Privacy policy
Effective 15 October 2026 · Hoist, package app.hoist.muscle, by Clearpoint Studios
Hoist is a strength training tracker. Your training lives on your phone. Hoist has no account of its own and never asks for your name, email address or phone number. If you choose to back up to Google Drive, you sign in with Google for that, and the backup goes to your own Drive and not to us. What leaves the phone for our services: an anonymous purchase identifier, a random install identifier with anonymous events about how the app is used, a hashed device identifier for the Studio Bundle, an anonymous support account with whatever you write to our support, and a push token once you allow notifications. One Pro feature, the paper sheet reader, sends a photo you take to be read. This page says what each of these is, who receives it and when.
What stays on your device
The app writes these to its own storage on your phone. Three things leave it, and only when you ask for that: a backup to your own Google Drive, the printed rows of a paper sheet you have read, and the score and tier you share with buddies. All three are described below.
- Every workout you log: exercises, sets, weights, reps, RPE and notes
- Your routines, templates and the session in progress
- Bodyweight, height, sex and units, which the score needs to be calculated
- Your Hoist Score, tiers, personal records and estimated one-rep maxes
- Settings such as rest defaults, language and the app lock
All of it is computed on the device. Uninstalling Hoist removes it.
Backup to your Google Drive, only if you connect it
In the settings you can connect a Google account to back up your training. Until you do, nothing in this section happens. The backup is free.
Once connected, Hoist saves your routines, finished workouts with every set, the bodyweight log, your printed sheets, your settings that describe you (units, sex, experience, rest and RPE preferences, the onboarding profile) and the model name of the phone that wrote the backup to the hidden app data folder of your own Google Drive. Hoist asks Google only for the drive.appdata permission: it can read and write files in this one folder, which only Hoist can see, and it has no access to any other file in your Drive. The data goes straight from your phone to Google. It does not pass through any server of ours, and we cannot read it. Hoist shows the email address of the connected Google account in the settings and keeps it on the phone.
The backup updates itself after a change or at an interval you choose, and you can switch the automatic backup off and back up by hand. If you sign in with the same Google account on another phone, Hoist finds the backup and can restore it there. Google stores the files under your account according to its own policy at policies.google.com/privacy.
You can disconnect at any time, and the backup stays in your Drive. You can also remove Hoist's access in your Google account under Security, Third party apps, and delete its hidden data in Google Drive under Settings, Manage apps.
Hoist's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is used for the backup and nothing else, it is not used for advertising, and it is not transferred to anyone.
What reaches our servers
| Purchase identifier | The app uses RevenueCat to check whether Hoist Pro is active. RevenueCat issues an anonymous app user ID on first launch and holds the purchase status behind it. The app asks RevenueCat for that status on every start. The payment itself runs through Google Play, and we never see your card, address or Google account. |
|---|---|
| Install identifier and product events | A random ID generated on the device on first launch. From then on the app sends anonymous events to a service we run on Cloudflare: that the app was opened, which onboarding steps were shown and whether the training plan offered there was accepted, that your first workout was finished, that the Pro screen was shown or closed, that the Studio Bundle screen was shown, whether a purchase was started, completed, cancelled or failed and for which plan, and that a bundle code was redeemed. Each batch carries the install ID, the purchase identifier, the app version, the interface language, the platform and whether Pro is active. The service notes the country the request comes from and does not store your IP address. On every start the app also asks this service, by install ID, which price list this installation sees, so that it stays the same. The events tell us where people get stuck in the app. They carry no name, no contact detail and nothing you logged: no exercise, no weight, no rep and no body value. |
| Device identifier (hashed) | A SHA-256 hash of the Android ID of your phone, sent together with the purchase identifier to the service we run on Cloudflare for the Studio Bundle, one purchase that unlocks Pro in several Clearpoint Studios apps. This happens once after installation on first launch, to check whether a Studio Bundle belongs to this phone (and again on the next start if the service could not be reached), when you tap Restore purchases, and when a bundle code is redeemed, whether you type it in or it arrives with the Play Store link you installed from. The hash lets the service give Hoist Pro back after a reinstall on the same phone and limits how many devices one bundle code can unlock. On every start, and after a Studio Bundle purchase, the app also contacts this service with the purchase identifier alone, to learn whether a bundle is held and which code belongs to it. The Android ID itself never leaves the device, and the hash carries no name and no contact detail. |
| Support account | On first launch the app creates an anonymous account on our support backend (Supabase): a random account ID with no name, no email address and no password. It exists so that a conversation you start, and our reply, belong to your installation. On every start the app signs in to this account, loads your own conversations and keeps a connection open for new replies. |
| Support messages | Sent only when you press send. Your message is stored on the support backend together with the app version, the Android version, the manufacturer and model of your phone, the app language and whether Pro is active. When you send a further message in a conversation, the backend notes the country the request comes from and does not save your IP address with it. A copy of the message that opens a conversation, with the app version, the Android version, the app language and the Pro status, goes through a relay we run on Cloudflare to our internal Telegram channel, so that we notice it quickly. The relay keeps your IP address for ten minutes to limit how many messages one connection can send. Messages can be translated with Google's Gemini API, so that we can read yours and you can read our reply in your language. |
| Push token (Firebase) | Hoist includes Firebase Cloud Messaging, a Google service, to tell you when we reply to a support request. Firebase starts when the app launches and registers this installation with Google, which issues an installation ID and a push token. The app asks for the notification permission after you send a support message. Once notifications are allowed, it stores that token together with the platform and the app language on our support backend. Workout reminders are scheduled on the device and need none of this. |
All of this travels over HTTPS. None of it is used for advertising, none is sold, and none is used to track you across apps of other companies. Hoist requests no advertising ID.
The optional training buddy
Hoist has an opt-in buddy feature, which not every version of the app shows. It stays switched off until you turn it on, and nothing about it is sent before you do. If you turn it on, a small profile is stored on our Supabase backend: a display name you choose, an anonymous account ID, an invite code, the Hoist Score and tier you share with the people you invite, and the time of the last update. Your sets, routines and history stay on the phone. Leaving buddies in the app signs this phone out of that account. The profile itself stays on the backend until you ask us to delete it, and the instructions are on the deletion page.
The paper sheet reader (Pro)
Hoist Pro can print a routine as a paper sheet, which you tick by hand at the rack and photograph afterwards. The photo you take is sent over HTTPS to our reading service on Cloudflare, together with what was printed on that sheet: its code, the unit, and for each row the exercise name, the number of set fields and the printed target. The service passes the photo and those rows to Google's Gemini API to read the numbers written in the fields. What comes back is the numbers, the date written on the sheet, the sheet's code and how many readings are left today. The photo is held in memory for the length of that one request and is not stored by us afterwards. Google processes it under the Gemini API terms for paid use, which do not allow it to be used for training their models.
Every request to the reading service carries your purchase identifier, because reading sheets is a Pro feature, and your phone's offset from UTC, which decides when your day ends. The service asks RevenueCat whether that identifier holds Pro and remembers the answer for up to six hours. It keeps a counter of how many readings that identifier used today, so the daily allowance can be enforced. It keeps no copy of the photo and none of the numbers of a reading that worked. If a reading fails, an excerpt of the failed answer of up to 400 characters is written to the service's error log. With Pro, opening the sheet screen asks the service how many readings are left today, which sends the purchase identifier and the offset. A photo is sent only when you take or choose one.
Other requests the app makes
Opening the More Apps screen makes the app ask the Google Play website, at most once in 24 hours, whether Clearpoint Studios apps that were not yet published are available now. The request names only the Play Store page of each such app. Printing a sheet in Arabic, Persian, Urdu, Hindi, Bengali, Thai, Japanese, Korean or Chinese downloads the font for that script from Google Fonts. In both cases Google sees your IP address, as with any web request, and receives no identifier from the app and nothing you logged. Links you tap, such as a Play Store page, open outside Hoist.
App lock
The PIN and the fingerprint or face unlock are handled by your device and its secure storage. We never receive either.
No advertising, no profiling
Hoist contains no ad network, no advertising ID, no cross-app tracking and no crash reporting SDK. Nothing you log is used to build a profile of you.
Children
Hoist is made for adults who train with weights and is not directed at children under 18.
Data retention
How long each thing is kept, and by whom:
| On your device | Kept as long as Hoist is installed. It goes when you uninstall the app or use "Delete all data" in the settings. Apart from the two cases named above, we never receive a copy. |
|---|---|
| Google Drive backup | Kept in your own Drive until you delete Hoist's app data there or remove the backup from inside the app. We hold no copy. |
| Install ID and product events | Deleted automatically 400 days after they arrive. A scheduled job on the analytics service runs every day and removes everything past that date, including the install record itself once nothing newer has come from it. |
| Purchase identifier | Held by RevenueCat while the purchase is valid, because restoring Hoist Pro on a new phone is what the identifier is for. It goes when you ask us to delete it, and a lifetime purchase you delete cannot be restored afterwards. |
| Device identifier (hashed) | Held by our Studio Bundle service, together with bundle codes and the record of which installation redeemed which code, until you ask us to delete it, because recognising the phone after a reinstall is what it is for. |
| Support account and push token | Kept on the support backend until you ask us to delete them. |
| Support conversations | A resolved or closed conversation is deleted automatically 30 days after its last activity, by a job that runs every day. An open conversation stays until it is resolved. The copy in our internal Telegram channel is deleted on request. The relay's record of your IP address expires after ten minutes. |
| Buddy profile | Held until you ask us to delete it. Leaving buddies in the app signs the phone out and leaves the profile on the backend. |
| Sheet photos and readings | The photo and the numbers are not kept. The photo lives in memory for the one request that reads it, and the numbers go straight back to your phone. The daily reading counter behind your purchase identifier starts again at the end of your day. The record that holds it, with your offset from UTC, is deleted 30 days after your last reading. An offset stored only because you opened the sheet screen has no such date and stays until you ask us to delete it. |
When you ask for deletion, the data is removed and not kept afterwards, apart from short lived operational backups our hosting providers rotate out within 30 days. Requests are handled within 30 days, and the deletion page says how to make one.
Your rights
Under the GDPR you can ask what is stored about you, ask for it to be corrected or deleted, and object to its processing. The legal basis for the purchase identifier is performing the contract you entered when buying Pro. For the anonymous product events it is our legitimate interest in seeing where the app fails people, and for the hashed device identifier it is our legitimate interest in giving a purchase back after a reinstall and in limiting how many devices one code unlocks. Support messages, the support account and the push token are processed to answer the request you sent us. The Google Drive backup is processed on the basis of your consent, given by connecting your account, and ends when you disconnect. Write to [email protected] and you will hear back.
Processors
Google Play handles payments and distribution. RevenueCat holds the purchase status. Cloudflare hosts this website, the service that receives the anonymous events, the Studio Bundle service, the relay for support messages and the service that reads paper sheets. Supabase hosts the support backend and, if you switch that feature on, the buddy profile. Google's Firebase Cloud Messaging delivers the notification about a support reply. Google's Gemini API reads the sheet photo you send, for that request only, and translates support messages. Telegram carries the copy of a support message to our internal channel. Each acts on our instructions. Apart from the sheet photo with the printed rows of that sheet, the score and tier you share with buddies, and whatever you write to support yourself, none of them receives your training data.
Changes
If this policy changes, the date at the top changes with it, and a change that affects what leaves your phone will be announced in the app before it takes effect.
Contact
Clearpoint Studios, [email protected]