Baseiron Privacy Policy

Effective October 13, 2026 · Last updated October 13, 2026

1. Who we are

Baseiron (“the app”) is published by Summit Lane Studios LLC, a Hawaii limited liability company (“Summit Lane Studios”, “we”, “us”). We are the controller of personal data processed through the app and its website pages. This policy explains what we collect, why, who we share it with, and the choices you have. It applies to the Baseiron mobile apps, web app and the pages for Baseiron at summitlanestudios.com.

Summit Lane Studios LLC
4754 E Ekahi Way, Unit D
Ewa Beach, HI 96706, USA
[email protected]

2. Information we collect

We collect only what Baseiron needs. We do not collect location, contacts, photos or advertising IDs, and we do not track you across other companies' apps or websites.

Account information: email address, name and user ID, through Clerk, our sign-in provider.
Profile and body data you enter (health information): sex, height, body weight, limb lengths and body measurements.
Training data (health and fitness information): workouts (exercises, sets, reps, weight), cardio sessions, progression and one-rep-max (1RM) entries.
Purchase information: whether you hold an active subscription or lifetime purchase, via RevenueCat and the Apple App Store or Google Play. We never receive card details.
Usage data: aggregate, cookieless page-view statistics about our websites and web app from Cloudflare Web Analytics (such as pages viewed, referrer, browser and country), and in-app activity such as last-seen date and time active, used to run and improve the service.
Device and technical data: our hosting provider automatically processes standard request data (such as IP address, browser and device type, and time of request) for delivery and security.

Health and body data is optional. You choose what to enter, and you can edit or delete it at any time.

3. How we use information

To create and secure your account and sign you in.
To provide the app: save and sync your data across your devices, and run the features you choose.
To process and verify purchases and subscriptions and restore them on new devices.
To keep the service secure, prevent abuse and fix problems.
To answer support requests and send service messages (for example about your account, purchases or changes to this policy).
To comply with law and enforce our terms.

We do not use your data for advertising, and we do not send marketing emails. If we ever do, we will ask first where required and every marketing email will include a working unsubscribe link, our postal address and accurate sender information, as the CAN-SPAM Act requires.

4. Legal bases (EEA/UK users)

Under the GDPR and UK GDPR we rely on: performance of a contract (providing the app and your purchases); legitimate interests (security, fraud prevention, fixing errors and improving reliability, in ways that do not override your rights); consent (optional features you switch on, and the health and body data you choose to enter, which is special-category data processed on the basis of your explicit consent), which you can withdraw at any time; and legal obligation (for example tax records for purchases).

6. Cookies and similar technologies

Baseiron uses your device's local storage, and session cookies set by Clerk, to keep you signed in, save your data and preferences, and work offline. These are strictly necessary. Cloudflare Web Analytics is cookieless and does not fingerprint or track you across sites. We set no advertising cookies.

7. Do Not Track and Global Privacy Control

Because we do not sell or share personal data or track you across other companies' sites and apps, there is nothing for a Do Not Track signal to switch off. We honor Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing for the browser or device that sends them.

8. Retention

We keep your account data for as long as your account is active. When you delete your account, we delete or de-identify your personal data from our live systems within 30 days, and remaining copies in backups are overwritten within a further 90 days. We may keep limited records longer where the law requires (for example purchase and tax records, generally up to 7 years), to resolve disputes, or to enforce our terms. Purchase records held by Apple, Google and RevenueCat are kept under their own policies.

9. Security

Data is encrypted in transit (HTTPS/TLS) and stored with providers that encrypt data at rest. Access rules limit who can read your data, and we limit our own access to what is needed to run and support the service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities as the law requires.

10. International transfers

We are based in the United States, and our providers process data in the United States and other countries. If you use the app from outside the US, your data will be transferred to and processed in the US, where laws may differ from yours. For transfers from the EEA, UK or Switzerland we rely on our providers' safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework where the provider is certified.

11. Children

Baseiron is not directed to children under 13, and we do not knowingly collect personal information from children under 13, in line with COPPA. Users under 18 need a parent or guardian's permission to use Baseiron and to make purchases. If we learn that we have collected personal information from a child under 13, we will delete it promptly. Parents can contact [email protected] to request deletion.

12. Your privacy rights

Depending on where you live, you may have the right to: access or know the personal data we hold about you; correct it; delete it; receive a portable copy; object to or restrict certain processing; withdraw consent at any time (without affecting earlier processing); and opt out of the sale or sharing of personal data, targeted advertising and profiling. We do not sell or share personal data, run targeted ads, or make decisions with legal or similarly significant effects by automated means.

United States residents

Residents of California (CCPA as amended by the CPRA) and other states with consumer privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, have the rights above as their state law provides. In the last 12 months we have collected the categories of personal information listed in section 2 (identifiers, account and commercial (purchase) information, internet or other electronic activity information, and user content, and sensitive personal information about health that you choose to enter) from you and your device, for the business purposes in section 3. We disclose them only to the service providers in section 5. We have not sold or shared (for cross-context behavioral advertising) personal information, and we have no actual knowledge of selling or sharing data of consumers under 16. We use sensitive personal information only to provide the features you ask for, as permitted under CPRA regulations, so a right to limit does not apply. Where a state law requires consent to process health data, entering that data and syncing it is your consent, and you can withdraw it by deleting the data or your account.

We will not discriminate against you for exercising your rights. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity. We verify requests by matching them to the email address on your account. If we deny a request, you may appeal by replying to our decision with the subject “Privacy appeal”; we will respond within the time your state law requires (generally 45 to 60 days). If your appeal is denied you may contact your state Attorney General.

EEA, UK and Swiss residents

You have the rights in the GDPR and UK GDPR described above. You may also lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We respond to requests within one month, extendable as the law permits.

How to exercise your rights

Email [email protected] with the subject “Privacy request”, or use the in-app tools (deletion, and export where available). We respond within the time required by applicable law: generally 45 days in the US and one month in the EEA/UK.

13. How to delete your account and data

In the app go to Settings → Account → Delete account and confirm. You can also follow the steps on our account deletion page or email [email protected] from the address on your account with the subject “Baseiron account deletion”. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store account settings.

14. Health disclaimer

Baseiron is a training log and is not a medical service or medical device. It does not diagnose, treat or prevent any condition and does not give medical advice. Estimates such as 1RM, torque and readiness are informational only. Consult a qualified health professional before starting or changing an exercise program. Baseiron is not covered by HIPAA, but we protect your health data as described in this policy, and we comply with applicable consumer health data laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, where they apply.

15. Changes to this policy

We may update this policy. We will post the new version here and change the “Last updated” date. If changes are material, we will tell you in the app or by email before they take effect and, where the law requires, ask for your consent.

16. Contact us

For questions, requests or complaints about privacy: