Torvex
Request early access Early access

Privacy

What Torvex knows about you, and what it does with it.

Last updated 14 October 2026. Covers the Torvex app for iPhone and this website, torvexapp.app.

The short version

Torvex stores your training log so you can read it back. Nothing in it is sold, nothing in it is used for advertising, and nothing in it is used to train a model. Every table in the database has row-level security: a row is readable only by the account that owns it, enforced by the database rather than by the app asking politely. The exceptions are deliberate and listed below — what other people can see once you choose a username, and the moderation tools only the developer’s own account can open. Three features send content to one outside service to do their job, and the app counts which features you use only if you say yes.

Who is responsible

Torvex is made and run by its developer, who is the controller of everything described on this page. For any question, request or complaint about your data, write to privacy@torvexapp.app. You will get an answer from a person, within a month at the latest.

What the app stores, and why

Each entry names what is kept and the reason it is lawful to keep it: because it is needed to provide what you signed up for (the contract), because you chose to give it (consent), or because keeping the service secure and working needs it (legitimate interest). Nothing here is collected for any other reason.

Your account

Your email address, a display name, a username (chosen when you set up the account; you can clear it later — see below), and optionally a profile picture and a short bio. Your password is never stored by the app: authentication is handled by Supabase, which keeps only a hash of it. New accounts have two-factor switched on, so a code is emailed at sign-in; the code is stored only as a keyed hash and only for the minutes it is valid. Contract.

Your profile and your choices

Body weight, height, your birth date if you give one, and the body figure the muscle map is drawn on; your units, language and theme, your notification switches, whether two-factor is on, and whether you share usage statistics. Everything that can be left blank can be left blank. Contract.

Your training

Workouts, exercises, sets, weights, reps, RPE, rest times and notes — including a note you keep on an exercise for every session — how a session felt when you rate one, routines and folders, the lifts you pin and a weekly target if you set one. A session in progress lives on your phone and reaches the server only when you press Finish. Contract.

The routine links you make

When you send a routine by link or QR code, a copy of it as it was at that moment — without its weights or notes — kept until a day after the link runs out or you stop sharing it, and deleted at once if you delete the routine; and the time you made each link, kept for two days to limit how many can be made. Contract.

Your body and food logs, if you use them

Measurements, progress photographs, the food you log and when, the barcodes you scan, recipes, water, the meals you save to log again, and the daily checklist of things you take with the days you tick them. These are health data, and they exist only because you chose to log them — the app works without any of them. Progress photographs are held in a private bucket readable only by you, through links that expire, and are never shown to anyone else. Consent, given by logging them and withdrawn by deleting them.

Training with other people

Whom you follow and who follows you. If you train together: the list of exercises in the shared session, the time each person last ticked a set, the six-character join code a host shows, the four figures you publish when you finish (volume, sets, duration, records), and the nudges — each one of three fixed messages, never typed text; the last one each person received is kept with that session, as who sent it, which message and when. And the accounts you block or report. Sets, weights, reps, RPE and notes never leave the phone that typed them until you finish, and then go only into your own account. Contract.

Photos, likes and comments

A photo you add to a session, re-encoded on your phone to at most 1440 pixels with its location and camera data stripped, and stored privately — your followers see it through links that expire. The likes you give, and the comments and replies you write, with the votes on them. A comment the check refuses is not kept. Every attempt, posted or refused, leaves a record — when it was made, on which workout, whether it was refused and why, and a hash of its text — which enforces the limits and shows the moderation tools how many of your comments were refused; each record is deleted once it is two days old. Contract, and legitimate interest in keeping the comments civil.

Usage statistics, only if you said yes

Which features you used, on which day, and when the app last sent them — described in full under Usage statistics below. Consent, asked when you set up the account with no answer chosen for you, and withdrawn in Settings.

The subscription

Whether Pro is active on your account, told to Torvex by the App Store. Payment happens entirely with Apple; no card number ever reaches Torvex. Contract.

Diagnostics

A build may carry crash reporting. When it does, a report describes what the app was doing — not what you were lifting: console output, request addresses and screenshots are left out before anything is sent, and session replay is off. When a build carries none, nothing is sent at all. Legitimate interest in fixing crashes.

Security records

Counts that limit how often something can be done — codes sent, password checks, photos uploaded, searches, imports — and the record of which sessions have passed two-factor. They hold a count and a time, and age out within hours or a day. Legitimate interest in keeping the service up and accounts safe.

Moderation records

If moderation ever concerns your account: a suspension with any note the developer wrote about it, the entries about your account in the moderation log, and the reports made about you — described under Moderation below. Legitimate interest in keeping the app safe for the people who use it.

Where it is stored

In a Supabase project hosted in the European Union (eu-west-1, Ireland): the database, authentication and photo storage are all there. Supabase is a processor acting on Torvex’s instructions and keeps its own operational logs and backups on its own schedule. The rules above govern every account in the app; the developer, who runs the project, can also reach the database directly as its administrator.

Supabase also keeps a log of every request made to the project, for a limited time: when it was made, the address it asked for, the device’s IP address and approximate location, the app or browser that made it and, when you are signed in, your account. The developer can read that log. A routine link is a web address on that project, so opening one — or a messaging app fetching a preview of it — is recorded there together with the link itself.

What is sent to someone else, and when

Five companies and one open database ever receive anything, each for one job. Nobody else does.

If crash reporting is configured in your build, crash reports go to Sentry, narrowed as described above. There is no advertising network, no advertising identifier, no third-party analytics and no data broker anywhere in the app, and nothing is ever sold.

What the app asks your phone for

Only what a feature needs, only when you use it, and each can be declined without losing anything else.

Who can see your training

Choosing a username is part of setting up an account. While you have one, anybody signed in to Torvex can find you by it and open your finished sessions in full — every exercise, set, weight, rep and RPE — along with your totals and your records. No follow and no approval is needed. The same goes for your profile: your display name, profile picture and bio, when you joined, how many workouts you have logged, how many people follow you and how many you follow. Your name and picture also appear beside every comment you write and to the people you train together with, and your profile picture is stored at a public link that opens without signing in.

Nobody else ever sees your notes, how your sessions felt, your body weight, your body measurements, your progress photographs, your food diary or your checklist. The volume other people see counts only the weight you lifted — the bar, the dumbbells, any added load — and leaves your body weight out, so it cannot be worked out from your sessions. Your own history and records still count it; the weekly and monthly recaps and the workout card you can share count only the weight lifted. If you weighed in during the month, the monthly card can show where your body weight started and ended, which you see before you share it.

A photo you attach to a workout, and the comments under your workouts, are seen only by you and the people who follow you — and, for moderation, by the developer. Training together shares the list of exercises, a timestamp per person and the nudges; at the end, the four figures each person publishes. A routine you send by link or QR code can be opened by anybody signed in who has the link: they see its name, its exercises with their rest times and supersets, and each set’s type, reps, time, distance and RPE target — never your weights or notes — with your display name and username, and they can save a copy as their own. A link works for 30 days, until you stop sharing that routine or until you delete it, whichever comes first; never for somebody you have blocked or who has blocked you, and not while your account is suspended. It is a copy, and it can be passed on like any link, so send it only to the people you mean it for.

You can clear your username in your profile at any time. You leave search, and from then on only people who follow you can see your sessions — the people who already do, and anybody you follow, who can still follow you back. Your profile stays visible to the people who follow you and the people you follow. The developer’s moderation tools still find and show every account. To keep somebody out, block them: blocking removes both follows, takes them out of any shared session you are in, and hides you from them.

Usage statistics

Only if you say yes. The questions you answer when you set up your account ask, with no answer chosen for you, and you can change it at any time in Settings › Your data › Share usage statistics.

If you say yes, the app notes which features you use: one tick per feature per day, from a fixed list — “logged a meal”, “finished a workout”, “opened Strength rank”. It never records how many times, and never anything you log, type, weigh or photograph. There is no device identifier and no third-party analytics service; the ticks go to the same Supabase project as the rest of your data.

No account in the app can read the ticks — not even yours. The figures appear only on a page the database opens for the developer’s own account, after two-factor sign-in, and it shows how many people used each feature, never who did what. But the developer also runs the database itself, so while ticks are kept with your account the developer can see them there, with your account beside them. Totals name nobody, and they are no promise of anonymity either: while there are few accounts, a small number can point to a person.

Ticks are kept with your account for 35 days and then folded into daily totals without names, kept for two years. The time the app last sent ticks is kept too, to limit how often it can send. Turn sharing off — or delete your account — and the ticks kept with your account, and that time, are deleted at once; within a day the stored totals for the last 35 days are worked out again without you. Totals older than that were already folded without names, and stay.

Moderation

The developer’s own account has moderation tools and no other account does: the database opens them to that one account alone, only after two-factor sign-in and with a sign-in code from the last twelve hours. They reach every account, including one without a username, and find one by its display name, username or account ID. With them the developer can see a person’s display name, username, bio and profile picture, when they joined, how many workouts, followers, comments and workout photos they have and how many accounts they follow, how many of their comments were refused in the last two days, the reports made about them and by them, the comments they wrote and whose workout each is on — which also shows whom they follow or have followed — the photos they attached to workouts, and the bug reports and messages they sent. An email address appears only beside a bug report or a message to the developer, and it is the account’s current address. The tools show nothing of your notes, how your sessions felt, body weight, measurements, progress photographs or food diary, and nothing from a deleted workout — though a photo from a workout gone from the bin stays as a leftover file the tools can reach until it is removed.

With the same tools the developer can remove a comment (with its replies) or a workout photo, remove all of one person’s comments or workout photos at once — which reaches workouts in the bin too — reset a display name, bio, username or profile picture, and suspend an account for a set time or until the suspension is lifted. A suspended account can read and change nothing, is signed out on every device within the hour, and after its next sign-in sees only a notice saying until when; from that notice the person can still delete the account or write to the developer, which is also how to ask for a copy of their data. Nothing in the account is deleted.

Each action is recorded with the account it concerned and the time, with any note the developer wrote about a suspension; the note is not shown to the person. The current suspension is kept until it is lifted, replaced or the account is deleted, and the record of actions until the account is deleted. Reports are marked as handled or dismissed, and deleting either account deletes the report.

How long it is kept

Until you remove it. A session you delete waits in Recently deleted for thirty days, with the day it will be purged printed on it, unless you restore it or delete it for good first. Two-factor codes last minutes; rate-limit records are pruned within hours or a day; comment-attempt records last two days; usage statistics follow the rules above; a routine link is deleted a day after it runs out or you stop sharing it, and at once if you delete the routine. Deleting your account in Settings › Security removes the account and every row and photograph that belongs to it from the app, immediately — there is no grace period, which is why the app tells you to export first.

Once a day the database is copied into an encrypted backup, which is kept for 14 days and then deleted. So for up to 14 days after you delete your account, your data can still exist inside that encrypted copy, and nowhere else. A backup holds the database — every row, your email address and the hash of your password included — but not photographs. It is stored on GitHub, which cannot read it: only the developer holds the key, and it is not kept with the backups. A backup is used only to recover the whole app after a failure, never to bring back one account. So that a restore cannot undo a deletion, the ID of every deleted account is kept for 15 days — the ID and the time alone, nothing else from the account — and after a restore every account deleted since that backup is deleted again. If the database itself were lost, an account deleted after the newest backup could come back this way, because that deletion would be in no copy.

Your rights

Security

Every request travels over HTTPS. At the database, every row is readable only by the account that owns it; the social features above go through database functions that decide exactly what another person may see, and the moderation tools are the one other exception, opened to the developer’s own account alone. Usage statistics are stricter still: no account can read them. Two-factor is on for every new account, and a session that has not entered its code reads nothing at all — enforced in the database, not in a screen. Uploads are checked by reading the bytes rather than trusting what a file claims to be, and paid features are refused by the server, not merely hidden by the app. No system is perfect: if you find a way to reach somebody else’s data, report it from Settings › Report a bug, and if something goes wrong that affects you, you will be told.

Children

Torvex is not for children under 13, and accounts are not knowingly created for them. Between 13 and 16, an account needs a parent or guardian who agrees on the young person’s behalf, as the terms say. If you believe a child has made one, report it and it will be removed.

This website

torvexapp.app sets no cookies for its visitors and loads nothing from anywhere but itself — its typefaces are its own files, and there are no scripts and no analytics from another company. What it does keep, and where, is short:

Changes

If this policy changes in a way that affects what is collected, who receives it or who can read it, the change will be described here with a new date at the top, and people with accounts will be told in the app.

Getting in touch

Questions about any of the above, or a request to see, correct or delete what is held: privacy@torvexapp.app.

Cookies

This website sets no cookies.

It keeps two small things in your browser’s own storage instead, and neither ever leaves it: your answer here, so you are not asked again, and — if you allow it — which theme you chose with the switch in the bar. It counts page views on its own server, without a cookie and without keeping your address; the Details say how. No advertising, nothing that follows you between sites. The cookie policy lists every item.