keep supported app data available on your devices through private iCloud.
• AI coach: to answer your questions with replies grounded in your training data, if you turn the coach on.
• Payments: to process optional tips through Apple.
• Support: to answer requests you send us.
• Analytics: to understand basic product usage, improve reliability, and test the coach against feedback you send.
• Crash diagnostics: to find and fix crashes and watchdog terminations.

Legal Bases

For GDPR, we rely on:

• Contract: to provide app features you request.
• Consent and explicit consent: for Apple Health data, location, notifications, the AI coach, and optional permissions.
• Legitimate interests: for limited analytics, crash diagnostics, app security, and product improvement.
• Legal obligation: where we must keep records or respond to lawful requests.

You can withdraw consent in iOS Settings, Apple Health, or the app where available. Withdrawal does not affect processing that already happened while consent was active.

Apple Health

Apple Health data is read through HealthKit and processed on your devices to calculate Fitness, Training Load, sleep, vitals, and workout insights and to provide daily training context.

We do not send Apple Health data to analytics providers. If you turn on the optional AI coach and send it a message, a summary of your training and health data travels with that chat. If you explicitly join a Challenge, your agreed goal progress is also sent to our server, as described below. If you join Incredible Month, only one yes or no per day is sent, as described below. None of these features shares this data until you choose to use it.

If you record or log certain activity in Incredible, the app may write workouts, activity totals, and sleep entries back to Apple Health. You can change Health permissions or delete Health data in Apple Health or iOS Settings.

Challenges

Challenges are optional. You agree to share your chosen name and your challenge progress with the other participants by tapping Invite when you create a challenge, or Join when you accept one, after the app has told you what is shared. Vercel processes and Supabase in the EU stores a pseudonymous device identifier, your chosen display name, challenge membership and invitation code, shared goal and dates, capped daily or weekly progress and its total, consent and sync times, and cheers. Progress may count workout days, workouts, training time, distance, or daily steps, and in the weekly Incredible Challenge also active energy. Weight goals share only the percentage toward your own target. In a strength challenge, the heaviest weight you lift on the chosen exercise during the challenge is shared with the people in that challenge, as your progress. Raw workouts, routes, heart rate, individual workout dates, body weight readings and body weight targets are not uploaded for Challenges.

Participants in the same challenge see your name, progress, sync time and cheers. Anyone with the invitation link can see the creator’s name, goal, dates and participant count, but cannot see other participants or progress before joining. Workouts can finish syncing for 48 hours after the challenge ends. Challenges ended more than 365 days ago and profiles inactive for 365 days are removed on the next request to the service. You can delete your challenge data in Challenge options. Leaving removes your progress and cheers and stops sharing. Removing a past result from your history keeps other participants’ results. Creators can delete a challenge before starting it. Membership is linked to your installation, or to your account while you are signed in. Without an account, reinstalling may create a new identity.

If you allow notifications, Incredible can send you a notification through Apple’s push service when a friend joins your challenge or cheers you. That notification carries no names, codes or health data. Joining a friend’s challenge counts as using their invite code for Invite a friend and the monthly draw, which links your installation to theirs in the same way as entering the code, so you cannot enter a code afterwards.

If you join the weekly Incredible Challenge, your progress toward it is stored with the same pseudonymous challenge identity as your other challenges, without your name. In a week about active calories, that progress is your total active energy for the week. Other people see how many joined, how many reached the goal, and how many people stand at each point of the progress bar, with the lowest, middle and highest progress there. People who joined also see their own place, and the place and progress of the leader and of the members just ahead of and behind them. Nobody sees your name or anything else that identifies you.

Incredible Month

Incredible Month is a challenge that runs every calendar month. Joining is optional and needs no account. Once you tap Join, the app sends our server one yes or no for each day: whether you did that day's challenge. Your workouts, steps and readiness are checked on your phone and never sent. Joining a month also enters you in every month after it, until you leave.

For each month you join, our server keeps when you joined, each day's flag (done, missed, or not decided yet), how many days you have done and missed, when you finished or left, and the capes you earned. It also keeps your phone's time zone, so it knows when your day ends. All of it is stored under a pseudonymous identifier for your installation, or under your account while you are signed in. Vercel processes it, and Supabase stores it in Stockholm. We use it only to run the challenge you joined. The legal basis is contract: taking part is the feature you asked for.

Anyone who opens the same month in the app sees only counts: how many take part, and how many have missed no day, one day, or two or more. After the month ends, they also see how many finished. These counts never show a name, an initial or anything else that identifies you.

The first time you open version 1.5 or later, our server gives your installation, or your account while you are signed in, a public invite code of 8 letters and numbers, whether or not you join. You can add a first name of 1 to 30 characters. Your invite link carries your code, never your name. When someone opens your link in Incredible, the two of you follow each other, so anyone who has your link can become your friend. Your friends see your first name and, for each month you are in, your yes or no for each day. You see the same of theirs. Nobody else sees your name. Stop Following ends the friendship for both of you.

We create this code under our legitimate interest in making a friend's invite link work the moment it is opened; until you add a first name it holds no name, health data or contact detail, and you can ask us to erase it.

To invite people from your contacts, the app asks for access to them. It reads names, phone numbers, email addresses and photos on your phone so you can pick people, and none of it reaches our server. Messages then opens with the invitation for the people you picked, and you send it from your own phone.

You can leave at any time with Leave Incredible Month, in the menu on its page. Leaving stops your entry for that month and every later one. Your past days, capes, code, first name and friends stay until you delete them. Delete Account removes all of it. Without an account, you can ask us to delete it, as described under Your Rights.

Account

Signing in is optional, and the app works fully without it. You can sign in with Apple.

If you sign in with Apple, we store Apple's user ID for you, your email address or the private relay address Apple gives us and whether it is a relay address, the name you give us, when the account was created and last changed, and which app installations you signed in on, with when each one was linked. Apple sends us your name only the first time you sign in. Incredible never sees your Apple password. We keep the email only to recognise your account when you write to us about it, for example to ask for a copy of your data or to delete it. We do not send email to it.

Nothing is copied when you sign in. The challenges, challenge name, invite code, draw tickets and founder messages of the first iPhone you sign in on become your account's, and follow you to a reinstall or another iPhone. On a later iPhone you see your account's data while you are signed in, and that iPhone's own earlier data comes back when you sign out.

Delete Account, in Settings, deletes your account, your name and email, your challenges and Incredible Month data linked to it, and your messages to the founder, including what the first iPhone you signed in on did while signed out, and asks Apple to revoke the sign in. Your workouts and health data are not affected, because they stay on your iPhone. Your ticket rows in the Invite a friend ledger stay, under your pseudonymous identifier only, because other people's tickets and draws already reference them.

If Apple tells us you withdrew consent or deleted your Apple Account, we delete your Incredible account the same way Delete Account does. If you turn relay email off or on, we update the stored email.

One iPhone installation belongs to one account for as long as that account exists. That keeps our fraud limits, such as the ticket cap, working the same way they do today.

Google Health

If you connect Google Health in Settings, Incredible reads your sleep, heart rate, resting heart rate, HRV, blood oxygen, breathing rate, skin temperature, steps, distance, energy, workouts, weight, body fat and VO2 max from the Google Health API and writes them into Apple Health on your device, under Incredible. That is how Fitbit and Pixel Watch data reaches the app. The connection is off until you turn it on.

You sign in on Google's own screen, and the access token stays in your device's keychain. The data goes from Google to your phone. None of it passes through our servers, and we never send it to analytics providers. Disconnecting revokes Incredible's access with Google, deletes the token, and removes everything the connection added to Apple Health.

Incredible's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI Coach

The AI coach is optional and off until you turn it on in the app. Nothing described here happens before that, and nothing is sent until you send a message.

When you chat, the app sends your message, any files or photos you attach, the recent conversation, and a summary of your training and health data, such as recent workouts, training load, sleep, readiness, your plan and goals, and body details like age, biological sex, and weight. While you are part-way through a strength workout, that summary also describes the session in front of you: the exercises, the sets you have logged, and the ones still to come. If answering needs more than the summary, the coach asks your phone for it, and that answer is sent too: individual workouts, exercise history, vitals, how a readiness score was reached, your plan, and your app settings. This goes to our server, which runs on Vercel in the European Union and passes it, through Vercel's AI gateway, to the provider serving the reply. Every such request runs under zero data retention: the gateway may only use providers under zero data retention agreements, currently Microsoft Azure serving OpenAI's model, and the request fails rather than falling back to any other route. Messages are also screened by OpenAI's moderation service for safety, which retains nothing under OpenAI's published retention table. The coach cannot browse the web.

The coach can also change things in the app, and it asks first every time. It can add a session to your schedule or move one, start, pause or end a training plan, create or change a goal or your race, adjust app settings, and change the workout you are in the middle of. Each of those arrives as a card that states exactly what will happen, and nothing changes until you tap to confirm. There are two deliberate exceptions, in opposite directions. Adding or skipping time on a running rest timer takes effect at once, because a countdown cannot wait to be confirmed. And the coach can never mark a set or a workout as done: what you have actually trained is yours to record. Changes are made on your phone and sync the way the rest of your data does.

The coach keeps a memory of useful facts it learns about your training so it can help you over time. That memory is stored on your device, not on our server and not with any other company. It travels with your messages to our server and the AI provider so the coach can read it, and neither of them stores it. After each reply the AI provider proposes what to add or change; your phone applies that and saves the result. You can switch memory off in the app at any time, and deleting it takes effect immediately because there is nowhere else to delete it from.

Conversations are stored on your device, not in a database of ours. Delete All Data in the app removes every chat and the coach's memory from your phone, and severs the random identifier your device uses so anything left cannot be connected to you. Because your chats and the coach's memory live in your phone's storage, they are included in your own device backups if you use them. Our server keeps short-lived technical logs, retained for about a day.

Nothing you write is used to train models, and nothing you write is kept: not by our server, not by the gateway, and not by the provider once the reply is written. The serving provider may process data in the United States; the Transfers section describes the safeguards.

You can rate a reply. Rating one down opens a form that asks what went wrong, and sending it shares that reply, your last message, and any notes you write with PostHog, our analytics provider, so we can test the coach against real failures. That text can contain training and health details, because that is what the coach writes about. Nothing is sent unless you tap Send on the form, a thumbs up sends no text at all, and deleting your chats does not remove feedback you have already sent.

Replies are generated by an AI model. They can be wrong, they are not medical advice, and they do not create legal effects or similarly significant decisions about you.

Message the founder is separate from the coach and works the same way as coach feedback: what you write, our reply, and technical details such as your app version and iOS version travel to our server in Frankfurt and are stored in Stockholm until you delete the conversation in the app. Versions 1.5 and earlier of the app also send your installation's anonymous analytics reference code with each message. Since October 6, 2026, our server discards it on arrival and never stores it, and the codes stored before then have been deleted. The thread is stored under a pseudonymous identifier for your installation, or under your account while you are signed in. The founder reads it personally, and none of it is used to train anything. If you allow notifications, you get one when the founder replies. It only says that he replied: none of the conversation goes to Apple.

iCloud And Apple Watch

Supported app data can sync through Apple's private iCloud and CloudKit systems for your Apple ID. This may include routines, exercises, plans, completed strength sessions, progress, library organization, preferences, layouts, optional check-ins, and optional feature data.

This is separate from the optional Incredible account described above. If iCloud is unavailable or disabled, supported data stays local until sync is available again.

The iPhone and Apple Watch apps can exchange workout state, routines, daily summaries, Fitness, Training Load, sleep, and vital data using Apple's WatchConnectivity and HealthKit systems.

Imports And Exports

If you import workouts or routines from screenshots, the selected images are processed on device using Apple frameworks. Incredible stores the workout or exercise data you choose to save, not the screenshots.

Imported and exported files stay under your control. Anything you share outside the app is your choice.

Analytics

Incredible uses PostHog's EU-hosted analytics service for limited product analytics. We do not send Apple Health data, workouts, derived health and training insights, screenshots, names, email addresses, or account IDs to PostHog.

Coach feedback is the one exception, and you choose it: when you rate a coach reply as unhelpful and send the form, that reply, your last message, and your notes go to PostHog, and that text can contain training and health details. The AI Coach section describes it in full.

Chatting with the coach also records how the chat went, such as how long the reply took, how many tools it used, and what it cost to run. Those records never carry the text of a message or a reply.

Analytics is not used for advertising or tracking, and it is anonymous counts of which parts of the app get opened and whether they worked. If you want to object to this processing, contact us and we will handle it. The coach feedback form is separate: it only ever sends when you tap Send on it.

Our Website

The app and the website are separate. Nothing you record in the app reaches the website, and the website has no access to your Apple Health data. There are two exceptions. A challenge invitation's page and the picture shown with its link carry the creator’s chosen name and the goal. An Incredible Month invite link carries the inviter's invite code, never their name.

The website carries a public request board where you can report a bug, ask for a feature, comment, and vote. What you write there is public. You can leave an email address so we can follow up, and leaving it is optional. Board content is stored by Supabase in Stockholm, inside the European Economic Area. To stop one person filing the same thing a hundred times we keep a one way scrambled form of your IP address, which we cannot turn back into an address, and a random identifier in a cookie so a vote counts once. That cookie exists to make the board work and nothing else. We also set a cookie to remember which language you are reading in.

The website uses Vercel Web Analytics for page view counts. It sets no advertising cookies, does not follow you to other sites, and does not store your IP address.

Crash Diagnostics

When the app crashes or freezes, Apple gives it a diagnostic report the next time it opens. The app sends a limited, anonymous form of it to PostHog: what kind of crash or freeze it was, where in the app it happened, and how long a launch took. These reports hold no Apple Health data, workouts, names or email addresses.

Once a day, the first time you open the app, it also records whether overnight health updates arrived on time, with a technical log of when the system woke the app, how long it was given, and whether the device was locked. That log holds timings, battery level and outcomes. It holds no health values, and it goes to PostHog in the same anonymous form.

Until October 4, 2026, the app also sent limited crash diagnostics to Sentry's Germany data region. It no longer does. Versions released before then still contain Sentry's software, but we have switched off its connection on Sentry's side, so Sentry turns those reports away and stores nothing. What it received earlier is deleted after 30 days.

Payments And Notifications

Optional tips are handled by Apple through StoreKit. Apple processes the payment and may share basic transaction status with the app. Incredible does not receive your payment card details.

If you allow notifications, Incredible may send local alerts such as a rest timer. These are generated on your device. Our server also sends a few notifications through Apple’s push service: when a friend uses your invite code, joins your challenge or cheers you, and when the founder replies to your message, as described above. We do not send marketing push notifications.

Sharing

We share data only where needed to run the app:

• Apple provides HealthKit, iCloud, StoreKit, WatchConnectivity, location, and notification services, App Attest, which confirms your copy of the app is genuine before the coach will answer, and Sign in with Apple, if you choose to sign in.
• PostHog receives limited product analytics, crash and freeze diagnostics, and the coach feedback you choose to send, as described above.
• Sentry received limited crash diagnostics until October 4, 2026, as described above.
• Vercel hosts the server that handles AI coach chats, with function execution in the European Union, and routes those chats to the AI provider through its AI gateway. Vercel also runs the Challenges, Incredible Month and optional account services, hosts our website and counts its page views.
• Supabase stores what people post to the public request board on our website, the Invite a friend ledger, Challenges, Incredible Month, and the optional account.
• OpenAI receives coach chats and their training summary to generate replies and to screen messages for safety.

We do not sell personal data, use health data for ads, or track you across other companies' apps or websites.

Transfers

Apple, PostHog, Sentry, Vercel, and OpenAI may process data in countries where they operate. We use PostHog's EU-hosted service for analytics, Sentry's Germany data region for the crash diagnostics it received until October 4, 2026, Vercel's European Union region for the coach server, and Supabase's Stockholm region for the request board, the Invite a friend ledger, Challenges and Incredible Month. OpenAI processes coach data in the United States. We have a data processing agreement with each of them. Coach data reaching OpenAI in the United States is covered by standard contractual clauses, with EEA data processed by OpenAI Ireland.

Retention

• Device and private iCloud data stays until you delete it, turn off sync, remove the app, or Apple deletes it under your settings.
• Apple Health data is controlled in Apple Health.
• Analytics data is kept only as long as needed for product usage and reliability, then deleted or aggregated. PostHog's retention rules may also apply.
• Sentry deletes the crash diagnostics it received 30 days after receiving them.
• Coach chats stay on your device until you delete them. Coach memories are kept until you delete them in the app. Reply requests run under zero data retention and are kept by no one. Server logs live for about a day.
• Coach feedback you send is kept for as long as it is useful for testing the coach, including as a saved test case so the same failure can be checked against later versions of the coach.
• Posts on the public request board stay until the request is closed and cleared, or until you ask us to remove yours.
• Support messages are kept as long as needed to answer you and keep a record of the request.
• If you sign in, your account is kept until you tap Delete Account, until Apple tells us the sign in was revoked or your Apple Account deleted, or on a verified request.
• Incredible Month entries, capes, your invite code, first name and friendships are kept until you delete them or your account. Leaving a month does not delete them.

Security

We limit what we collect, avoid sending health data to analytics or crash diagnostics services, and rely on Apple's device, HealthKit, iCloud, and StoreKit security for the Apple services used by the app. No system is perfect, but we keep the data flow small and protected.

Automated Insights

Incredible calculates Fitness, Training Load, sleep, vital, and workout insights and provides daily training context from the data you allow. The optional coach generates replies with an AI model. None of this creates legal effects or similarly significant decisions about you.

Your Rights

If GDPR applies to you, you may have the right to access, correct, delete, export, restrict, or object to processing of your personal data. You may also withdraw consent.

Some data is only on your device, in Apple Health, or in your private iCloud, so the most direct controls are in the app, Apple Health, iCloud, and iOS Settings. In the app, Delete All Data in the coach's settings erases every chat and everything the coach has learned, immediately, because all of it is held on your phone. Product analytics have no switch in the app: they run for everyone, as described under Analytics. If you signed in, Manage Account in Settings shows your name and email, and Delete Account there erases the account as described in the Account section above. The full record, including your Apple user ID if you signed in with Apple, when the account was created and changed, and which installations are linked, is available on request.

You can make a request at incredible-app.com/contact. We may need enough information to verify and handle it. You can also complain to your local data protection authority.

Children

Incredible is not designed for children. If you believe a child has provided personal data through the app, contact us.

Changes

We may update this policy as the app changes. If changes are meaningful, we will make them clear in the app or on our website.