Privacy Policy

Chalk is a workout tracker that runs on your iPhone. Your training data — every session, set, weight, rep and programme — is stored on your device and is never uploaded to us. There is no account and no sign-in, and no server holds your training history.

What stays on your device

All of the following is written to your iPhone’s local database and to the app’s own preferences. None of it is transmitted anywhere:

• Every workout session, exercise, set, weight and rep count
• Your saved templates and five-week training blocks
• Your weekly points, tier and streak
• Your name, bodyweight and height
• Your settings — units, rest length, appearance, reminders

Your training goal and how many days a week you train are stored on the device too. They are the one part of your profile that can appear in an anonymous usage event, and only if you have turned those on — the section below says exactly where.

Deleting the app removes all of it. You can also erase it from inside the app at any time: Settings → Delete all data. That deletes every session, template and block, and clears your name, bodyweight and height. It cannot be undone, and we hold no copy to restore from. Anything you sent us on the roadmap is separate, and you delete that yourself from Settings → Roadmap → Ask → Your requests.

What is sent, and to whom

Apple — subscriptions

Chalk Pro is sold through Apple’s In-App Purchase system. Apple processes the payment; we never see your card details, billing address or Apple Account. We use RevenueCat to check whether a subscription is active. RevenueCat receives a randomly generated identifier for your install and your purchase receipt. It is not linked to your name or your training data, because the app never sends those anywhere.

TelemetryDeck — anonymous usage, only if you agree

This is off until you turn it on. The last screen of onboarding asks, and the switch starts off. Tap past it without turning it on and nothing is ever sent — the analytics service is not started at all. You can change your mind in either direction at any time: Settings → Share anonymous usage.

When it is on, Chalk records a small, fixed list of product events: that onboarding finished, that a session was started, finished or discarded, that a programme was generated, saved, advanced or replaced, that an exercise was swapped, that the history or insights screen was opened, that the subscription screen was shown, and that a purchase completed. Alongside them we send simple counts and settings — how many sets a session had and how long it ran, how many days a week you train, your training goal, your experience level and which units you use.

These go to TelemetryDeck, a privacy-focused analytics service. There is no advertising identifier, no cross-app or cross-site tracking, and no data broker. The identifier TelemetryDeck uses is a salted one-way hash that cannot be reversed to identify you or your device.

The events are a fixed list built into the app. There is deliberately no way for any screen in Chalk to attach your name, bodyweight, height or the contents of a workout to one.

Firebase — the in-app roadmap

Chalk has a roadmap inside the app: cards for what is planned, a vote button, and a form for asking for something or reporting a bug. That is the one part of Chalk with a server behind it. It runs on Google Firebase, and the function that receives what you write runs on Google’s servers in the United States — so that text leaves the EU. Nothing else about you does, because nothing else is sent.

The first time you open the roadmap, the app signs in anonymously. That gives your install a random identifier — no email, no name, nothing you typed. It is what lets the app show you your own requests and count one vote per person. It is kept in your device’s keychain, which means it survives deleting and reinstalling the app.

Stored under that identifier, and nothing else:

• The text of anything you send, up to 500 characters, exactly as you wrote it — along with our reply and whether we said yes or no
• Which roadmap cards you have voted for, and when
• For a bug report only: your app version, your iOS version and your device model. A feature request carries none of that, and the server drops those fields rather than trusting the app to leave them out.

Not your name, not your bodyweight, not a single set you have logged. The roadmap screen has no route to any of it.

You can take it back. Settings → Roadmap → Ask → Your requests lists everything you have sent, and the bin on a row deletes it from our database for good. Tapping a card’s vote again removes the vote. If something you asked for became a card on the public roadmap, that card stays — it is our words about our own plans, and most of them stand on more than one request.

If somebody abuses the form we can stop their submissions being accepted, which means keeping their anonymous identifier on a list. That list holds nothing else, and nobody can read it from the app. Firebase is Google’s; their privacy documentation covers what they do as our processor.

What Chalk never collects

• Your contacts, photos, location or health records
• Apple Health data — Chalk does not request access to it
• Your advertising identifier (IDFA). Chalk shows no ads and does not track you across apps or websites.
• Any data sold or shared with data brokers, ever

Notifications

Chalk can send you three reminders: when a rest timer ends, on the days you plan to train, and before a free trial converts to a paid subscription. These are scheduled locally on your device — no push server is involved and no notification content leaves your phone. Permission is asked for once, after you finish a session, and you can change it at any time in iOS Settings.

Children

Chalk is not directed at children under 13, and we do not knowingly collect data from them.

Your rights

Almost everything Chalk knows about you is on your phone, so requests to access, correct or delete it are answered by the app rather than by us — it is already in your hands, and Settings → Delete all data erases it.

The roadmap is the exception, and it has its own controls for the same reason: what you sent us is on our server, so Your requests is where you read it back and where you delete it, and a second tap on a vote withdraws the vote. If you would rather we did it, email us — but you will have to tell us what you wrote, because the identifier it hangs off is not something we can connect to a person or an email address.

For the anonymous product events there is nothing linked to you that we could look up. You can stop them at any time with the setting above.

If you have a question about any of this, email hello@websab.nl and you will get a reply from a person.

Changes

If this policy changes in a way that affects what is collected, the date at the top of this page changes with it, and the change is described in the app’s release notes.

Who we are

Chalk is made by WebSab, based in the Netherlands. Contact: hello@websab.nl.