Last updated 29 September 2026
NomaSports works with data about your body. That makes this document part of the product, not paperwork. It describes what we actually store, and it is written against the code — not against what a policy usually says.
You can use NomaSports without giving us anything: no email, no sign-up. We store what you log and what you allow us to read. We never write to Apple Health. We do not use advertising, we do not run third-party analytics, and we do not sell anything to anyone.
Without an account. Open the app and we create an anonymous profile so your sets have somewhere to live. It holds no name, no email and no phone number. If you later create an account, the same profile becomes yours — your history is not migrated or reset.
If you sign in to an account you already had — since 21 September 2026. Then the anonymous profile cannot become that account (one identity belongs to one profile), so instead what you recorded as a guest on this phone moves into your account: sets, sessions, food, water, protein answers, check-ins, symptoms, weight before and after training, supplements, the readings and workouts from Apple Health. Where your account already has an entry for the same day or the same set, the account's entry stays and the guest's copy is dropped. The anonymous profile is then deleted. The move needs a one-time ticket the app takes while you are still the guest; it expires in fifteen minutes and cannot be used to take anyone else's data. Before that date the guest's records simply stayed behind on the phone, and the app said so.
Account. Email address, and a password we never see in readable form. If you sign in with Apple, Google or Facebook, we receive the identifier that provider returns — with Apple that may be a relay address rather than your real one.
About you. Sex, training experience, goal and interface language. Sex is asked because starting loads depend on it; it can be skipped. If you fill them in: year of birth, height and target weight, used for your daily energy and protein.
Your time zone, read from your phone and updated automatically when it changes. Without it, "today", the days since your last session and the quiet hours for notifications would follow someone else's clock. We keep only the current zone, not a history of where you have been. Your phone alone remembers the last change, so the app can tell you that your clock moved; deleting your account erases that too. For two days after such a change, when the app asks for today's weight it also tells our server by how many hours the clock moved — only the number of hours, never the zones or a place. The server uses it for that one answer and does not store it, and it is never sent to an AI provider.
Training. Sessions and sets: movement, weight, repetitions, duration and time. This is the memory the app is built around. Since 29 September 2026 that includes load outside the gym — a run, a ride, a swim, an hour on court — with its length and distance, whether you type it, say it ("ran five") or it comes from Apple Health. A short spoken phrase like that is understood on the phone; only the kind, minutes and kilometres are saved.
Weight before and after training, if you enter it — since 29 September 2026. Two numbers for a day. The app shows you the difference and nothing more: it does not turn it into advice. They sit in an isolated table your app can only reach through two narrow functions that check it is you, and go to no model and no vendor.
What you answer in one tap. Once a day the app may ask whether you got enough protein, or how a muscle group feels after your last session — fresh, sore, or very sore. One tap, and ignoring it is a valid answer. These answers change what the app suggests next; they never change the weights it calculates for you.
The morning check-in, only if you open it yourself. From 4 to 21 September 2026 the app offered a short morning check-in every day: energy, mood and soreness on a five-point scale, plus cramps and bloating. Since 21 September it is not offered any more. It stays reachable from "How you are today" on your own page, for the mornings you want to note something; nothing prompts you, and nothing counts the mornings you don't. We stopped offering it because the answer changes nothing in the app (see below) and a form that appears every day is the fastest way to make people stop looking. What replaces it — a single yes/no when your measurements disagree with each other, at most once every few days — will be described here before it ships.
Heavy after food or drink — since 20 September 2026. A third tick joined the two: whether what you ate or drank sat heavily. It is the first answer in a loop we are building — the app says what to eat and drink around training, you say in one word how it went. It lives in the same isolated table as cramps and bloating, reachable only through the same narrow function, goes to no model and no vendor, and today changes nothing: it is recorded and shown back to you. When it starts to change what the app suggests, it will be because a named specialist signed the rule, and this paragraph will say so first.
Until that date this section said there was no daily form, no mood diary and no symptom log. That stopped being true the day the check-in shipped, and we are saying so here rather than quietly deleting the sentence.
Energy, mood and soreness are stored in their own table that only you can read. Cramps and bloating are kept apart from even that — in an isolated table your app has no direct access to at all: it can only reach them through one narrow function that checks it is you. We separated them on 4 September 2026, before a single row existed, because for the people this app is built for those two are cycle-adjacent, and cycle data has lived apart here from the first day. They go to no model and no vendor. Today they change nothing at all in the app — not your weights, not the order of what's suggested; they are recorded and shown back to no one but you. If that ever changes, this paragraph changes first.
Supplements, if you list them. What you tell us you take — the kind from a fixed list, the name you write on it, and how many times a day. We use it for one thing: telling you when you have named the same substance twice. We do not know what is inside any product and never guess at it. This is health data, it sits in its own table with the same owner-only access, and it goes nowhere outside.
From Apple Health, with your permission. Sleep, heart rate variability, resting heart rate, body weight, steps and exercise minutes. Since 29 September 2026 also your workouts from other apps and watches, except strength sessions: for each one the kind (run, ride, swim, court, walk and so on), when it started and ended, its length and distance — not the route, not your heart rate during it, not the app that recorded it. For steps, the first time you connect we also read the last three weeks, so your usual number of steps is known from the start instead of three weeks later. We only read. We never write anything into Health.
Read on your phone and kept there. Some things the app works out only on the phone and never sends anywhere: your steps hour by hour (to notice long stretches without steps), the times you went to bed over the last two weeks (to show your usual bedtime), and when you last logged caffeine, if another app writes it into Health (to show how long before sleep that was). These describe your daily routine, so they stay with you.
We do read what you eat, if some other app writes it there: energy, protein, carbohydrates, fat and water. Not to count calories at you — we don't — but to explain how what you ate landed on your sleep and your load. You already keep that diary somewhere; we would rather read it than ask you a second time. Turn those categories off in Health and everything else keeps working.
From Whoop or Oura, if you connect them. Sleep, heart rate variability, resting heart rate, recovery or readiness score, steps, and the length of workouts you recorded — so the app knows you trained and doesn't ask where you have been. Plus the access tokens needed to fetch all this. Tokens are stored on our server and are never sent to your phone or anyone else. We ask those providers for nothing beyond this list: not your name, not your email, not your body measurements.
Sensitive. If you turn on cycle tracking: the start date of your last period and your average cycle length, and the moment you turned tracking on — that is your consent. Turning tracking off withdraws it: the dates and the consent are deleted, not just hidden. If you mark your periods in Apple Health, the app asks — separately, only when you turn tracking on — to read them, and works out two numbers on your phone: the day your last period started and your usual cycle length. Only those two numbers reach our server; your day-by-day record stays in Health. If you note physical limitations: the movements to avoid. These live in a separate, isolated table that the app cannot read directly — only through two narrow functions that return your own row — are excluded from any analytics, and are never sent to an AI provider.
Social and marketplace, if you use them. Your public name, username, photo and bio; posts with photos or video and their captions; comments, likes, follows and direct messages; your shop, its products and contact details; reviews and helpfulness votes; reports you send and people you block.
If you apply to be a specialist. What you write about yourself — education, years, what you work with — and, for physiotherapists and doctors, a licence number and the authority that issued it. Plus our decision on the application: its date, who signed it, and the reason if it was not accepted. Your specialisation and what you wrote about yourself become visible to everyone once the application is signed; the licence number, the issuing authority and the reason for a refusal do not — they stay between you and us. Applying is entirely your choice, and the application is deleted with your account.
Subscription, if you buy one. Apple tells us the subscription's identifier, which plan it is, whether it is active and when it runs out — and whether it was a real purchase or a sandbox test. We never see your card, your Apple ID or your name. What you paid stays between you and Apple; we only ask them whether your access is on.
Notifications. If you allow them, a device token from Apple so we can deliver a push.
Morning digest — since 29 September 2026. If notifications are on and your sleep reached the app in the last day and a half, one push between 8 and 10 in the morning your time: how you are today, in the same words the app shows, and what the day's plan says now. It is assembled on our server from codes, not written by an AI, and no AI provider sees it. We keep the text, the codes it was built from, when it was delivered and whether you opened it — in its own table, separate from the messages that invite you back, so it never counts against them. "Stop morning digests" on the notification turns it off.
Engagement. When you last trained, how long the gap is, which messages we sent you and whether you came back. This is how the app knows to write first after a break.
Crash reports. If the app closes unexpectedly, the next time you open it we send the app and iOS version, the reason it stopped and the top twelve lines of the stack, together with your account id. No screen contents, no text you typed, no training or health data. We keep the id because otherwise we cannot tell whether something breaks for one person a hundred times or for a hundred people once. There is no third-party crash SDK: this is our own code sending to our own server. You can turn it off in Settings.
Water you log yourself. One number a day: how much you drank, in millilitres, against the date. You enter it by tapping a glass — we do not read it from anywhere, and we do not infer it. It is stored with your account and used for one thing: the progress bar next to today's target. It goes to no one outside, and it is deleted with your account.
What you post in the community. Groups you start or join, challenges you enter and the progress you type into them, meet-ups you create or say you are going to — with the place and time you wrote. Other signed-in people see this: that is the point of it. People who are not signed in do not, and anyone you have blocked does not. Progress in a challenge is a number you type, not something we measure.
Location. Your contacts. Advertising identifiers. There is no analytics SDK and no advertising SDK in this app. Our own code has no third-party dependencies at all; the one exception is Apple Pay, which uses Stripe's own library — see "Who else sees it" below. We do read the food you log in other apps through Health (see above), but we never ask you to count it and never show you a calorie target.
Voice. When you log sets by voice, recognition runs entirely on your iPhone. The audio never leaves the device and never reaches us.
A short phrase — "forty by twelve" — is understood on the phone too, and only the weight and repetitions are saved. A long one — "three sets of twelve, then four with the dumbbells" — is more than the phone can work out, so the recognised text of what you said after the command word is sent to our server and on to our AI provider, which returns the sets it found. The recording still never leaves your phone, and we do not store the text. If you would rather nothing left the device at all, keep to short phrases or type the set in — both write the same thing to your log. Once you have allowed the microphone, it listens the whole time the app is open: on every screen, and while the screen is dark, because the phone usually rests on a bench and a gym leaves your hands busy. Nothing is written down unless you start with a command word, so ordinary talk around you is heard and discarded, never stored and never sent. iOS shows a recording indicator the whole time. You can mute the microphone from the switch on the exercise screen or from the lock screen card, and closing the app stops it.
Camera. A photo of a machine is sent to our AI provider to identify the movement pattern, and is not stored by us afterwards.
Questions you ask the app. You can ask a few things in your own words — why today's weight is what it is, whether to train, what to do today, why your recovery reads low, how a movement is done, what has changed. The list is closed on purpose: anything outside it, the app declines rather than improvises, and questions about pain, injury, medication or eating are declined without leaving your phone.
Most of those answers are worked out on your device or by our own engine, with no AI involved at all. Where an AI provider is used, it is given the conclusion we already reached and short reason codes such as `short_sleep` — never your sleep hours, your heart rate variability or any other raw measurement, and never anything from the sensitive table. Its job is to put our conclusion in ordinary words; if its answer adds a number we did not supply, we discard the whole answer and you see ours. Decisions about load are never written by it.
To tell you what to do today, to remember your working weights, to explain what your recovery means and act on it, to write to you after a break, and to run the social and marketplace features you choose to use. That is the whole list.
Loads are calculated by a deterministic engine from a fixed table of constants — not by an AI model, and not from your personal data beyond your own training history and recovery.
code and the movement name) so it can be phrased in plain language, the machine photo when you use recognition, and the recognised text of a long spoken phrase so the sets in it can be worked out. We do not send your identity, your raw health data or anything from the sensitive table.
your account id and what you bought; when you open a shop it receives the email you give for payouts. Stripe's own library ships inside the app for Apple Pay, and it reports its own usage statistics to Stripe with a device identifier. That library is the only third-party code in the app, and it is present only because a payment token cannot be built by hand.
Other people using NomaSports see what you deliberately publish: your public profile, posts, comments, shop, products and reviews. Your training log, your health data and your cycle data are never visible to them.
On Supabase infrastructure in the Mumbai region (ap-south-1, India). Access to your rows is enforced by the database itself, on every table, so one person cannot read another's data even if the app asked it to.
We keep your data while your account exists. Settings → Delete account removes it immediately and for good: training, workouts from Health, weight before and after training, health signals, cycle data, posts, photos and videos, shop, products, reviews, messages and the tokens of any wearable you connected. Connected providers are disconnected first. There is no recovery afterwards, and no copy kept.
You can also remove parts at any time without deleting the account: disconnect Whoop or Oura in Settings, revoke Apple Health access in the iOS Settings app, delete individual posts, products and reviews.
You can ask what we hold about you, correct it, delete it, or withdraw a permission you gave earlier. Write to the address below.
NomaSports is not intended for people under 16.
If this policy changes in a way that affects what we collect or who sees it, we will say so in the app before the change takes effect.
michael.rspace@gmail.com
NomaSports is not a medical service and does not give medical advice. Its recommendations are deliberately conservative, and they do not replace a doctor or a coach.