Test program
Privacy & data notice
Last updated: July 1, 2026 · Applies to the invite-only test program
Tolfi is in an invite-only test phase. This notice explains, plainly, what data the app collects and how the training-data sharing that test-group membership requires actually works. A complete, formal privacy policy will be published at public launch; until then, this is the document we hold ourselves to.
What the app collects to work
Tolfi is a training engine. To do its job it stores the data you'd expect: your account (Sign in with Apple), profile and preferences, workouts and sets, nutrition logs, recovery and readiness inputs, and — with your HealthKit permission — health metrics like heart rate. This data lives under your account and is used to run your coaching. It is not sold, and it is not shared with advertisers.
De-identified training data (the test-group part)
Tolfi's intelligence improves by learning from real training. Test-group members agree to share training data for this purpose. When sharing is on, we retain de-identified training data, specifically:
- motion signals captured during your sets, and
- body-scan geometry and measurements (for example, depth/geometry data and the derived measurement values).
This training data is stripped of information that identifies you before it is retained. In particular, it does not include your name, is not linked to your account, does not include a device identifier, and does not include precise timestamps (only a coarse month-bucket). Your body-scan photos are never included in this training data.
Because this data is not stored under your name or account, it is de-identified — not retrievable or deletable by us on a per-person basis once it has been contributed. We deliberately say “de-identified” rather than “anonymous”: some of this data (such as body geometry) is inherently characteristic of a body, so we do not claim it can never be matched. What we do is remove the link to your identity and account, and we do not keep a reverse-map back to you.
Body-scan photos, specifically
The body scanner takes photos and depth captures to measure you. Three things are true about those photos, in order:
- By default, photos stay on your phone. The scan is measured on-device and photos are not uploaded. This is the out-of-the-box behavior.
- Cloud photo storage is a separate, optional choice (off by default). If you turn it on in the app, your scan photos are stored securely — encrypted, faces blurred on upload — so you can compare progress across check-ins and re-analyze past scans. It's for your own history, nothing else, and you can turn it off. If you want stored photos deleted, email us and we'll do it.
- Photos are never part of the training data. Even if you store photos in the cloud and share training data, the de-identified corpus described above receives depth geometry and numeric measurements only — never photographs.
Retention after you leave
De-identified training data contributed while sharing was on is retained even after you delete your account. Because it carries no link to you, we cannot single it out to remove it. Turning sharing off stops future contributions but does not remove data already contributed.
Your choices
- Test-group membership requires training-data sharing. If you'd rather not share, you can still apply — we'll simply notify you at public launch instead.
- You can turn sharing off at any time in the app's Settings.
- You can delete your account (and the data stored under it) from the app.
- HealthKit access is governed by iOS permissions you control, and health data is only uploaded to Tolfi's servers with a separate in-app consent.
Questions
This is a small test program and we read everything — reach us at hello@tolfi.app with any question about your data, and we'll answer directly.