Apex Privacy Policy

Apex is run by one person, as an individual. It is not a company. In this policy, "Apex" means that person acting as the operator of Apex, and "the person who runs Apex" means that person personally.

Apex is a free, invite-only test of a training app that uses AI, for adults.

For any question or request about your information, email privacy@apextraining.app. To revoke your authorization, see §7.

• Apex keeps what you enter, the briefs it writes for you and, if you connect WHOOP, your WHOOP data. It reads and stores new WHOOP data, and uses it in your briefs, only while you agree to both of its optional WHOOP statements (§3).
• To write your daily brief, Apex sends much of this to an AI model provider, whose AI writes the brief. That includes your injuries, and the words you type about your goal, your equipment and your day, word for word. It includes your WHOOP figures only while you agree to both optional WHOOP statements (§3). Apex asks you to sign a written authorization for this, and you can revoke it at any time.
• A database provider stores Apex's data. A hosting provider runs the Apex website and app. An authentication provider runs sign-in.
• Apex doesn't sell your information or show ads, and it puts no outside analytics or tracking tools in its website or in the Apex iPhone app. Only if you agree to an optional statement, Apex's own code keeps a record of the days on which you open four of its pages and of when you change your training setup, without anything you read, chose or wrote there (§3). Apex also looks at its own counts of each member's activity to see how the test is going (§4). If you use the Apex iPhone app, the company that distributes it collects reports of the app's crashes and information about your device and how you use the app, and shares them with Apex (§6).
• Apex keeps your information until your account is deleted, which you can ask for at any time. After a deletion, Apex keeps copies of your data on the computer of the person who runs Apex for about 30 days, then deletes them. Those 30 days cover only those copies. Copies of a weekly summary of members' activity may also be kept on that computer (§9). Apex also keeps a record of the deletion. It holds your account ID and how many records of each kind were deleted, but none of your readings and nothing you entered. Apex also keeps the emails you sent it. If you had an account before 6 October 2026, Apex also keeps older working records that can identify you. Apex's developer tools, from the same company as the AI model provider, can read them, even after you revoke your authorization or delete your account (§6). Before that date, Apex also put information about members into that company's chat app, including information about injuries, which is health information. It went to that company outside any authorization, and Apex has not deleted those chats (§6). Some members' readings, which are also health information, may have gone to that company outside any authorization too, through Apex's developer tools (§6). The service providers Apex uses keep their own copies under their own rules (§9).
• Apex is for adults only.

What you enter

• Your email address, copied from your sign-in account the first time you sign in.
• Your goal: its type, your sport, what you measure, your target and its unit, and your target date.
• Your height, your weight, and whether you use metric or imperial units.
• Each injury you add: the body part, how severe it is, what you write about it, and when you added it.
• Where you train (a full facility, a partial setup or no equipment), and anything you write about your equipment.
• What you log by hand for each day: recovery, hours of sleep and notes.
• When you sign the authorization: the full name and the date you type. Apex uses your typed name only to sign the authorization. It appears on your signed copy and in any copy of your data, and it is not sent to the AI model provider to write your brief. For older accounts, see §6.
• Anything you write to Apex by email.

Some of these are boxes you can type anything into: your sport if you choose a custom goal, what you measure and its unit, your injury body parts and notes, your equipment note, and the notes you log by hand. Whatever you write in those boxes is kept, and is sent to the AI model provider word for word in each brief that uses it (§5). That includes anything about your health or about who you are.

From WHOOP, if you connect it

• Apex asks WHOOP for read-only access to your recovery, sleep, workouts, daily strain and profile. It also asks for continuing access, so it can keep reading without asking you each time. Apex's app does not read your WHOOP profile, even though it asks for permission to.
• Two optional WHOOP statements. If you connect WHOOP, Apex asks you to agree to two separate statements, each optional and unticked until you tick it: one to send your WHOOP readings to the AI model provider to write your brief (§5), and one to save your WHOOP numbers in your brief history. The words of the first name the AI model provider. Apex uses your WHOOP data for your briefs only while you agree to both and Apex hasn't stopped using WHOOP data for every member (below); in this policy, that is what "while Apex uses your WHOOP data" means. Otherwise, Apex reads and stores no new WHOOP data, sends none of it to the AI model provider, and writes your briefs without it. Anything you log or type yourself is still used, even if you copied it from WHOOP.
• Changing them. While your authorization is in force, you can agree to either statement, or withdraw either, on Training setup on the Apex website once you have finished setting up Apex, and you can withdraw either at any time by emailing privacy@apextraining.app. Apex records an emailed withdrawal on the day it receives your email. If you withdraw while a brief is being written, that brief may still use your WHOOP data. Withdrawing doesn't delete WHOOP data Apex already holds; §10 says how long Apex keeps it.
• Apex can also stop using WHOOP data for every member at once, for example if WHOOP asks it to. While it does, whatever you have chosen, Apex reads and stores no new WHOOP data, sends none to the AI model provider, and writes your briefs without it.
• While Apex uses your WHOOP data, it reads your recovery, sleep, workouts and strain for the past 7 days, plus one more day so nothing at the edge is missed. It does this on each day's scheduled run: from 8am your time, about every 15 minutes until that day's brief is ready, and not after 8pm. It may also do so at other times while it uses your WHOOP data, such as when you connect WHOOP.
• For each day it reads, Apex stores your recovery, heart-rate variability, resting heart rate, hours of sleep, strain and number of workouts. If you withdraw a statement, the WHOOP figures Apex has already stored stay until your account is deleted (§10). Until 19 October 2026, when Apex read your WHOOP data, it also stored the unedited data WHOOP returned, which included measurements and details Apex doesn't use. It stopped that day and no longer does, and the same day it deleted from its database the unedited data it had stored. Copies made before the deletion, in a copy of your data (§8), in a copy made before deleting an account (§9) or in Apex's database backups, and anything of it in the database provider's or the hosting provider's logs, last until they are deleted or expire.
• Apex keeps the keys that connect your WHOOP account, encrypted.

What Apex records as you use it

• Your time zone, as set on your phone or computer. Apex reads it when you open Apex while signed in. Until Apex first reads it, it is "UTC".
• Your consent. For each version of the consent statement you agree to: when you agreed, the IP address you agreed from, and the policy version Apex recorded with it. If you agree to the optional usage statement (see "Your use of four pages" below), Apex keeps a record of that agreement too: when you agreed and, where Apex recorded them, the policy version and the IP address you agreed from. If you agree to or withdraw either optional WHOOP statement (see "From WHOOP" above), Apex keeps a record of each agreement and each withdrawal, including which statement and which version of its words it was, when Apex recorded it, and the policy version Apex recorded with it.
• Your authorization. The version you signed, when Apex recorded it, when it ends, and any revocation, including whether it was made in the app or by email.
• Your briefs. Each brief written, with a snapshot of part of what it was written from: your goal, your injuries, where you train, your time zone, the reading it judged your readiness from (that day's, or your latest from the 7 days before it), with any note you logged with that reading, and, if Apex used your WHOOP data to write it, the past week's WHOOP figures. A brief's text can repeat your figures and words, including your WHOOP numbers if Apex used your WHOOP data to write it. Some briefs written on or before 7 September 2026 don't record where you train.
• Records of Apex's own work for you:
  • each brief written or failed, and why, and for each brief written, the AI model used and what it cost;
  • each WHOOP connection, and attempts to connect that failed, with the reason; each data pull; requests to WHOOP to withdraw Apex's access for a deletion, and any connection Apex could neither keep nor withdraw; and errors WHOOP returned;
  • each change you save to your goal on the Goal page, with the old goal and the new one, except a save whose only differences are capital letters;
  • any unusual height, weight or sleep figure you confirmed;
  • each time you pressed Try again on a brief that didn't come through, while your authorization was in force and Apex hadn't stopped work on your account;
  • each time Apex stopped or restarted work on your account.
• A code used while you connect WHOOP. It works for 10 minutes and is deleted when it is used in time. Otherwise it is kept until your account is deleted.
• Your use of four pages, and changes to your training setup, only if you agree. This is the optional usage record. Apex keeps it only if you agree to its statement, and only from then on, and keeps nothing in it from before you finish setting up Apex. If you don't agree, your brief is written all the same.
  • Pages. The days on which you open Apex's Brief, Archive, Help or Log page, and which of those pages it was, at most once a day for each. Opening one of your past briefs, or a web address for a past date, counts as the Archive page. Apex keeps the date, in your time zone as Apex holds it (see "Your time zone" above), and not the time, the web address, or anything you read or write there.
  • Training setup. A note that you saved a change to where you train or to your equipment note, and whether you changed one, the other or both. It never holds what you chose or what you wrote.
  • Apex doesn't send this record to the AI model provider. Apex's developer tools (§6) don't see it, apart from counts across all members that check nothing was recorded that shouldn't have been. The exception in §6 for the account of the person who runs Apex doesn't cover this record.
  • Stopping it. You can stop it on Training setup on the Apex website once you have finished setting up Apex, or at any time by emailing privacy@apextraining.app (or support@apextraining.app). If you email, Apex stops it on the day it receives your email. Stopping deletes the record from Apex's database. It can't be turned back on during this test: Apex keeps your agreement, and a note that the record was stopped, when, and whether you stopped it in the app or Apex did, so that it doesn't start again. Copies made before you stopped it, in a copy of your data (§8), in copies of the weekly summary (§4, §9), or in Apex's database backups, last until those copies are deleted or expire (§8, §9).
  • Otherwise Apex keeps the record until your account is deleted, and deletes it with your account (§9).

What Apex doesn't collect

• Apex's own forms don't ask for your age or date of birth, sex, home address, phone number or payment details, and there's nowhere to upload medical records or lab results. Agreeing to the consent statement includes confirming that you are 18 or older (§12).
• Apex's own forms don't ask for your name, except to sign the authorization. The authentication provider's sign-up form may (§6).
• Apex doesn't use your device's location. Your time zone and IP address do show roughly where you are.
• Apex's own code doesn't keep a record of which pages you open, apart from the optional usage record above, which it keeps only if you agree. The hosting provider's own records of each request can include the web address opened, and so can what the authentication provider receives once you have signed in (§6).

• To write your daily brief, and to show you your briefs and your data.
• To run Apex: signing you in, keeping your WHOOP data up to date while Apex uses it (§3), and stopping work on accounts that are closed or blocked, that have not signed the authorization, or whose authorization was revoked.
• To answer your requests.
• To see how the test is going. For this, the person who runs Apex looks at a summary of each member's activity: counts, such as briefs written and entries logged; the date of the member's last profile change, if it falls in the period the summary covers; whether the member has finished setup, is active and has connected WHOOP; and information from the optional usage record (§3) and about each member's choice on it and their account's status, including dates. The summary contains no readings and nothing you wrote. The person who runs Apex produces it on that person's computer, where copies of it may be kept, and doesn't give it to Apex's developer tools (§6).
• To keep Apex secure and fix problems. The person who runs Apex can access everything Apex stores, to run the service and carry out your requests.

Apex doesn't sell or rent your information, and doesn't train any AI model on it. It doesn't use your information for advertising either, unless you are the person who runs Apex, whose own information Apex may use in its marketing (§6).

Apex asks you to sign a written authorization in the app (form APEX-AUTH-1). It lets Apex share your information with three companies, which it names, for the purposes it states: the AI model provider, the database provider and the hosting provider described in §6. You can download your signed copy from the Authorization page (apextraining.app/authorization), or save or share it from the Authorization screen of the Apex iPhone app, at any time you can sign in to Apex.

Each time Apex writes your brief, it sends the AI model provider the information below, so that its AI can write the brief. That is normally once a day after 8am your time. Your first brief is written as soon as you finish setup, and a brief may be written again if one fails and is retried. Some items apply only on some days, or only while Apex uses your WHOOP data (§3), as each item says.

1. Today's date and your time zone. The time zone is the one set on your phone or computer, as Apex last read it when you opened the app. It changes when that setting changes and you next open Apex, for example after you travel and your device updates its time zone. Until Apex first reads it, it is "UTC". It shows roughly where you are.
2. Your goal as you entered it: the type of goal, the sport, what you measure, your target number (rounded to 3 decimal places) and its unit, and your target date. If you changed your goal since yesterday's brief, a fixed notice says that it is a new goal or that the target was updated. Once your change is saved, Apex doesn't send your previous goal, except in a brief it had already started, which it then discards.
3. Your height, your weight, and whether you use metric or imperial units.
4. Your protein target, in grams per kilogram of body weight, which is fixed by your type of goal. If you use metric units and have given your weight, it also includes the grams per day this comes to at that weight.
5. Each injury you recorded: the body part, how severe it is, and what you wrote about it. Apex has no way yet to mark an injury as healed, so each one is sent with every brief.
6. Where you train: a full facility, a partial setup, no equipment, or that you have not said. Also what you wrote about your equipment.
7. How ready you are today:
   • While Apex uses your WHOOP data (§3): your WHOOP recovery, heart-rate variability, resting heart rate, hours of sleep and strain so far.
   • What you logged by hand today: recovery, sleep and notes.
   • If there is no reading yet today, the most recent one from the 7 days before, with its date and its age in days.
   • While Apex uses your WHOOP data, if WHOOP has only partly synced today: your sleep, strain and number of workouts.
8. For each of the 7 days before today:
   • while Apex uses your WHOOP data, your WHOOP recovery, heart-rate variability, resting heart rate, sleep, strain and number of workouts;
   • what you logged by hand: recovery, sleep and notes.
9. Yesterday's brief, in full. It repeats some of your figures and words. It is not sent if you changed your goal since, except in a brief Apex had already started when you saved the change, which Apex then discards. Unless Apex uses your WHOOP data (§3), it is sent only if Apex recorded that it was written without your WHOOP data.

Everything you type into these fields is sent word for word. That means the sport, what you measure and its unit, your injury body parts and notes, your equipment note, and the notes you log by hand. It includes anything about your health or about who you are that you choose to write there.

What Apex doesn't send. Apex doesn't send the AI model provider the full raw data WHOOP returns, or the dates of your injuries. It doesn't add your name, email address, account ID or IP address to what it sends the AI model provider to write your brief, including the name you type to sign the authorization. If you write any of them into a field above, it is sent as you wrote it. So what Apex sends is not anonymous: your words, time zone, dates and figures could help identify you.

What the AI model provider may do with it. Under the AI model provider's terms as published on 2 October 2026:

• It does not train its AI on this information without Apex's express permission.
• It deletes what Apex sends, and what its AI writes back, within 30 days. It may keep some things longer:
  • content flagged as breaking its usage rules, and safety scores about that content, for set periods;
  • anything it needs in order to deal with breaches of those rules, with no time limit stated;
  • anything the law requires it to keep;
  • anonymized versions, which it may use for research.

The AI model provider can change its terms.

Where other texts differ. Version 1.2 of the short consent statement in the app, which version 1.3 replaced, said recent check-ins are sent. They are not. It also didn't mention today's date, your time zone, or whether you use metric or imperial units, all of which are sent, and it said "the last seven days" where Apex sends today and the seven days before. Version 1.0 of the authorization says your previous goal is never sent, and that yesterday's brief is not sent if you changed your goal. Each can be sent, once, in a brief Apex had already started when you saved the change, and Apex then discards that brief. Version 1.0 also says your goal is sent as you entered it. A target number with more than 3 decimal places is sent rounded to 3. Version 1.0 also says that if you use metric units, the grams-per-day figure is sent. It is sent only if you have also given your weight. Version 1.0 also says that, under it, writing your brief is the only reason Apex sends your information to the AI model provider, and that Apex adds no name, email address or account ID to anything it sends there, including the name you typed to sign it. If you had an account before 6 October 2026, the second of these isn't so, and your information can also have reached that company outside your authorization: Apex's developer tools, from the same company, can read older records that can identify you and can hold your email address and that typed name, and before that date Apex put information about members, including account IDs, into that company's chat app (§6). Version 1.0 also says that while it isn't in force, and after you revoke it, Apex sends nothing about you to the AI model provider, and that the AI model provider keeps what Apex has sent under the terms in your authorization. If you had an account before that date, the developer tools can still read the older records at those times, and what they read, and the chats, are kept under the terms described in §6, which can differ from those in your authorization. For every account, Apex sends your information to the AI model provider only to write your brief, apart from what Apex's developer tools read or are given, what Apex put into that company's chat app before 6 October 2026, and, for the account of the person who runs Apex only, that account's own information (§6). Version 1.3 of the consent statement, and version 1.0 of the authorization, describe Apex as storing your WHOOP data and sending your WHOOP figures, and the previous day's brief, to the AI model provider. From 20 October 2026, Apex reads and stores new WHOOP data, and sends your WHOOP data, only while it uses your WHOOP data (§3), and otherwise sends the previous day's brief only if Apex recorded that it was written without your WHOOP data. Version 1.3 of the consent statement, and version 1.0 of the authorization, also describe Apex as keeping the complete unedited data WHOOP returns. From 20 October 2026, Apex doesn't add that data to what it stores when it reads your WHOOP data, and §3 says what happens to what it had already stored. Apex will ask you to sign a new authorization that describes this the next time it asks members to sign one. Apart from those points, your signed authorization and this policy describe what Apex sends the AI model provider to write your brief.

This policy describes the service providers Apex uses by what they do, not by name. WHOOP, the wearable service you choose and connect yourself, is named.

What they may do with it. Apex shares your information with a service provider only so that it can provide its service to Apex. What the provider may then do with it is set by the provider's own terms with Apex, which can change. As Apex read them in October 2026, the terms of three providers also let them use it for some purposes of their own: the database provider and the hosting provider (see their entries below) and the AI model provider (§5). The company that distributes the Apex iPhone app may also use what its app-testing service collects for purposes of its own (see its entry below). This policy doesn't describe the other providers' terms.

• An AI model provider writes your daily brief. What Apex sends it to write your brief, and what it may do with that, are in §5.
• Apex's developer tools, from the same company as the AI model provider. Apex uses them to build and run the app and the business behind it. They don't write your brief, and your authorization doesn't cover them.
  • Whatever these tools read, or Apex types into them, goes to that company, under the terms of the account Apex uses them through, which can differ from the terms in §5. Apex has turned off that company's option to train its AI on it, and that company keeps it for as long as that account's terms allow.
  • From 6 October 2026, Apex gives these tools nothing that identifies a member, apart from the older records below and the account of the person who runs Apex. Any script or database query Apex runs with them shows counts across all members only, or only the information of the account of the person who runs Apex. Apex doesn't use them to open any record made on or after that date that identifies a member, such as the log of a deletion, apart from that account's own information. The person who runs Apex also has an Apex account, and Apex may give these tools that account's own information, put it into that company's chat app and use it in Apex's marketing. This never covers information about any other member, wherever it appears. It also never covers the name typed to sign that account's authorization, or the summary of members' activity (§4), even the part about that account.
  • If you had an Apex account before that date, Apex's working records from before it can identify you, for example by a shortened form of your account ID or by a description that fits only you. They can also hold facts about you and your account, for example your time zone, the state you live in, your type of goal, whether a brief was written for you, and when you signed or agreed to something. They can hold your email address too, and the name you typed to sign version 1.0 of the authorization. Searches of them in October 2026 found no exact copy of the injury details, goal or equipment words, day notes or brief text they looked for, but they looked for only some of what members had entered, and only in some of the files that hold those records, so the records may still hold any of it. They found some numbers that are the same as readings or as figures members entered, and couldn't tell whether they are those values or the same numbers by chance, so the records may hold some of your readings or other figures about you. Readings are health information, and so are your height and weight. If the records hold any of your information, it went, or can go, to that company through these tools, outside any authorization.
  • Apex keeps those older records, and these tools can read them, whether or not your authorization is in force, and after your account is deleted.
• That company's chat app. Apex has used the chat app of the same company as the AI model provider for some of Apex's work, through the same account as Apex's developer tools. Your authorization doesn't cover it.
  • Some chats from before 6 October 2026 hold information about members, of these kinds: shortened account IDs and one full account ID; which state someone lives in; whether and when someone agreed to Apex's consent statement or signed an Apex authorization; whether a wearable was connected; goals; and injuries.
  • Information about injuries is health information. It went to that company through the chat app, outside any authorization.
  • If you had an Apex account before that date, those chats can hold your information of those kinds, including your goal and your injuries.
  • Apex still has those chats. They stay with that company, under that account's terms (see above), until Apex deletes them, and may stay for a time after that. Revoking your authorization or deleting your account doesn't delete them.
  • From 6 October 2026, Apex puts no information about members into that chat app, apart from the account of the person who runs Apex, and then only that account's own information, as described under Apex's developer tools above.
• A database provider stores Apex's database, which holds everything in §3 except your emails to Apex. Under its terms with Apex, as Apex read them in October 2026, it may use your information only to provide its services to Apex, apart from anonymized, aggregated statistics drawn from it. It can change its terms. It also keeps its own logs of requests to the database.
• A hosting provider runs the Apex website and app.
  • Everything you enter in the app or in the Apex iPhone app, apart from your sign-in and account details, and everything the app sends the AI model provider to write your brief, passes through the hosting provider's servers. The app puts your briefs together there and pulls your WHOOP data there. Your sign-in and account details, meaning what you type to sign in or sign up and the account settings the authentication provider shows you, go straight from your browser, or from the Apex iPhone app, to the authentication provider.
  • Under its terms with Apex, as Apex read them in October 2026, it may use your information to run and improve its services and to develop new ones. It also keeps logs of the app's activity. It treats them as its own data: it may keep them and use them for any business purpose, with no time limit stated. It can change its terms.
  • Apex's own log messages at the hosting provider use fixed codes and don't add your account ID. When an error isn't handled, the hosting provider's logs also get the error's own message, which can sometimes include details from the error itself. Log messages Apex wrote there before 7 October 2026 could carry your account ID, in full or in a shortened form, and the hosting provider keeps its logs under its own rules (see above). The hosting provider's own records of each request can also include the web address opened (which can include a date, such as the date of one of your briefs) and possibly your IP address.
  • If you use the Apex iPhone app, its requests to Apex pass through the hosting provider too, and the hosting provider's records of each request can include the address the app asked for (which can include a date, such as the date of one of your briefs) and possibly your IP address.
• An authentication provider runs sign-in.
  • It holds your email address and your sign-in details, such as your password, your sessions and any second sign-in step. It also holds your name, if you gave it when you signed up.
  • Apex regularly checks with it, by your account ID, that your account still exists and isn't blocked. Apex sends it none of your health information.
  • Its sign-in code loads on every Apex page except a few error pages. So it can receive your IP address and browser details when you visit, even if you never sign in. Once you have signed in, it can also receive the web address of a page you open (which can include a date, such as the date of one of your briefs).
  • If you use the Apex iPhone app, it signs you in through the authentication provider's code. That code contacts the authentication provider when you sign in and while you're signed in, and it can also do so each time you open the app, even if you're not signed in, so it can receive your IP address and details of your device and of the app.
  • It also sends Apex's invitation and sign-in emails.
• WHOOP, your wearable service, if you connect it. WHOOP can see that you connected Apex and when Apex reads your data. Apex sends WHOOP nothing about you beyond those requests and a request to withdraw its access: if you delete your account (§9), or at once if Apex can't keep a connection you have just made.
• An email provider hosts Apex's mailboxes. If you email Apex, your message is kept in that mailbox, not in Apex's database. Email you send Apex is not covered by your authorization.
• A domain and network provider manages Apex's domain name. To keep out bots, the authentication provider's sign-up form may also run a check from this provider in your browser, which can see your IP address and browser details. Accounts aren't created in the Apex iPhone app, and the app's own screens don't run this check. But if the app opens the authentication provider's own sign-in page for you to sign in, that page may run this check, which can see the same details.
• An uptime-monitoring service checks that Apex's scheduled jobs keep running: the job that writes briefs, and the job on the computer of the person who runs Apex that deletes the copies described in §8 and §9.
  • After each run of the brief job, Apex sends it counts, timings and fixed labels only: how many members the run covered, how many briefs it wrote, failed to write, put off or skipped and why, what Apex's checks with the authentication provider found, including how many accounts were stopped and how many stops couldn't be recorded, and, for accounts being deleted, for how many accounts wearable connections were due to be withdrawn, and for how many it tried, withdrew them, failed (and for how many of those the failure raises an alarm) or put it off, with a count of the connections withdrawn and whether that step itself failed; and, across all members, how many new wearable connections Apex could neither keep nor withdraw. Its alarms give counts, fixed labels and a fixed next step only. If a run fails outright, Apex sends it at most a fixed failure label, the error's code and the kind of error instead.
  • Once a day, and after any run that deletes a copy, Apex sends it the deletion job's run time, how many copies were due, deleted or failed, how many files it left in place, and whether that computer's backups skip the folder the copies are kept in. If the job fails or refuses to run, the message says so, with the exit code or the reason, which can name a folder, a file or a branch of Apex's code on that computer.
  • Apex doesn't send it an account ID, an email address, anything you entered or any of your readings.
• A code-hosting provider stores Apex's code and some of Apex's working records, including some of the older records described under Apex's developer tools above.
• The company that distributes the Apex iPhone app, if you use the app. You install the app through that company's app-testing service, which that company runs under its own privacy policy.
  • If Apex invites you to test the app, Apex gives that company the email address it invites you at, and no name.
  • While you test the app, that service collects reports of the app's crashes and information about your device and how you use the app, which can include your name and email address, and shares them with Apex. That company may also use them itself, under its own privacy policy. That company's privacy information for that service says testers can't opt out of this collection, so your iPhone's settings for sharing analytics with app developers may not stop it. Deleting the app from your iPhone ends new reports of its crashes and of how you use it, though reports collected before then may still reach Apex.
  • Apex has turned off that service's setting for testers to send Apex feedback and screenshots from inside the Apex iPhone app, because a screenshot of the app can show your health information. After a crash, that service may still offer to send Apex details of the crash with anything you add, which that company also receives, so please don't add screenshots or health information. That service's own app may still let testers email Apex. If you email Apex that way, please don't attach screenshots: Apex keeps your email, and the address you sent it from, like any other email you send it (§6). Apex gives that company none of your health information.
• The law. Apex may disclose information if the law requires it, for example under a court order.

How long it lasts. Your authorization lasts 12 months from the day you sign it, measured in Pacific time. From 30 days before it ends, Apex shows you a reminder in the app. It does not email you. To renew it, you sign a new authorization in the app. The app lets you sign an authorization only after you have agreed to the current consent statement.

How to revoke it. You can revoke it at any time:

• In the app, on the Authorization page (apextraining.app/authorization), which Training setup on your dashboard also links to, or on the Authorization screen of the Apex iPhone app. It takes effect the moment you confirm.
• By email to support@apextraining.app, the address on your signed authorization. Apex records an emailed revocation on the day it receives it. Until it is recorded, that day's brief may still be written.

What happens when you revoke.

• Revoking ends every Apex authorization you have signed that is still in force.
• Once your revocation is recorded, Apex starts no new brief and no new WHOOP pull for you, and sends nothing new to the AI model provider to write your brief. Revoking doesn't stop Apex's developer tools reading the older records described in §6. A brief or a WHOOP pull already running may finish, which takes at most 5 minutes.
• Before you sign, and once a revocation is recorded, the app doesn't let you finish setting up Apex, log by hand, change your goal or where you train, or connect WHOOP.
• Revoking can't recall what Apex has already sent, including the chats described in §6. The AI model provider keeps what Apex sent to write your briefs under its terms (§5).
• Revoking doesn't delete your account or what the database provider stores. To delete them, see §9.
• Revoking doesn't delete the optional usage record (§3), and may not stop it. To stop it and delete it, see §3.
• You can sign a new authorization later to start again.

To make any request, email privacy@apextraining.app (or support@apextraining.app) from the address you sign in with, so Apex can match it to your account. Apex has no buttons for these requests yet, so the person who runs Apex handles each one by hand. Apex will reply within 30 days. To revoke your authorization, see §7.

A copy of your data. Apex prepares a file of everything its database holds under your account, except the keys that connect WHOOP, and sends it to you. It includes your typed name and the IP addresses on your consent records. Apex keeps its own copy of that file on the computer of the person who runs Apex for about 30 days, then deletes it.

Your signed authorization. You can download it from the Authorization page, or save or share it from the Authorization screen of the Apex iPhone app, at any time you can sign in to Apex.

Corrections.

• While your authorization is in force, you can change your goal and where you train in the app, and correct a day's log by logging that day again.
• Your time zone updates when you open Apex on a device set to a new one.
• Apex has no page for changing your height, weight, units or injuries after setup. To correct them, or anything else, email privacy@apextraining.app.

Email privacy@apextraining.app (or support@apextraining.app) and ask for your account to be deleted. There's no delete button yet.

Your signed authorization is deleted too. Download it from the Authorization page, or save it from the Authorization screen of the Apex iPhone app, before you ask. If you ask in the same email, Apex will send you a copy of your data (§8), which includes the record of your signature, before deleting.

The person who runs Apex:

1. Blocks your sign-in and stops all work on your account, apart from withdrawing Apex's access to WHOOP (step 2). From then on, Apex writes no brief, pulls nothing from WHOOP and sends nothing about you to the AI model provider to write a brief. Apex's developer tools can still read the older records described in §6. Anything already running may finish, within 5 minutes.
2. If you connected WHOOP, has Apex ask WHOOP to withdraw Apex's access. Apex sends the request from the first run of Apex's scheduled job after the person who runs Apex asks for the withdrawal, once work on your account has been stopped for at least 10 minutes, and when WHOOP accepts it, Apex deletes the keys that connect your WHOOP account. If the request fails, your account stays stopped, the deletion waits, and Apex tries again about every 15 minutes. After 3 failures in a row, about 45 minutes, the person who runs Apex may go ahead with the deletion anyway. The keys are then deleted with your account, so Apex can no longer read your WHOOP data, and Apex makes no further request to WHOOP. WHOOP may still show Apex as connected, so Apex tells you once, by email if Apex can reach you, to remove Apex in your WHOOP account yourself. If Apex can't reach you, the deletion still goes ahead. As part of deleting your account, Apex does the same if a WHOOP connection you started was never kept and Apex couldn't withdraw the access WHOOP had given, unless Apex couldn't record that connection under your account.
3. Deletes what Apex's database holds about you, including your signed authorization, apart from the records listed under "What Apex keeps after a deletion, on purpose" below.
4. Deletes your sign-in account at the authentication provider.

A deletion can't be undone.

Copies kept for about 30 days.

• Before deleting, the person who runs Apex makes a copy of everything Apex's database holds under your account, without your WHOOP keys, in case the deletion goes wrong.
• A copy is made just before deleting, and usually another in a trial run first.
• They are kept on the computer of the person who runs Apex, in a folder only that person's computer account can open.
• Apex keeps each copy for about 30 days, then deletes it.
• After a copy is deleted, including the copy in §8, it may still exist for a day or more in any automatic snapshots that computer keeps of its disk, until the computer removes them.
• Those 30 days apply only to these copies. They do not apply to anything under "What a deletion can't reach" below.

What Apex keeps after a deletion, on purpose

• A record that your account was deleted. It holds:
  • your account ID;
  • when your account was deleted;
  • when work on your account stopped;
  • how many records were deleted from each part of Apex's database;
  • what Apex recorded about its requests to WHOOP to withdraw access and, if your account was deleted before a withdrawal succeeded, counts of the WHOOP connections Apex still held keys for and of the tries that had failed. If a WHOOP connection you started couldn't be kept and Apex couldn't withdraw it, it also holds what Apex recorded about that under your account: how many such records there were, why each wasn't kept, and the results Apex recorded;
  • where the copy made just before deleting is kept, and the date it is due to be deleted.

  Apart from how many records of each kind were deleted, it contains none of your health information. It stops Apex from ever again writing a brief, pulling WHOOP data or sending anything to the AI model provider to write a brief, for that account. It has no set deletion date.

• Logs of the deletion, on the same computer. The deletion log holds the start of your account ID, counts and results, and nothing you entered and none of your readings. The record of the job that deletes the copies holds no part of your account ID, except in lines written on 4 October 2026, which may hold its start. Neither is deleted with the copies, and neither has a set deletion date.
• Notes of refused or failed attempts. If something tried to write a brief for your account after it was stopped, Apex may keep a note of the refusal, which doesn't carry your account ID. If a WHOOP connection you started couldn't be kept and Apex couldn't withdraw it, any note of that which Apex filed without naming anyone is kept too.
• Emails you sent Apex, in its mailbox (§6). They have no set deletion date.
• Older working records and chats, if you had an account before 6 October 2026: the records and the chats described in §6. They have no set deletion date.
• Copies of the weekly summary (§4), if any are kept on the computer of the person who runs Apex. They can identify you and show counts and dates, and none of your readings and nothing you entered.

What a deletion can't reach. These follow their own rules, not the 30 days above:

• Apex's database backups and the database provider's logs, until they expire.
• What was already sent to the AI model provider (§5), read by Apex's developer tools, or put into that company's chat app (§6).
• The hosting provider's logs (§6).
• What the authentication provider keeps after your sign-in account is deleted.
• Your data at WHOOP itself. You can also remove Apex from your WHOOP account yourself at any time.

Apex keeps your information until your account is deleted. If you stop the optional usage record, Apex deletes it then (§3). On 19 October 2026, Apex deleted from its database the unedited data WHOOP returned that it had stored (§3).

Some things are replaced as you go:

• a new goal you set on the Goal page replaces the old one, though the old one is normally kept in the records of goal changes;
• changing where you train, your equipment note or your time zone replaces the old one, though if you agreed to the optional usage record, Apex keeps a note that you changed where you train or your equipment note, without the old or new choice or words (§3);
• logging a day again replaces that day's entry, though an unusual sleep figure you confirmed stays in Apex's records;
• each WHOOP pull replaces that day's WHOOP figures.

The copy made when you ask for your data is separate: Apex keeps it for about 30 days, then deletes it (§8). Each brief keeps its snapshot as it was. For what happens after a deletion, see §9.

Cookies and storage. Apex's own code sets one kind of cookie, a short-lived one, which carries a one-time message to the page you land on, such as the result of trying to connect WHOOP or the date of a log you have just saved. It holds no account ID, name or email address, and none of your readings. Your browser sends it only to Apex's own site, and it is deleted after a short time. The authentication provider sets the cookies that keep you signed in, under Apex's web address. Once you're signed in, Apex keeps the name of your time zone in that browser tab until you close it, so it isn't sent again on every page.

Tracking. Apex puts no outside advertising, analytics or session-recording tools in its website or in the Apex iPhone app, and none of its own code follows you across other websites. If you agree to the optional usage record (§3), Apex's own code records some of your use of Apex's own pages, as §3 describes; it sets no cookie and uses none of your browser's storage for this. The website's fonts and photos are served from Apex's own site. Outside code runs on Apex's pages in two places:

• the authentication provider's sign-in code, on every page except a few error pages;
• at sign-up, and on the authentication provider's own sign-in page, possibly a bot check from the domain and network provider.

They can receive your IP address and browser details in order to provide sign-in and bot protection. Apex doesn't know whether they use them to collect information about your activity over time and across other websites. Apex doesn't ask them to and receives none of it. Their own privacy policies say what they do.

Do Not Track. Apex's own code doesn't track you across other websites, so Apex changes nothing when your browser sends a Do Not Track or Global Privacy Control signal. Those signals may not change what the authentication provider or the domain and network provider do (see Tracking above).

On your iPhone. If you use the Apex iPhone app:

• The app keeps the key that keeps you signed in in your iPhone's secure storage, set so that it stays on that iPhone and isn't moved to another device by a backup. The app deletes it when you sign out or your account has been deleted and, because that storage can outlast the app, the first time you open the app after installing it.
• The app doesn't store your health information or your briefs on your iPhone. It holds them only in its memory while it runs, and hides its screen when you switch between apps. When you save or share your signed authorization, the app makes temporary files of it on your iPhone to do that, and deletes them afterwards. A copy you save or send goes wherever you choose.
• The app's fonts and images are built into it.
• The app contains no advertising, analytics or crash-reporting code, and nothing that follows you across other apps or websites. While you test the app, the company that distributes it collects reports of its crashes and information about your device and how you use it (§6).

Apex is for adults, 18 or older. It is invite-only, and invitations go only to adults the person who runs Apex knows. When you agree to the consent statement, you confirm that you are 18 or older. Apex doesn't ask for your age or date of birth, and doesn't check whether your confirmation is true. If Apex learns that someone under 18 has an account, it will stop all work on that account and delete it as described in §9.

• Apex's database lets each signed-in member reach only their own records.
• The keys that connect WHOOP are encrypted before they are stored.

No system is completely secure, and Apex can't promise that your information will never be accessed without permission. If your health information is disclosed without your authorization, Apex will tell you. Health information has already been disclosed that way: before 6 October 2026, Apex put information about injuries into the chat app of the AI model provider's company (§6). Some members' readings may also have reached that company that way, through Apex's developer tools (§6).

When Apex changes this policy, it will post the new version here with a new effective date. If a change is material (for example a new kind of information, a new company receiving it, or a new use), Apex will tell you before it takes effect, by email to the address you sign in with. Because this policy describes companies by what they do, Apex will also tell you in the same way before a new company starts receiving your information, even if this policy's wording doesn't change. If a change alters who receives your health information or what they receive, Apex will ask you to sign a new authorization.

Apex: privacy@apextraining.app.

To revoke your authorization by email, write to support@apextraining.app (§7).