Privacy Policy

Last updated: October 20, 2026

BellSense (“we,” “our,” or “us”) operates the BellSense iPhone app (the “App”) and the bellsense.app website. This policy says what leaves your phone when you use the App, who receives it, how to stop it, and how to delete it.

The short version

  • Your account and training record are stored in Google’s Firebase, under your account.
  • The camera counts reps on your phone. No video, image or body-pose point is uploaded.
  • The microphone: your phone turns your speech into text. No audio is recorded or uploaded.
  • The AI coach’s generated words come from Anthropic’s Claude models, through our server. With your consent, words you type or say to the coach are sent to Anthropic, along with your workout notes and a summary of your training. The consent screen you see at sign-up includes that consent in its one “I agree”.
  • The coach’s voice is made by ElevenLabs from the coach’s own sentence, never from your voice.
  • Apple Health: your sleep, heart-rate variability and resting heart rate readings stay on your phone, and only the readiness scores made from them sync. Workouts you import from Apple Health sync to your account with their heart-rate data.
  • Groups: members of a group you join can see your workouts, including heart rate, your notes and the coach’s written debrief.
  • Sensor recordings: if you train with the BellSense sensor, its motion recordings are uploaded by default so we can improve rep counting. You can turn this off.
  • Email: creating an account adds you to our Training Notes email list. You can unsubscribe in any email.
  • Analytics and crash reports go to Google, tied to your account id. The App does not use an advertising identifier.
  • Deleting your account in Settings removes your training record. A few records are kept, and section 15 lists them.

Every company that receives your data is in section 12, and the choices you have are in section 14.

1. Your account

You sign in with Apple, with Google, or with an email address and password. Google’s Firebase Authentication runs the sign-in, and Apple or Google take part when you choose their button.

We keep your email address, your display name, how you sign in, when you created the account and when you last signed in. With Sign in with Apple, the App asks Apple for your name and email, and Apple may give us a relay address instead of your own. If you use a password, Firebase keeps it hashed.

Your profile holds the following. You enter most of it during setup or in Settings → Personal Info, and the App records the rest.

  • your training setup: weight unit, goal, your goal in your own words, experience, days per week, bodyweight, age, a maximum heart rate if you set one, the bells you own and whether you have a barbell;
  • a location and a bio, if you write them;
  • your answer to how you heard about BellSense;
  • your plan, whether you own a BellSense sensor, how far you got through setup, and your current group.

A profile photo is optional. It is stored in Firebase Storage, where any signed-in BellSense user can open it, and its web link opens for anyone who has the link. The link is copied onto each of your workouts.

When you agree on the consent screen, we save which version of the safety acknowledgment you accepted and when, and the date you consented to AI coaching. We also save the date you answered the training-data question.

2. Your training record

Your training record is stored in Google’s Firestore, under your account. It holds:

  • Each workout: date and time, duration, exercises, bell weights, sets and reps, scores, your feel rating and effort, any rep counts you corrected, and the program and day.
  • Your notes: on the results screen of a sensor or camera workout, the “Any unusual reps?” tags and anything you type under “Add a note…”. A note is optional. The note you type is sent to the AI coach (section 5). You can also type a note under “Add a note…” on a program’s conditioning block. That note is saved with the day’s program results, and it is not sent to the AI coach.
  • Per-rep detail from the sensor or the camera, and a heart-rate series when a heart-rate strap or an Apple Health import supplied one.
  • The coach’s written debrief of the workout, and a coach summary saved with it that includes your goal in your words and what you have told the coach.
  • Your display name and photo link, copied onto each workout.
  • Your training state: baselines, fatigue profiles, personal records, program progress and results, progression decisions, load suggestions, custom workouts and cardio plans, and exercises you name yourself.
  • What you tell the coach: movements to keep out because something hurts, the bells on hand, the time you have, days away, a skipped day and your goal. You can clear one of these, and the record keeps it, marked cleared.
  • Check-ins: the daily readiness check-in (overall, energy, soreness and sleep quality, each from 1 to 5) and the quarterly check-in (whether you have pain or an injury, which body areas, notes about the pain, a satisfaction score, and what is and is not working). Answering is optional. Both prompts are on by default, and each has a switch in Settings.
  • A heart-rate strap, if you pair one: the heart-rate series during a workout, its average, maximum and minimum, and the drift, recovery and training-load numbers worked out from it.

You can delete a workout in History.

3. The camera and the microphone

The camera

The camera counts reps on your phone, using Apple’s Vision framework to find your body. No video, frame, image or body-pose point leaves your phone.

What syncs is a few numbers per rep, saved in the workout: timing, how far your joint angles traveled, and a quality grade. When the camera runs alongside the BellSense sensor, a timeline of the reps the camera saw syncs too.

The Set Analyzer reads a video you pick from your photo library, on your phone. Its result syncs only if you add it to your history.

The camera needs the iOS camera permission, and it runs only in a workout session you open.

The microphone

When you talk to the coach, your phone turns your speech into text. The App requires Apple’s on-device speech recognition, so your speech is not sent to Apple’s servers. On a phone that cannot recognize speech on the device, the microphone button does not appear. No audio is recorded or uploaded.

The text appears in a field you can edit, and it leaves your phone only when you send it (section 5). The App asks for the microphone and speech-recognition permissions the first time you tap the microphone. You can always type instead.

4. Apple Health

Connecting Apple Health is optional. You allow it on Apple’s Health permission sheet, and you can change that at any time in iOS Settings → Privacy & Security → Health → BellSense. The App never writes to Apple Health.

Readiness

The App reads your heart-rate variability, resting heart rate and last night’s sleep on your phone to score your readiness. These readings are not uploaded. What syncs is the readiness score, its band and its sub-scores, which are scaled values, not your readings.

The permission sheet also lists VO2 max and body mass. The App does not read either.

Imported workouts

The App can also import workouts recorded in Apple Health, such as a run or a ride. Each one becomes a workout in your training record and syncs like any other. It carries the start and end time, the activity type, the distance and Apple Health’s id for the workout. It also carries a per-second heart-rate series built from Apple Health’s heart-rate samples, the average, maximum and minimum heart rate, and a training-load score.

So heart-rate data from Apple Health does leave your phone when a workout is imported. The same Health permission covers it.

We do not use Apple Health data for advertising or marketing, and we do not sell it.

5. The AI coach

The AI coach’s generated text comes from Anthropic’s Claude models. Our server makes every request, and the App never contacts Anthropic itself. No request carries your account id.

Your consent

AI coaching needs your consent. Since September 18, 2026, the consent screen, shown when you create an account and again when its text changes, includes AI consent in its one “I agree”, which also accepts the risks and agrees to the Terms of Service and this policy. If your account already held AI consent, it keeps its original date. You can also give consent later in the App, in Settings → Coaching → AI Coach.

You can withdraw it in the same place. Every AI request needs it, so once you withdraw it, no new requests are made.

The consent applies to free accounts too. With it, a free account can get a spoken reply from the coach during setup, and may get a few written debriefs and analyses. The rest of the AI coach needs Live access: BellSense+ Live, a Live window that is still open, or complimentary access from us.

Written coaching

The session debrief, the weekly and monthly reviews, the on-demand analysis, the daily greeting, the Live morning brief and the Live window’s day-12 receipt are written from a summary of your synced record. The summary holds:

  • exercises, reps, bell weights, scores, your feel ratings and effort, your program position and recent workouts;
  • your readiness score and band, never your Apple Health readings;
  • heart-rate summaries (drift, recovery trend, training load and weekly minutes in each zone), never the per-second series;
  • your experience, days per week and bells, and what you have told the coach that still applies, such as lifts kept out and days away;
  • your goal in your own words, with every digit replaced by “(number)”;
  • your workout notes, as you typed them, numbers included, up to 512 characters (a longer note is left out).

The summary does not include your name, email or account id, and it gives dates only as a number of days ago. We store the text the coach writes, and a monthly count of your AI use.

Asking the coach about a report (Converse)

Each message you type is sent word for word, up to 1,000 characters. With it go the thread’s earlier messages, the report you are asking about, and what the coach looks up in your own record to answer: your workouts with their notes, your program, your profile and goal, readiness, records, past coaching, and what you have told the coach.

We store every message and the whole thread. You cannot delete a single message or thread yourself, and deleting your account removes them. Converse needs Live access.

The coach conversation

When you use the coach conversation with Live access, what you say (turned into text on your phone) or type is sent, cut to 280 characters. With it go today’s movement names, the bells on hand, the session lengths the App can set, your weight unit and the kind of day.

Your words are written to a request record under your account, and our server deletes them from that record when it takes up, refuses or answers the request. We keep the answer, which is a list of changes to make in the App. Our server logs count these requests and record a category, never your words.

The coach then speaks one line about what changed. To write it, our server sends Anthropic the facts of the change: movements kept out, minutes, bell sizes, the session’s name and main lift, the shape of the program day, a skipped day, days away and target days, with your goal, every digit replaced. The request record keeps those facts, your goal words, the line and where its audio is stored, under your account until you delete the account.

When you use the coach conversation without Live access, it uses recorded clips and buttons you tap, and sends none of your words.

The coach’s reply during setup

During setup you can add a note to your goal, typed or spoken, up to 280 characters. If you do, and you have given AI consent, the coach writes a two-sentence reply, once. Anthropic receives your goal choice together with the note you added, and your experience answer, each with every digit replaced, and how many bells you have.

We store a request record under your account with your goal choice and note, your experience answer, the number of bells, whether you have a sensor and the program name, along with the reply and its audio. You cannot delete these yourself, and deleting your account removes them.

The coach’s voice (ElevenLabs)

The coach’s generated lines that you hear are voiced by ElevenLabs. ElevenLabs receives the coach’s sentence and the voice settings, never your voice. Because the sentence answers you, it may restate your goal. The request carries no account id.

The audio is stored in Firebase Storage, where only your account can play it, and it is deleted with your account.

In short

No request to Anthropic or ElevenLabs carries your account id. Your goal words reach Anthropic with every digit replaced in written coaching and the setup reply, and in the spoken line when you use the coach conversation. Your Converse messages and your workout notes reach Anthropic as you wrote them, numbers included. When you use the coach conversation, our server deletes your words from its record once it has handled the request. No audio of you is recorded.

6. Sensor recordings (Contribute Training Data)

If you train with the BellSense sensor, the App uploads a compressed recording of the sensor’s raw motion (accelerometer and gyroscope) from each sensor workout to Firebase Storage, filed under your account id. Workouts without the sensor produce no recording.

This is on by default. Turn it off in Settings → Personal Info → Contribute Training Data. Turning it off stops future uploads. It does not delete recordings already uploaded. Deleting your account does, and you can ask us to delete them sooner at support@bellsense.app.

We use recordings that carry a rep count you confirmed to test and improve rep detection. They are labeled with the first 8 characters of your account id, never your email.

If you discard a sensor workout while this is on, we keep its recording and its full workout record, including heart rate and notes, marked as discarded.

7. Friends and groups

You join a group with its invite code. Members of a group you join see your display name, your profile photo, your member profile, your place on the leaderboard and your workouts in the group feed.

The feed loads each workout’s whole record onto the member’s phone. That includes the exercises, weights, reps and scores, your feel ratings and effort, any heart-rate series, workouts imported from Apple Health, your workout notes, the coach’s written debrief, and the coach summary saved with it, which holds your goal in your words and the lifts you have asked to keep out.

A note on a program’s conditioning block is saved with your program results, not with the workout, so the feed does not load it.

A group’s record holds its name and emoji, its invite code, and each member’s account id and display name.

If you leave a group, its members stop seeing your workouts.

If you never join a group, other BellSense users cannot see your workouts.

Deleting your account does not remove your account id and display name from a group’s record.

8. Email

We send email through Loops. Creating an account adds your email address to our Training Notes list, and you can unsubscribe in any email.

At sign-up, Loops receives your email address, your account id, that you signed up from the App and that you have not trained yet. It does not receive your name.

Later it receives whether you have trained and the type of your first workout, whether you have given AI consent, your plan (free, BellSense+ or BellSense+ Live), and when a trial ends without a subscription.

If you stop training for a while, Loops may also receive how many days it has been since your last workout, your total workouts, your last program and the date of your last workout, so we can write to you.

If you ask for a weekly or monthly activity email (“Keep tabs on me”), Loops receives that period’s training totals.

Deleting your account does not remove your Loops contact. To have it removed, email support@bellsense.app.

9. Analytics, crash reports and notifications

Analytics

The App records which screens and features you use and some of the choices you make, such as how you heard about us, your goal focus and the kind of thing you told the coach, including that something hurts. Some events carry facts about your training, such as the activity type and rough length of a workout imported from Apple Health, and your readiness score. These events go to Google Analytics for Firebase, tied to your account id, and are exported daily to Google BigQuery, where we read them.

Google’s software may add details of its own, such as your device, iOS version, app version, an install id and an approximate location worked out from your IP address.

The App does not use an advertising identifier and does not show Apple’s request to track you. Analytics is on in every App Store version of the App, and the App has no switch for it.

Crash reports

When the App crashes or records an error, Firebase Crashlytics receives the report and its diagnostic details, tied to your account id. Some error reports also carry the account id in their details. The App has no switch for it.

Notifications

The App saves your phone’s push token on your account record, and our server uses it, through Firebase Cloud Messaging and Apple, to tell you when a Coach Review is ready. Notifications need the iOS notification permission. A token that stops working is removed.

10. Subscriptions and Apple Ads

Subscriptions are bought through the App Store and handled by RevenueCat. RevenueCat identifies you by your account id and receives your App Store purchase and subscription records. Its software may add device details of its own.

RevenueCat tells our server when your subscription changes, and we keep the result under your account: whether you pay, the last change, whether you are in a trial or a paid period, the store environment and the time.

You manage or cancel a subscription in your Apple Account settings.

The App also passes RevenueCat a token from Apple that says whether you installed the App from an Apple Ads campaign, so a subscription can be traced to the campaign. It uses no advertising identifier and needs no tracking permission.

11. Exercise demo videos

When you tap Demo on a movement that has an approved video, the App loads YouTube’s privacy-enhanced player (youtube-nocookie.com). Google receives that request, with your IP address and your device and browser details. Other demos open in a Safari page inside the App. No BellSense account data is sent.

12. Who receives your data

  • Google: Google Sign-In, Firebase Authentication, Firestore, Storage, Cloud Functions and their logs, Cloud Messaging, Analytics with its BigQuery export, Crashlytics, and YouTube for demo videos.
  • Apple: Sign in with Apple, push delivery, App Store purchases and the Apple Ads token.
  • Anthropic: the AI coach’s writing.
  • ElevenLabs: the coach’s voice.
  • RevenueCat: subscriptions.
  • Loops: email.
  • Vercel: analytics for the bellsense.app website.
  • Stripe: payments for the beta sensor sold on the website.
  • Other people: your profile photo (section 1) and, if you join a group, its members (section 7).

Our server logs are keyed by your account id. The logs for Converse and the coach conversation record counts and reasons, never your words.

We do not sell your personal information. We may also disclose data when the law requires it.

13. Where your data is processed

Our servers run on Google Cloud, through Firebase. The companies in section 12 may store and process your data in countries other than the one you live in, whose data protection laws may differ from yours.

To ask where your data is stored, or what safeguard applies to a transfer, email support@bellsense.app.

14. How to stop it

  • AI coaching: withdraw your consent in Settings → Coaching → AI Coach.
  • Sensor recordings: Settings → Personal Info → Contribute Training Data.
  • Apple Health: iOS Settings → Privacy & Security → Health → BellSense.
  • Camera, microphone, speech recognition and notifications: each is an iOS permission you can turn off in iOS Settings. You can always type instead of speaking.
  • Check-in prompts: each has a switch in Settings.
  • Email: unsubscribe in any email to stop the emails. Creating an account adds you to the Training Notes list, and the App has no switch for that. To have your Loops contact removed, email support@bellsense.app.
  • Groups: leave the group in the App.
  • Analytics and crash reports: the App has no switch for these.
  • Subscriptions: manage or cancel them in your Apple Account settings. The Apple Ads token passed to RevenueCat has no switch.
  • Everything: delete your account (section 15).

15. Deleting your data

Delete a single workout in History. Delete your whole account in Settings → Delete Account, or by emailing support@bellsense.app.

When you delete your account, the App revokes its Sign in with Apple access if you used it, deletes your training record and your account record, deletes your sensor recordings and profile photo, and then deletes your sign-in account. When a sign-in account is deleted, from the App or any other way, our server deletes everything still stored under it, including AI threads and messages, reviews, the setup reply, coach conversation requests, usage counts, stored audio and any recordings.

These records are kept after you delete your account:

  • our record of your subscription, and of any complimentary access we gave you;
  • your Loops contact and its email history (email support@bellsense.app to have it removed);
  • RevenueCat’s customer record and Apple’s purchase records;
  • analytics events in Google Analytics and BigQuery, and crash reports, keyed to your account id;
  • server logs;
  • your account id and display name on the record of any group you were in.

The records we keep on our own server are keyed to your deleted account id.

16. The bellsense.app website

The website counts page views with Vercel Web Analytics: the page, the site that sent you, your country, and your device and browser type. Vercel describes it as not using cookies. These page views are not linked to an App account.

If you join the waitlist at bellsense.app/buy, we save your email address and where you signed up, and Loops adds you to the Training Notes list. You can unsubscribe in any email.

The first time you sign in on the website, we create an account record with your email address and display name, and Loops receives a sign-up, with your first name when the sign-in supplies it, which adds you to the Training Notes list.

From March to June 2026 the website sold a beta BellSense sensor, and checkout is now off. Stripe took the payment and holds the card details. We saved the shipping name, address, phone, email and a Stripe customer id on the buyer’s account record, and Loops received a purchase event. Deleting the account deletes the record with the shipping details. Stripe and Loops keep their own records.

17. If you are in the European Economic Area or the UK

You have the right to:

  • see the personal data we hold about you, and get a copy;
  • correct it (much of your profile can be changed in Settings → Personal Info);
  • have it deleted (section 15);
  • receive the data you gave us in a format you can take to another service;
  • object to our use of it, or ask us to restrict it;
  • withdraw a consent at any time, without affecting what was done before (section 14 lists where);
  • complain to the data protection authority where you live or work.

To use any of these rights, email support@bellsense.app.

18. If you live in California

California law gives you the right to:

  • know what personal information we collect, use and disclose, and get a copy;
  • correct it;
  • delete it (section 15);
  • opt out of the sale or sharing of your personal information;
  • limit our use of sensitive personal information;
  • not be treated differently for using these rights.

Sections 1 to 12 and 16 list the personal information we collect and who receives it. We do not sell your personal information.

To use these rights, email support@bellsense.app. Someone you authorize can ask for you. We may need to confirm who you are first.

19. Children’s privacy

BellSense is not intended for individuals under 13 years of age. We do not knowingly collect data from children.

20. Changes to this policy

We may update this policy periodically. Continued use of the App after changes are posted constitutes your acceptance of the updated policy. The date at the top shows when it last changed.

21. Contact

For privacy questions and requests: support@bellsense.app