Privacy.

IronStack is made by Mission Built, which is Mike Nichols, in Pittsburgh, Pennsylvania. For the purposes of privacy law, Mission Built is the controller of whatever this page says leaves your phone. There is no parent company, no subsidiary and no partner with access to your data. The app is not open source; this page is where to read what it does with your data, and the What the server holds screen shows you the rest, live.

You can log every set you will ever do without signing up, logging in or giving a name, an email address or a phone number. The only identity Coach ever sees is a key your phone creates in its secure hardware, which proves a request came from a real copy of IronStack and nothing more.

Social is the one exception, and it is optional. To share sessions with the people you train with, you sign in with Apple. IronStack asks Apple for neither your name nor your email, and stores neither if Apple sends them. The Social server keeps the stable, anonymous user id Apple gives it, and a sealed token it uses for one thing: disconnecting Sign in with Apple when you delete your account.

Every set, session, note and correction; your programs, workouts and exercises; your gear and home gym; the details you give for a session (bodyweight, sleep); your Coach conversation; and your Social settings. All of it lives in files in the app's own container on your iPhone, written under the phone's encryption and protected until the first unlock after a restart. Those files are included in your iCloud or computer backup the way any app's data is; Mission Built has no access to your backups.

Apple Health, if you allow it. IronStack reads your weigh-ins, sleep, height, date of birth and biological sex, so the questions it asks before a session answer themselves and Insights can line your sleep up with your lifting. It only fills empty fields; you can always type over them. If you turn on the separate switch in Settings (off until you do), it saves each finished session to Health as a strength workout. It never writes your weight or your sleep. Nothing from Health is used for marketing, advertising or anything but the log and your own Insights.

Location, if you allow it. From your second session on, the app asks once. During a session it asks for roughly a kilometre of accuracy and rounds the coordinates to two decimal places the moment they arrive. The session keeps the town name, those rounded coordinates, whether you were away from home, and the weather. To get the weather and the town name, the rounded point goes to Apple's WeatherKit and Apple Maps. Logging never needs location, and an export leaves coordinates out unless you switch them on.

Automatic travel, only if you turn it on. Set travel automatically, in Settings, is off until you turn it on. On, the app remembers where home is, rounded to about a kilometre, and watches for large moves in location (not a live track), even when a session is not running, so it can switch you to Away when you are farther from home than the distance you pick (50 miles unless you change it) and back when you return. The check happens on the phone; no location is sent anywhere for it. Turning the switch off stops the watching; Forget home erases the home area.

Your voice, only while you hold the button. Speech is turned into text on the phone, by Apple's on-device speech recognition, only while you hold the talk button. No audio is kept or sent anywhere.

MealStack, if it is on the same phone. The two apps share a private shelf on your phone that only Mission Built apps can open. On it: the travel switch (Home or Away, which app flipped it, and your rounded home area if you use automatic travel); today's session time when you move it, so the other app can offer to follow, Sync or Skip; and, only after a separate yes for each, when your last session started and how long it ran, and when you usually train. Each app also leaves a note that it is installed and when it was last used, which is how the Double Stacked badges know you used both. Neither app moves anything in the other without asking, and nothing crosses to a server to do this. Turn a share off and IronStack takes it back off the shelf.

This section also serves as the consumer health data notice some states require. The health data involved: bodyweight, sleep, height, date of birth and biological sex read from Apple Health with your permission, the workouts written to it with your permission, and the sets, effort ratings and notes you log. Source: you and Apple Health. Purpose: the log, your Insights, and Coach when you ask it. Shared with: nobody, except what goes to Coach when you ask it a question, and the session card you choose to share on Social, as described next.

Consent and withdrawal. Nothing in this notice is read or shared until you allow it: Health access in iOS Settings › Health › Data Access & Devices, and Coach only when you ask it something. Turning either off withdraws your consent from then on, and Delete all IronStack data removes what was collected. Your rights under Washington's My Health My Data Act and similar laws (to confirm, access, delete and withdraw consent) are the ones in Your rights below, at the same address. Mission Built does not sell consumer health data.

Settings › Your data › Export all my data writes every session you have ever logged, your plan and your own exercises into one file, in the Mission Built Schema, a documented format you can read anywhere or bring back into IronStack. Export the raw log gives you the log itself, line for line.

What the server holds asks the Coach server, live, for everything it keeps for your install and shows it to you. The request is signed by your phone's key, so the server can only ever answer for the install that asked.

Delete all IronStack data is one screen that erases everything, everywhere, in order: first the server's copy (the install record, the counters, and the log copy if you had it on), then your Social account if you have one, then everything on the phone. It reports each one. If the server or Social cannot be reached, it stops before touching the phone and says so, so nothing is left behind that you can no longer ask to erase; you can try again or delete the phone's data anyway. Social › Delete Social account deletes only the Social side: your handle, spotters, shared cards and support, and disconnects Sign in with Apple. Your log is not touched.

Two things those buttons do not remove: workouts IronStack wrote to Apple Health stay in Health, where you can delete them in the Health app; and the count-and-cost record of Coach use expires on its own within about ninety days. Turning Coach off in Settings stops it from sending anything from then on; signing out of Social stops notifications.

If the app was deleted before you asked, nothing on the Coach server can be matched to you, which also means nothing there can identify you. For that, for your Social account, or for anything else about your data, email [email protected]. Mission Built will confirm within ten days and finish within thirty.

You can ask what Mission Built holds that relates to your install or your Social account, ask for it to be corrected or deleted, ask for a copy, object to or restrict its use, and withdraw any consent you gave, all at the address above, and you will not be treated differently for asking. Under the GDPR, the legal bases are your explicit consent for anything involving health data (Coach, Apple Health, the log copy), your consent for Social and location, and Mission Built's legitimate interest in running the Coach allowance, keeping Social safe and keeping the service from being abused. Mission Built has not appointed an EU or UK representative; write to the address above. If you are in the EU, the EEA or the UK you may also complain to your supervisory authority. Under California law, Mission Built does not sell or share personal information and has not done so in the past twelve months.

Mission Built operates from the United States and the companies above process data there, so anything that leaves your phone leaves your country if you are outside the US. Cloudflare and Anthropic each rely on recognised transfer mechanisms such as standard contractual clauses or the EU–US Data Privacy Framework for that.

If what the app collects or shares changes, this page changes first, with a new effective date at the top. A change that widens what leaves your phone will be asked about in the app before it applies to you. Effective September 29, 2026.