Security

Local fitness database

Fitness data is stored in SQLite on the device. An account is not required for normal workout tracking. Signing out or deleting the server account does not silently erase the local database.

Zero-knowledge backup design

Before upload, Privalift serializes the local database, compresses it, and encrypts it with AES-256-GCM. Every backup uses a fresh nonce and authenticated format metadata. The Recovery Key stays in secure device storage unless the user explicitly copies or exports it.

App-local photos are normalized to WebP, encrypted separately on the device, and reused across restore points so unchanged photos are not uploaded with every database backup.

Privalift servers store:

• the encrypted backup artifact;
• backup size, checksum, format and key versions;
• creation, verification, and expiry timestamps;
• the account and authorized Backup Device identifiers.

Privalift servers do not receive:

• the Recovery Key;
• decrypted workouts, measurements, routines, notes, or preferences;
• readable app-local photos.

Recovery and device replacement

A backup can be restored on a replacement device by signing into the same account and entering the Recovery Key. Privalift validates and decrypts the backup before replacing local data. Only one device may be authorized to create backups for an account at a time.

Restore safety

Restore is replace-only; Privalift does not merge databases. The app offers a safety export, validates the incoming database in isolation, resets device-specific integration state, and preserves a rollback copy until the replacement succeeds.

Retention

While backup entitlement is active, Privalift retains up to seven restore points: the newest restore point and up to six older points. Older points expire after 30 days. When entitlement ends, the newest restore point may be retained for up to 12 months for recovery. Expired and incomplete uploads are removed by scheduled cleanup.

Deleting the Privalift account immediately requests deletion of active backup objects and metadata. Infrastructure disaster-recovery copies may persist for up to 30 days before automatic expiry.

Crash reporting

Crash reporting is required so Privalift can detect app failures. Reports are limited to exception type and sanitized code locations, app release/build, OS, device model/architecture, and whether the error was handled. Reports remove raw exception messages, account identity, fitness values, request bodies, breadcrumbs, arbitrary contexts, stack variables, device names, screenshots, replay data, and tracing data. Privalift does not use behavioral analytics.

External exercise-video links

Selecting Find video on YouTube opens a YouTube search outside Privalift. Google/YouTube may receive ordinary connection, browser, app, and device information under its own privacy policy. Privalift does not receive the user’s YouTube searches, viewing history, or account activity.

Responsible disclosure

Report security concerns to support@privalift.app with “Security” in the subject. Do not include another person’s private data in the report.