Privacy Policy

Last updated: 2026-11-06

The short version: RawLift stores what you enter so the app can work for you — in a database that belongs to your account alone. We do not sell your data, we do not share it for advertising, and we do not use analytics or tracking tools. You can export or delete everything from Settings at any time.

1. Who we are

RawLift is operated by ELVISION LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801 (“we”, “us”). Questions or requests: [privacy@rawlift.app].

Information about bodyweight, nutrition, training and the medications or supplements you log is consumer health data. How we collect, use and share it is described in detail in our Consumer Health Data Privacy Policy, which is part of this policy.

2. Information we collect

Account information: email address and password (stored only as a bcrypt hash), sign-up and last sign-in time, and the policy versions and time of your consents.
Waitlist: if you join the waitlist, your email address, when you joined and confirmed it, your consent to waitlist emails (time and wording version), your invite code, and who invited you (so referral rewards can be credited). The person who invited you sees only how many of their invitees joined, never who.
Content you enter: workouts, exercises, sets, weights and notes; food diary entries, products and nutrition targets; bodyweight; medication, peptide and supplement logs (compounds, doses, times, injection sites, pain levels, side effects); optional profile data (name, sex, birth year, height, activity level, preferred units).
Device and technical information: when you use the service, our server processes your IP address, browser type and the pages requested. IP addresses are held briefly in memory to stop abuse (for example, limiting sign-in attempts) and are not stored in our databases. For each signed-in session we keep the browser’s user-agent string so you can recognize your devices. We count visits to the homepage as a plain number per day (and whether they came from an invite link), without storing who visited.
Camera: the barcode scanner uses your camera only while it is open. Images are processed on your device and are never uploaded.
Background photo (optional): if you choose your own photo as the app background, we store a downsized copy (location and other metadata removed) with your account until you remove it or delete your account. It is shown only to you.

We do not collect precise location, contacts or payment card data, and no photos other than a background you choose.

3. How we use information

to provide the service: store your logs, show trends, suggest targets and training weights;
to secure the service, prevent fraud and abuse, and fix problems;
to communicate with you about your account (for example, password reset emails);
with your consent, to email you about the launch, your early-access invite and product news. Every such email has an unsubscribe link;
to comply with law and enforce our Terms of Service.

We do not use your information for targeted advertising, we do not build marketing profiles, and we do not use your content to train AI models.

4. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose information only:

to service providers that process it on our behalf under contract — hosting ([Hosting provider and server location]) and transactional email ([email provider]);
to Open Food Facts, when you search for or scan a product that is not in your own list: our server sends only the barcode or search term — never your account, IP address or health data;
if required by law, subpoena or court order, or to protect rights, property or safety;
in a merger, acquisition or sale of assets, subject to this policy, with notice to you.

5. Cookies and similar technologies

We use only strictly necessary cookies: a session cookie that keeps you signed in (up to 90 days), a cookie that remembers your color theme, a cookie with your time zone (so “today” is your day), and, when you open someone’s invite link, a cookie that remembers their invite code for 30 days so the referral can be credited. A service worker caches the app’s code in your browser so it loads faster. There are no advertising, analytics or third-party cookies. Because we do not track you across sites, “Do Not Track” and Global Privacy Control signals do not change anything — we already treat every visitor as opted out.

6. Retention

We keep your information while your account exists. When you delete your account, your account and your entire database are deleted immediately; copies in encrypted backups are overwritten within [30] days. Password reset links expire after one hour; sign-in sessions expire after 90 days without use. Waitlist entries are kept until launch and then for as long as an unredeemed reward is open, at most [12] months; you can ask us to delete yours at any time.

7. Security

All traffic is encrypted with TLS. Passwords are hashed with bcrypt. Each account’s data is kept in its own separate database. No method of transmission or storage is perfectly secure, but if a breach affecting your health data occurs we will notify you and the authorities as required by law, including the FTC Health Breach Notification Rule.

8. Your choices and rights

Everyone, wherever they live, can:

access and export their data (Settings → Export my data, as JSON);
correct it (most data can be edited directly in the app);
delete their account and all data (Settings → Delete account);
withdraw consent to processing of health data by deleting the account.

California residents (CCPA/CPRA) have the right to know what personal information we collect, use and disclose; to delete and correct it; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only to provide the service you request); and not to be discriminated against for exercising these rights. In the last 12 months we collected the categories listed in section 2, from you and your device, for the purposes in section 3, and disclosed them only to the recipients in section 4. We have not sold or shared personal information, including of consumers under 16.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have similar rights, including the right to appeal a decision on a request. Residents of Washington, Nevada and Connecticut have additional rights for consumer health data, described in our Consumer Health Data Privacy Policy.

To make a request, use the in-app tools or email [privacy@rawlift.app] from the address on your account. We respond within 45 days. You may use an authorized agent; we may ask for proof of authorization. To appeal a decision, reply to our response with “Appeal” in the subject line; if we deny your appeal you may contact your state attorney general.

9. Children

RawLift is not directed to children under 13, and we do not knowingly collect personal information from them. Users under 18 need permission from a parent or guardian. If you believe a child under 13 has created an account, contact us and we will delete it.

10. Users outside the United States

RawLift is intended for users in the United States. If you use it from elsewhere, your information is processed where our servers and service providers are located.

11. Changes

If we make material changes, we will update the date above and notify you in the app or by email before they take effect. We will not use previously collected health data in a materially new way without your consent.