Ironcraft Privacy Policy
Effective date: October 27, 2026
Ironcraft is an iPhone and Apple Watch app for strength training, food logging and personal health records. It is published by Mister Business Enterprises LLC ("we", "us", "our"). This policy explains what the app stores, where it stores it, and the small amount of information that leaves your device. It applies to the Ironcraft app and to these web pages.
If you live in Washington, Nevada or Connecticut, also read our Consumer Health Data Privacy Policy. It gives the same facts in the form those states' laws require, and we apply it to everyone in the United States. If you live outside the United States, also read Outside the United States.
The short version
- No account. Ironcraft has no sign-in, and we run no server for it. We do not receive what you log.
- Your data stays on your devices. It lives on your iPhone and Apple Watch, and Ironcraft encrypts its data on your iPhone.
- No analytics SDK, ads or tracking. Ironcraft sends no usage events. Open Food Facts keeps visitor logs for its security, technical analysis and popularity measurement when you choose an online food lookup.
- One online service. The app's only network requests go to Open Food Facts, and only when you scan or type a barcode that is not one of your own foods, or tap Search Open Food Facts. See exactly what it receives.
- Apple Health only with your permission, and only for the data types listed below.
- You are in control. You can export or delete everything from inside the app.
What Ironcraft stores on your device
Ironcraft stores only what you enter, what you import, and what you allow it to read:
- Training: workouts, exercises, sets (weight, reps, time, distance, effort rating), notes, routines and folders, custom exercises, personal records, achievements and weekly streaks.
- Body: body weight, body-fat percentage, body measurements (such as waist or arm), and progress photos with their notes.
- Food: food log entries (food name, amount, meal, nutrition values), your own foods (including any barcode you add), saved meals, meal plans, grocery lists, water, nutrition targets, and the profile details you enter so Ironcraft can suggest targets (such as age, sex, height, activity level and goal).
- Medication log (off unless you turn it on): the names you type, units, schedules and reminder times, entries marked taken or skipped with their time and amount, the body site you pick for an entry, supply amounts, symptoms with their severity and notes, and the date you confirmed that you are 18 or older.
- Events: countdowns with their title, type, date, time zone, the location text you type, phases and check-in days.
- Settings: units, the modules you turn on, reminder choices, quiet hours, discreet reminders, app lock, Apple Health on or off, rest-timer defaults, and your plate and bar weights.
- Purchase status: whether Ironcraft Pro is active, as Apple reports it to the app on your device.
- An install number: a random number created when you install Ironcraft and kept in the Keychain on that device. The number orders edits and travels with record metadata between your paired devices and in backups. We do not receive it.
Ironcraft also ships with built-in exercise, food and recipe data. Using it sends nothing anywhere.
Where your data is stored and how it is protected
On your iPhone
Ironcraft keeps its data in its own private storage on your iPhone, which other apps cannot open. It encrypts that data with AES-GCM and a 256-bit key. The key is kept in your iCloud Keychain, which Apple protects with end-to-end encryption, so neither we nor Apple can read it. Progress photos are kept in this encrypted storage, not in your photo library.
Device backups
If you back up your iPhone to iCloud or to a computer, the backup holds Ironcraft's stored data only in encrypted form. Ironcraft leaves the files it keeps unencrypted, the widget summary and the quick-action files described below, out of device backups. To open the data after a restore, Ironcraft needs its key from your iCloud Keychain: the same Apple Account, with iCloud Keychain turned on. See moving to a new iPhone.
What iOS can show while your iPhone is locked
Some features have to work without opening Ironcraft's encrypted storage, so a few small items are kept outside it. They are protected by your iPhone's passcode-based data protection:
- Widget summary: your next event's title and date, the name of your next routine, calories and protein left today, and workouts done this week against your target. It never contains medication-log entries, body measurements or photos. Only Ironcraft and its widgets can read it. Ironcraft leaves this file out of device backups.
- Quick actions: when you act from a widget or a notification, the action is handed to the app in a short-lived file that is deleted as soon as Ironcraft saves it. Ironcraft leaves these files out of device backups.
- Reminders: iOS holds the text of each scheduled reminder. Discreet reminders are on by default. If you turn them off, reminder text can show the item name. With discreet reminders on, medication-log reminders read "Scheduled entry" with no name or amount, and no reminder ever shows an amount.
- Live Activities: the rest timer and event-day countdown on your Lock Screen.
iOS itself keeps reminder text and Live Activities, so how they are handled in a device backup is up to iOS, not Ironcraft.
On your Apple Watch
The Watch app keeps your routines, your recent results for those exercises, your units, your Apple Health choice and your next countdown event. It also keeps the workouts you log on the watch. A workout logged on the watch stays there until your iPhone confirms it has a copy, and finished workouts are kept on the watch for 30 days. iPhone and Apple Watch exchange this data over the encrypted connection Apple provides between paired devices. Medication-log entries are not copied to the Watch app. Reminders from your iPhone can still appear on your watch as notifications. Delete All Data on your iPhone also tells the watch to erase the Ironcraft data it holds from before the deletion the next time the two connect, and nothing the watch made before the deletion is saved on your iPhone (see Deleting your data).
App lock
If you turn on app lock, Ironcraft asks for Face ID, Touch ID or your device passcode when it opens. iOS does the check. Ironcraft never receives your face data, fingerprint or passcode, only whether the check passed.
Encrypted backup file
You can export a backup file from Ironcraft's Settings. The file is encrypted with a key made from a passphrase you choose. We never see the passphrase or the file. You decide where to keep the file, for example in Files, on a computer or in a cloud storage service you use, and that service then stores the encrypted file under its own terms. If you lose the passphrase, nobody can open the file, including us.
Exports and sharing you start
CSV exports, and the PDF report in Ironcraft Pro, are not encrypted. They contain what you choose to export, and you decide where to save or send them. Progress photos and share cards you save to your photo library are then handled by Photos, and by iCloud Photos if you use it.
Apple Health
Ironcraft uses Apple Health only if you turn it on, and iOS asks you about each data type. Ironcraft works without Health access. You can change your choices at any time in the Health app: tap your profile picture, then Apps, then Ironcraft.
| Data type | Saved to Health | Read from Health |
|---|---|---|
| Workouts | Yes, the workouts you log | No |
| Heart rate and active energy | With the workouts you log on Apple Watch | On Apple Watch, during a workout you log there |
| Body weight | Yes, the weights you log | No |
| Dietary energy, protein, carbohydrates and fat | Yes | No |
| Water | Yes | No |
On iPhone, Ironcraft reads nothing from Health. On Apple Watch, it reads heart rate and active energy only during a workout you log there, to show them and to save them to Health with that workout. Ironcraft never uses Health data for advertising or marketing, never sells it, never sends it to us or anyone else, and never writes it to iCloud. What Ironcraft saved to Health stays in Health if you delete Ironcraft or its data. To remove it, open the Health app, tap your profile picture, then Apps, Ironcraft, and delete the data from there.
Notifications
All Ironcraft reminders are local notifications that iOS schedules on your device. There is no push server, and Ironcraft never sends marketing notifications. You choose which kinds of reminders you get. Reminder text can appear on your Lock Screen, in Notification Center and on your Apple Watch. Discreet reminders are on by default. If you turn them off, reminder text can show the item name. Medication-log reminders and the rest-timer alert use Apple's Time Sensitive delivery. If you start a free trial, Ironcraft reminds you 2 days before it ends.
Open Food Facts
When you scan or type a barcode that is not one of your own foods, or tap Search Open Food Facts, Ironcraft asks Open Food Facts (world.openfoodfacts.org) for the food's nutrition facts. Open Food Facts is an independent, open food database run by a non-profit association based in France. It is not our partner or service provider.
What Open Food Facts receives with each lookup:
- the barcode you scanned or typed, or the search words you submitted;
- your device's IP address, which every internet request carries;
- a User-Agent that names the app and its version and a contact address,
Ironcraft/<version> (mister-business-enterprises@agentmail.to), as Open Food Facts asks apps to do, and an Accept header requesting JSON.
iOS may also add standard request headers, such as a preferred-language header.
What it does not receive: your name, your Apple Account, your Ironcraft logs, Health data, medication-log entries, or any advertising or device identifier. Ironcraft does not send or accept cookies in these requests. Open Food Facts says it sometimes derives a country from an IP address for product-entry assistance; its policy does not say whether that happens for Ironcraft's read-only lookups.
The requests go straight from your device to Open Food Facts. We never receive them, so we cannot connect a lookup to you. Open Food Facts handles them under its own privacy policy. That policy says it keeps visitor IP addresses and logs for 3 years for security, technical analysis, and popularity measurement. It does not say whether those logs retain the barcode or search words in a request URL. You can reach Open Food Facts at privacy@openfoodfacts.org.
Before your first lookup, Ironcraft shows a notice that says what is sent, and you choose whether to continue. Online lookups are optional: you can turn them off in Ironcraft's Settings and still log food from the built-in foods, your own foods or quick add. Turning them off stops future requests; it cannot recall a request already sent. Nutrition facts you add from Open Food Facts are saved with your food log on your device. The data comes from the community, so check the label. Food data from Open Food Facts is available under the Open Database License.
What we receive
- From the app to us: nothing. There is no account, no server of ours and no analytics service of ours. Optional Open Food Facts requests and that service's visitor-log purposes are described above.
- From Apple: Apple processes all purchases. It gives us sales and payment reports that do not include your name or payment details. If you chose to share analytics with app developers (iPhone Settings › Privacy & Security › Analytics & Improvements), Apple also gives us crash reports and app usage statistics. Apple collects these, controls them and presents them to us in a form that does not identify you. Ratings and reviews you post on the App Store are public.
- From you, by email: if you write to support, we receive your email address, your message and anything you attach. We use it only to answer you and to handle your requests. We delete it 12 months after the conversation ends, unless the law requires us to keep it longer, and you can ask us to delete it sooner at any time. We do not need health details, medication-log entries or photos to help you, so please do not send them. If you do, we delete them from the conversation as soon as we see them, unless you give us your explicit consent to keep them for a purpose we tell you. Never send your backup passphrase: we will never ask for it.
- From your browser: when you visit these web pages, the technical details of each request, which reach us through Cloudflare (see These web pages).
What we do not do
- We do not include analytics or advertising SDKs, send usage events, or track you across other companies' apps or websites. Open Food Facts' visitor-log purposes for an optional lookup are described above.
- We do not sell your personal information, share it for targeted advertising, or use it for profiling.
- We do not send your data to any AI service.
- We do not ask iOS for your location or send a location field. Like every internet request, an optional Open Food Facts lookup carries an IP address; the provider's possible country derivation is described above.
These web pages
These pages are part of misterbusinessenterprises.com. They are served from servers we rent in the United States, and Cloudflare delivers them and protects them from attacks as our service provider. Each time your browser asks for a page, the request carries your IP address, details about your browser (such as its name, version and preferred language) and the address of the page.
- Our web servers use these details only to send you the page. They keep no log of your visits.
- Cloudflare uses them to deliver the page and to block attacks and misuse. It keeps records of requests, including IP addresses, for a limited time under its own retention periods, and shows them to us in security and traffic reports in our Cloudflare account. Cloudflare answers each request from a data center near you and stores information mainly in the United States and the European Economic Area. Its privacy policy explains how.
We add no cookies, analytics tools or advertising to these pages. Cloudflare's request records and their security and traffic-report purposes are described above. If Cloudflare needs to check that a visitor is not an automated program, it may set a security cookie for that check.
Your choices
- Turn Apple Health access, notifications, online food lookups and the medication log on or off at any time.
- View and edit everything in the app, and export it as CSV or as an encrypted backup file.
- Delete single entries, or use Delete All Data in Ironcraft's Settings. See Deleting your data for what that removes and what it does not.
- Deleting the app removes its data from that device.
Children
Ironcraft is for adults. You must be 18 or older to use it, and it is rated 18+ on the App Store. The medication log also asks you to confirm that you are 18 or older before it turns on. Ironcraft is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you think a child has sent us information, contact us and we will delete it.
Your privacy rights in the United States
Depending on where you live, state law may give you rights to know about, access, correct, delete or get a copy of your personal information. It may also give you rights to opt out of its sale, targeted advertising and profiling, and to appeal our decisions. We offer these rights to everyone in the United States:
- Data in the app: we do not hold it, so you use these rights directly in Ironcraft: view, edit, export (CSV or backup file) and delete.
- Data we do hold (support emails): email mister-business-enterprises@agentmail.to with "Privacy request" in the subject. We may confirm the request comes from you by replying to the same address. You can also use an authorized agent, who must show us your permission. We respond within 45 days. If we need more time we tell you why, and we take at most 45 more days. When you ask us to delete your data, we also tell Open Food Facts about your request, as described in the Consumer Health Data Privacy Policy. There is no fee, and using your rights never changes how Ironcraft works for you.
- Opt-outs: we do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising or use it for profiling, so there is nothing to opt out of. Global Privacy Control and Do Not Track signals have nothing to switch off.
- Appeals: if we decline a request, reply with "Appeal" in the subject. We answer in writing within 45 days and explain our decision. If we deny the appeal, we tell you how to contact your state's Attorney General.
- California: we do not disclose personal information to third parties for their direct marketing.
Security incidents
We do not hold the data you log, but we take the security of the app seriously. If we learn of an incident that affects your information, we will notify you and the authorities as the law requires. Because we have no account or contact details for you, we would do so in the app, on this page and through any other channel the law requires.
Outside the United States
This section is for people who use Ironcraft outside the United States, for example in the European Union and the rest of the European Economic Area, the United Kingdom or Brazil, where laws such as the GDPR, the UK GDPR and Brazil's LGPD protect personal data. It adds to the rest of this policy, which still applies to you.
Who is responsible
Mister Business Enterprises LLC, a company in the United States, publishes Ironcraft and is responsible for the personal data described in this policy. It is the "controller" under the GDPR and the UK GDPR, and the "controlador" under the LGPD. The owner of Mister Business Enterprises LLC is the person in charge of data protection. For anything in this policy, write to mister-business-enterprises@agentmail.to.
In Brazil, our data protection officer under the LGPD (the encarregado) is the owner of Mister Business Enterprises LLC, contactable at mister-business-enterprises@agentmail.to.
What personal data there is
Ironcraft is built so that very little personal data leaves your devices:
- What you log stays on your devices. Your workouts, food log, body data, medication log, photos and settings stay on your iPhone and Apple Watch, and Ironcraft encrypts them on your iPhone. We never receive them, so we cannot see, correct or delete them for you. You do that yourself in the app.
- Food lookups go to Open Food Facts. When you scan or type a barcode that is not one of your own foods, or tap Search Open Food Facts, your device sends the barcode or your search words, its IP address and the app's User-Agent straight to Open Food Facts, a non-profit association in France (details above). We decide that the app makes these requests, and only when you ask, but we never receive them. Open Food Facts decides what it keeps from them, such as its logs with IP addresses, and is responsible for that under its own privacy policy.
- Support emails come to us. If you write to us, we receive your email address, your message and anything you attach.
- Visits to these web pages go through Cloudflare. Your browser sends your IP address, browser details and the address of the page you ask for. Cloudflare receives them for us and passes the request on to our web servers, which send you the page (details above).
- Apple handles purchases and App Store data under Apple's own privacy policy (details above).
Why we use it, and our legal bases
| What | Why | Legal basis |
|---|---|---|
| Food lookups | To get the nutrition facts you asked for | Needed to give you the feature you ask for (GDPR and UK GDPR Article 6(1)(b); LGPD Article 7(V)). Ironcraft also asks you before the first lookup, and you can turn lookups off at any time |
| Support emails | To answer you and to handle your requests | Needed to help you with the app you use (Article 6(1)(b); LGPD Article 7(V)), or our legitimate interest in answering messages sent to us (Article 6(1)(f); LGPD Article 7(IX)). For privacy requests and our answers: our legal obligations (Article 6(1)(c); LGPD Article 7(II)) |
| Health details you send by email | We do not need them, and we ask you not to send them. If you do, we delete them as soon as we see them, unless you agree that we keep them for a purpose we tell you | Only your explicit consent, which you give with a clear statement in reply to our request. Sending the details is not consent (GDPR and UK GDPR Article 9(2)(a); LGPD Article 11(I)). You can withdraw it at any time, and we then delete them |
| Visits to these web pages | To deliver the pages and to protect the site from attacks and misuse | Our legitimate interest in running a website that works and is secure (Article 6(1)(f); LGPD Article 7(IX)) |
| What the app does on your device | To run the features you turn on | We never receive this data. Where a law treats this processing as ours: needed to give you the app you use (Article 6(1)(b); LGPD Article 7(V)), and for health data, your explicit consent when you turn on the medication log or Apple Health (Article 9(2)(a); LGPD Article 11(I)) |
We do not use personal data for advertising or profiling, and we make no decisions about you by automated means.
Where your data goes
- We are in the United States, so support emails you send us are stored and read there, by us and by our email provider, which stores them for us as our service provider. Data protection law in the United States may differ from the law where you live.
- Visits to these web pages reach our servers in the United States through Cloudflare, which stores information mainly in the United States and the European Economic Area. Cloudflare takes part in the EU-U.S. Data Privacy Framework, with its UK extension and the Swiss-U.S. framework, and uses standard contractual clauses for other transfers.
- Food lookups go from your device to Open Food Facts in France.
- Apart from our email provider and Cloudflare, which work for us as service providers, no one receives personal data from us.
How long we keep it
- Support emails: we delete them 12 months after the conversation ends, unless the law requires us to keep one longer, and sooner if you ask. Health details you send without our asking are deleted as soon as we see them. If you agree that we keep them, we keep them only for the purpose and the time we told you.
- Visits to these web pages: our own web servers keep no log of them. Cloudflare keeps its records of requests for a limited time, under its own retention periods, to protect the site and for the security and traffic reports it shows us.
- What you log stays on your devices until you delete it. Open Food Facts keeps its logs under its own policy (details above).
Your rights
Depending on where you live, you have the right to:
- find out whether we hold personal data about you, and get a copy of it;
- have it corrected;
- have it deleted;
- restrict or object to how we use it;
- receive it in a format you can take elsewhere;
- withdraw your consent at any time, without affecting what we did before;
- know who receives it, and what happens if you do not consent (we need only your email address to answer you);
- not be subject to decisions made only by automated means (we make none).
How to use them:
- What you log: in the app. View and correct anything, export it as CSV or as an encrypted backup file (which is also how you take your data elsewhere), and delete single entries or use Delete All Data. You can turn off online food lookups, Apple Health access and the medication log at any time.
- What we hold: email mister-business-enterprises@agentmail.to with "Privacy request" in the subject. We may confirm that the request comes from you by replying to the same address. We answer within one month. If a request is complex, we may take up to two more months, and we tell you why within the first month. Under the LGPD, we answer a request for confirmation or for a full copy within 15 days. Requests are free.
- Food lookups: we never receive them, so we cannot find them for you. Write to Open Food Facts at privacy@openfoodfacts.org. If you ask, we also pass your request on to them.
Complaints
If you are unhappy with how we handle your data, please write to us first so we can put it right. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened. For example: the data protection authority of your EU or EEA country, the Information Commissioner's Office in the United Kingdom, or the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil.
Representatives in the EU and the UK
Mister Business Enterprises LLC has no establishment in the European Union or the United Kingdom. Before Ironcraft is offered in the EU, the rest of the European Economic Area or the United Kingdom, we will appoint a representative in the EU and one in the UK, as the GDPR and the UK GDPR require, and name them here with how to reach them. Until then, Ironcraft is not offered there, and you can write to us directly at mister-business-enterprises@agentmail.to.
Changes to this policy
If we change this policy, we will update the effective date above. If a change is material, we will tell you in the app before it takes effect. We will ask for your consent in the app before Ironcraft shares any new kind of data, shares data with a new kind of recipient or uses data for a new purpose. If a future version offers an account or sync, it will be optional, and we will update this policy before that version is released.
Contact
Mister Business Enterprises LLC
Email: mister-business-enterprises@agentmail.to