Project Phoenix - Bluetooth Training Companion App
Effective Date: December 21, 2025 · Last Updated: September 19, 2026
Summary: Project Phoenix is a privacy-focused, offline-first app. Everything works on your device with no account required. Cloud sync and online sign-in are optional — if you choose to enable them, your training data and profile settings are sent to your own private account (Section 5 lists what is sent). We never sell your data, and we don't use ads, analytics, or tracking SDKs. The optional voice "Safe Word" stop uses your microphone on-device only when you turn it on — it never records or uploads audio.
1. Introduction
Project Phoenix ("we," "our," or "the App") is a community-developed companion application for Bluetooth resistance training equipment. We are committed to protecting your privacy and being transparent about our data practices.
This Privacy Policy explains what information the App accesses, how it is used, and your rights regarding your data. It covers the Project Phoenix mobile apps (Android and iOS), including the data they send to the Phoenix backend when you use Cloud Sync. The optional Phoenix Portal website has its own features (such as leaderboards and community features, subscription billing, website error monitoring, and Strava, Fitbit, and Garmin connections) that are described in the Phoenix Portal Privacy Policy.
2. Information We Collect
By default, the App stores all data locally on your device. The App does not require an account and does not transmit your data anywhere unless you explicitly enable optional features such as Cloud Sync or third-party integrations (see Sections 5 and 6). The App does download exercise images and, if you ask it to, exercise catalog updates from public websites; these requests contain no personal data (see Section 6).
The App stores the following data, primarily on your device:
Workout Data: Exercise sessions, sets, reps, weights, and timestamps
Performance Metrics: Real-time machine data during workouts (position, velocity, load, power)
Personal Records: Your best lifts and calculated one-rep max estimates
Custom Routines & Cycles: Workout routines and training programs you create
App Preferences: Settings such as weight unit (kg/lb), language, theme, and display options
Profiles: The name you give each lifter profile on the device, plus per-profile settings such as body weight
Body Weight from Your Health Platform (optional): If you grant permission, the App reads your most recent body weight from Health Connect (Android) or Apple Health (iOS) and uses it as your profile's body weight
Gamification Data: Badges earned, streaks, and achievement progress
Account Information (only if you sign in): If you enable Cloud Sync, an account is created using your email or a Google/Apple sign-in. We store the minimum needed to authenticate you and associate your synced data with your account.
3. Bluetooth Permissions
The App requires Bluetooth Low Energy (BLE) permissions to connect to compatible training equipment. This connection is used exclusively for:
Discovering and connecting to your training machine
Sending workout commands (weight, mode settings)
Receiving real-time workout metrics from the machine
Bluetooth data is processed in real-time and relevant metrics are stored on your device. It is not shared with any third party. If you turn on Cloud Sync, the workout results derived from it (sets, reps, loads, velocities, and per-rep summaries) are uploaded to your account as described in Section 5. On the Inferno subscription tier, the raw per-rep machine telemetry (force, velocity, and position samples recorded many times per second during each rep) is uploaded too.
4. Microphone & Voice Recognition (Safe Word Feature)
Project Phoenix includes an optional "Safe Word" feature — a hands-free, voice-activated emergency stop for your workouts. It is off by default, and the App requests microphone and speech-recognition permission only if you choose to enable it. When enabled:
On-device recognition: Speech is processed by your device's built-in speech recognizer (on Android, offline recognition is requested via EXTRA_PREFER_OFFLINE; on iOS, on-device speech recognition is used). Your audio is never sent to Project Phoenix's servers.
Active only during workouts: The microphone is used only while the feature is enabled and a workout is in progress, listening for your configured safe word.
Not recorded or stored: Audio is analyzed in real time to detect the safe word and is then discarded. We do not save recordings or transcripts.
Your safe word stays private: The word or phrase you set is kept on your device and is deliberately excluded from diagnostic logs.
Platform services: Because recognition relies on your operating system's speech features, the relevant platform provider's (Apple / Google) privacy terms may also apply to that on-device processing.
5. Optional Cloud Sync & Accounts
Cloud Sync and the Phoenix Portal web companion (an optional premium service at phoenix-portal.com) are opt-in. The App is fully functional without them. If you choose to enable Cloud Sync:
Account required for sync only: You create an account (email/password) or sign in with Google or Apple. You can use the entire app without ever creating one.
What is synced: Your workout sessions, sets, per-rep summaries, routines, training cycles, personal records, badges and progress data, custom exercises, assessment results, rep-phase statistics, and per-exercise movement signatures are uploaded so they can be accessed across your devices and in the Phoenix Portal web companion.
Profile settings, including body weight: Your profile settings are synced, including a profile's stored body weight (whether you typed it in or it was read from your health platform). Your Safe Word and a few device-only flags are never synced.
Profiles on this device: Every lifter profile on the device belongs to the signed-in account. Synced data is tagged with its profile, and the profile names are uploaded so the Portal can show whose data is whose. If other people use profiles on your device, their profile names and training data are uploaded to your account.
Device ID: A random identifier created by the App (not a hardware or advertising identifier) is sent with each sync so your devices can be told apart.
Raw rep telemetry (Inferno tier only): On the Inferno subscription tier, the raw per-rep machine telemetry is also uploaded so the Portal can show force curves. On other tiers it stays on your device.
Connected-service activities: With a Cloud Sync subscription, activities imported from Hevy or Liftosaur (Section 6) are synced to your account.
Where it is stored: Synced data is stored in our backend infrastructure (Supabase) under your account, protected by per-user access controls. Other users can't read it, except for what you choose to share through Phoenix Portal features such as leaderboards and community features (see the Phoenix Portal Privacy Policy for what is shown and how to turn it off).
Secure tokens: Authentication tokens are stored securely on your device (Android Keystore-backed storage / iOS Keychain).
You stay in control: You can use the app entirely offline, and you can request deletion of your synced data at any time (see Section 8).
6. Third-Party Services
The mobile App does not use advertising networks, analytics SDKs, crash-reporting services, or social-media tracking SDKs. (The Phoenix Portal website's own services, such as billing and error monitoring, are covered by the Phoenix Portal Privacy Policy.) The external services the App contacts are:
Supabase — backend for optional Cloud Sync, accounts, and the Phoenix Portal. Only used if you enable Cloud Sync.
Google / Apple Sign-In — optional authentication providers, used only if you choose them to sign in.
Apple Health / Health Connect — optional. If you enable it, completed workouts can be written to your device's health platform, and your most recent body weight can be read from it, under permissions you grant. The body weight becomes your profile's body weight and is synced with your profile settings if Cloud Sync is on (Section 5). You can revoke these permissions at any time in Health Connect or the iOS Health app.
Hevy and Liftosaur — optional, and requires a Phoenix account with a paid subscription. If you connect one of these services on the Integrations screen, the API key you enter is sent once to the Phoenix backend, which stores it encrypted and uses it to fetch your activities, routines, programs, and body measurements from that service. The App does not keep the key on your device. When you tap Disconnect on the Integrations screen, the App asks the Phoenix backend to delete the stored key and removes the imported data from your device. If you are offline when you disconnect, that request may not reach the backend, so to be certain, also revoke the key in that service's own settings. Activities already imported into your Phoenix account stay there until you delete them or delete your account (Section 8).
Exercise images and catalog (GitHub, wger) — exercise demonstration images are downloaded from GitHub (the public free-exercise-db project) when you browse exercises, and the optional "Refresh extra exercises from wger" setting downloads exercise data from wger.de. These requests contain no personal data beyond what any web request carries, such as your IP address.
CSV Import/Export (Strong, Hevy formats) — file-based and fully under your control; nothing is sent to those companies.
7. Data Sharing
We do not sell your data, and we do not share it with third parties for advertising or marketing. Data you keep local stays local. Data you choose to sync is stored in your private account solely to provide the sync and Portal features to you. We only disclose data if required by law.
8. Your Rights and Data Control
You have complete control over your data:
Access: All your data is visible within the App's history and analytics screens
Deletion (local): Delete individual workouts and routines in-app, or clear all App data through your device settings
Deletion (synced): If you use Cloud Sync, you can delete your account and synced data yourself: sign in at phoenix-portal.com and use the account deletion option on your Profile page (deletion is scheduled with a 30-day grace period during which you can cancel). You can also request deletion via the contact methods in Section 12
Portability: Export your workout data to CSV at any time, and back up locally using your device's standard backup mechanisms
9. Children's Privacy
The App is not directed at children under the age of 13. We do not knowingly collect any information from children. The App is designed for adult fitness enthusiasts using compatible resistance training equipment.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated effective date. We encourage you to review this Privacy Policy periodically.
11. Community Project
Project Phoenix is a community-driven project developed by 9th Level Software. We are committed to transparent privacy practices.
12. Contact Us
If you have any questions about this Privacy Policy or the App's data practices, you can: