Privacy Policy

Effective date: November 14, 2026

Need help? Support

1. Introduction

This policy covers the Ferro fitness coaching app on iPhone and on the web at ferrocoach.com (the "Service"). "We", "us" and "our" mean Ferro. It explains what personal data we collect, how we use it, and the rights you have over it.

By using the Service you agree to the collection and use of information in accordance with this policy.

2. Data we collect

Account data

When you register we collect your email address and, optionally, your name.

Health & fitness data

To provide personalised coaching you may voluntarily provide:

Body metrics — height, weight, age, biological sex
Fitness goal and training experience level
Workout logs — exercises, sets, reps, weight, duration
Nutrition logs — meals, calories, macronutrients
Recovery data — sleep, energy, soreness, mood
Daily calorie and protein targets

Photos you share

When you add a photo or screenshot of a meal, a food label, a workout or a training plan, we send it to Anthropic, the company whose AI powers Ferro. It works out what's in the picture. We save what it found, such as the foods and their nutrients or the exercises and sets. We don't save the photo.

Any photo you attach in the coach chat is sent to Anthropic first, to tell what it shows. If it isn't food or a workout, we keep a short description of it in your chat history, not the photo.

Wearable data (optional)

If you connect a WHOOP or Oura Ring device we receive daily recovery and readiness scores, and body measurements (weight, height) from those providers. We only store scores and measurements — raw sensor data stays with your wearable provider. You can disconnect at any time from your Profile page.

WHOOP (optional)

We ask for your explicit consent before connecting WHOOP. Once connected, we store:

The OAuth tokens that let us read your WHOOP data (never your WHOOP password)
Recovery — recovery score, heart rate variability, resting heart rate, blood oxygen and skin temperature
Sleep — time asleep and in each sleep stage, sleep performance, efficiency, consistency, respiratory rate and sleep need
Daily strain — each day's strain score, energy burned and heart rate
Workouts — activity type, time, strain, heart rate, energy burned, distance and elevation
Body measurements — your weight, and your height if your profile doesn't have one

This data is sent to Anthropic, our AI provider, to write your coaching. It is not used to train AI models. Disconnecting WHOOP in Profile deletes all the WHOOP data we stored. A height we copied into an empty profile stays, because it has become part of your profile; you can change it in Profile. Deleting your account deletes everything.

Apple Health (optional, iOS app only)

If you connect Apple Health in the Ferro iPhone app, it reads only the Health data you allow and sends it to our servers, so Ferro's advice can take it into account:

Daily totals: steps, calories burned through activity, exercise minutes, resting heart rate, heart rate variability and hours of sleep
Calories eaten: the daily total that other apps, such as a food diary, save to Apple Health
Body weight: the first reading of each day
Workouts: each workout's type, start and end time, duration, calories burned, distance and the app or device that recorded it

The app also reads your height, date of birth and biological sex from your Apple Health profile, only to fill in those answers for you while you set up Ferro. We save them to your account only if you confirm them.

We never add or change anything in Apple Health. We never read your heart rate moment by moment or your location. We never use Apple Health data for ads or sell it. You can disconnect in Profile, or turn off access any time in the iPhone Settings app under Health → Data Access & Devices.

Usage data

We collect standard server logs (IP address, browser type, pages visited, timestamps) for security and reliability purposes. These are never sold. When you sign up we also record which link or ad brought you here (its campaign tags and the website you came from), so we know which ones work. We also save two things about your sign-up: the kind of device you used, such as the iPhone app or a computer browser, and your country. Our host, Vercel, works out the country from your connection. We don't save your IP address, city or browser details with them. These sign-up details are deleted with your account.

Payment data

Ferro is free during the beta. We do not ask for, collect or store any payment details. If paid plans are introduced, this policy will be updated before any payment is taken.

3. How we use your data

To provide and personalise the Service — we send your health data, history, your chats with Ferro and the photos you share to Anthropic, the company whose AI powers Ferro. It uses them to make your workout plans, meal estimates and advice. Anthropic is our sub-processor: a company that handles data on our behalf.
To operate and improve the Service — we analyse aggregated, anonymised usage patterns to fix bugs and prioritise features. If you agreed to AI coaching, we also check some of your chats with Ferro to improve the coaching, as section 4 explains.
To communicate with you — transactional emails (password reset, email confirmation). We do not send marketing emails without your explicit consent.

We do not sell, rent, or trade your personal data to third parties.

4. AI processing

Coaching responses are generated by Anthropic, our AI sub-processor. Your profile data, recent activity history and your chats with Ferro are included in the request context so the AI can give personalised advice, and we send it the photos you share, so it can work out the food in a meal or the exercises in a workout. Anthropic processes this data solely to return a response and does not use it to train future models under our API agreement. See Anthropic's Privacy Policy.

Anthropic is a US company, so this data is processed in the United States. Ferro asks for your agreement before it sends anything to Anthropic, and you can turn AI coaching off at any time in Profile. If you say no or turn it off, logging by hand and barcode scans still work.

If you agreed to AI coaching, Ferro also sends some of your chats with Ferro to Anthropic, the same AI, to check and improve the coaching. For each reply it checks, Ferro stores a short rating: what kind of problem there was, if any, how serious it was, and a one-sentence reason. A rating is kept with that chat reply until you delete your account; clearing a chat doesn't delete it.

AI-generated health and fitness content is informational only and is not a substitute for advice from a qualified medical or nutritional professional.

5. Data sharing

We share personal data only with the following categories of sub-processors:

Provider	Purpose	Data shared
Anthropic	AI coaching responses	Your profile, workout and meal history, your chats with Ferro, activity and recovery data, including from WHOOP, Oura and Apple Health, and the meal, food-label and workout photos you share
Neon / PostgreSQL host	Database hosting	All stored data, encrypted at rest
WHOOP (if connected)	Importing your recovery, sleep, strain, workouts and body measurements	OAuth tokens. We read from WHOOP and send it none of your Ferro data
Oura (if connected)	Readiness data import	OAuth tokens only
Sentry	Finding and fixing errors	When something breaks: a technical error report, the page you were on with search details removed from its address, and your browser and device type. Never your name or email, and not linked to your account. For 1 in 10 visits, timings of how fast pages and requests were. For 1 in 10 visits, and any visit with an error, a recording of how the screen changed, with every word, everything you type and every image hidden
Upstash	Blocking floods of requests so Ferro stays fast and safe	Temporary counts of how often something was used, labelled with your account, your IP address, your phone's Apple Health sync id, or a code made from your email address. Each is deleted within 3 days
Grafana Labs	Internal dashboards and alerts on reliability and AI costs	Can read everything in our database but can't change it. Our dashboards and alerts show counts and totals, such as sign-ups or AI spend. We may also look up individual records through it to fix a problem
PostHog (US)	Product analytics: which screens and features get used	Your account id only (never your name or email), page addresses without query strings, and named in-app events. No health data, no screen text, and no session recordings in PostHog
Vercel	Hosting the app and its servers	All requests to Ferro, in transit
Resend	Sending account emails	Your email address and the email's content
Google / Apple (if you sign in with them)	Signing you in	They tell us your name and email (with Apple, a private relay address if you choose to hide it)

6. Data retention

We retain your account and health data for as long as your account is active. If you delete your account, all personal data — including workout logs, meal logs, recovery data, wearable tokens, and your email address — is permanently deleted straight away; copies in our database backups are gone within 30 days. To delete your account, go to Profile → Account. Still setting up? Tap "Sign out or delete account" at the bottom of the screen. Deleting also disconnects WHOOP or Oura if you connected them.

We keep WHOOP data while WHOOP stays connected, for up to 365 days, so your coach can see trends: each day, anything from WHOOP older than 365 days is deleted automatically. Disconnecting WHOOP deletes all the WHOOP data we stored (recovery, sleep, strain, workouts, weigh-ins imported from WHOOP and the connection tokens) straight away.

You can export all your data at any time from Profile → Export my data.

7. Cookies

We use only session cookies required for authentication (NextAuth.js) and short-lived CSRF state cookies for OAuth flows. We do not use advertising, analytics, or tracking cookies. Our product analytics (PostHog) keeps a random identifier in your browser's local storage, not in a cookie. If you arrive through a tagged link or on one of our landing pages, we also set one first-party cookie for 30 days that remembers the link's campaign tags (utm_source, utm_medium, utm_campaign, a referral code), the website you came from (its host name only, never the full address) and which of our landing pages you first saw. We save it on your account or waitlist entry when you sign up, to count which channels bring people in. It holds no personal data. The one thing that leaves Ferro is the channel's name (for example "reddit" or "direct"), added to our links to the App Store so Apple can tell us how many downloads each channel brought; Apple shows us totals only. We also count visits to our landing pages, without adding any cookie: each visit only adds one to a daily total per page and channel. We don't store your IP address, browser or any identifier with it, and the counts can't be linked back to you.

8. Your rights

Depending on your jurisdiction you may have the right to:

Access the personal data we hold about you
Correct inaccurate data (editable directly in your Profile)
Delete your account and all associated data
Export your data in machine-readable format (JSON)
Withdraw consent for wearable data sync at any time

To exercise any right not covered by self-service tools in the app, email us at hello@ferrocoach.com.

9. Children

The Service is for adults 18 and over and is not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. During sign-up we ask for your birthday or for you to confirm that you are 18 or older, and an account can't be set up with a birthday under 18.

If we learn that an account belongs to someone under 18 (for example, from the birthday on a linked Google account), we pause it: coaching, plans and profile changes stop, and the account shows a screen explaining why. Nothing is deleted automatically. From that screen the account holder can download their data or delete the account and everything in it straight away. If you are a parent or guardian and believe your child has given us data, or if you think we have your age wrong, email us at hello@ferrocoach.com and we will delete the data or fix the record promptly.

10. Security

Data is encrypted in transit (TLS) and at rest. Authentication uses hashed passwords (bcrypt) and secure, httpOnly session cookies. Tools that only need to read data, such as our monitoring, can't change it.

No method of electronic transmission is 100% secure. We cannot guarantee absolute security, but we follow industry best practices and review our controls regularly.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of the page. For material changes we will notify you by email or an in-app notice at least 14 days before the change takes effect.

12. Data sources & attribution

Nutrition data shown in the Service is sourced in part from the following third-party databases:

U.S. Department of Agriculture, Agricultural Research Service. FoodData Central, 2019. fdc.nal.usda.gov. (Public domain, CC0.)
Open Food Facts (openfoodfacts.org), a collaborative, crowd-sourced database licensed under the Open Database License (ODbL). Data is used for lookup only and is not redistributed.

13. Contact

Questions about this policy? Email hello@ferrocoach.com.