Privacy Policy

Last updated: September 11, 2026

Rocky ("we", "us", "the app") is a gym workout tracker and AI coaching app. This policy explains what information we collect, how we collect it, how we use it, and who we share it with — including the third-party AI service that powers Rocky's coaching agent and the "Lazy add-in" feature.

1. Information we collect and how

2. How we use your information

We use the data above for the following purposes only:

We do not use your data for advertising, profiling for advertisers, or any purpose unrelated to providing the service. We do not share your data with anyone except the sub-processors listed in Section 4.

3. AI features and third-party processing

Rocky uses Google Vertex AI (Gemini models) for two features. We call Vertex AI through Google's global endpoint, which means Google may process the request in any of its global Vertex AI regions rather than a single fixed region (see Section 9 on international transfers). Both features are accessed only through our backend; the app never talks to Google directly.

3a. Coaching agent (the daily plan)

3b. Lazy add-in (free-text parsing)

3c. Equivalent protection and contractual terms

Google is contractually bound by the Google Cloud Data Processing Addendum and the Vertex AI Service Specific Terms, which provide data-protection commitments equivalent to those we make to you in this policy. Google may not use your data for its own purposes.

4. Other sub-processors

We use the following additional service providers to run Rocky. They are contractually required to protect your data and are not permitted to use it for their own purposes.

5. Information we do not collect

5a. Apple Health and Health Connect

Rocky can, if you turn it on, save your finished workouts to Apple Health (iOS) or Health Connect (Android). This is opt-in and off by default — enable it from Profile → Health. It is write-only: Rocky requests permission only to add workout records (and, on Android, calorie records) and never requests or uses permission to read any health data. What is written for each finished workout is the workout type (e.g. strength training, running), its start and end time, and an estimated energy burn calculated from the workout's duration and your bodyweight (this is a rough estimate, not a measurement, and is labelled as such). Nothing from Apple Health or Health Connect is read by the app, sent to our servers, or shared with any third party. You can turn the sync off at any time from Profile → Health; you can also revoke Rocky's access in iOS Settings → Health → Data Access & Devices → Rocky, or in the Health Connect app on Android. Data already written stays in Apple Health / Health Connect under your control and can be deleted there. Our use of Health Connect complies with Google's Health Connect permissions policy: the data is written solely to provide the feature described here and is never used for advertising, sold, or shared.

6. Storage and retention

Data is stored in a Postgres database on a server we operate, hosted with Hostinger in Mumbai, India. All connections to and from the backend use TLS. Nightly backups and continuous write-ahead-log backups are stored off-site in Cloudflare R2, where they are encrypted at rest by Cloudflare; backups are retained for 14 days on a rolling basis.

We retain your workout, profile, coaching notes, and readiness data for the life of your Rocky account. When you delete your account, all of your workout history (including cardio sessions), routines, PRs, profile, bodyweight history, coaching notes and chart commentary, readiness check-ins, planned sessions, agent run audit rows, push tokens, and preferences are purged from our systems within 30 days. Backups that may still contain your data roll off within a further 14 days. Lazy add-in free-text and agent prompts are not retained by Google Vertex AI (see Section 3); on our side, prompts are processed in memory and not persisted — only the model's structured response (planned session and coaching notes) is stored.

Purchase and subscription state (Section 1) is retained while your account exists and is deleted with it; the stores and RevenueCat retain transaction records under their own policies (Apple and Google receipts cannot be deleted by us).

7. Your rights — and deleting your account

You can delete your Rocky account and all associated data at any time:

You can also:

8. Children

Rocky is not directed to children under 13 (or under 16 in the EEA / UK). We do not knowingly collect data from children.

9. International data transfers

Your data is primarily stored and processed in India (our Hostinger-hosted server in Mumbai). Additional processing occurs in the United States (Clerk; Expo; Cloudflare, which stores our database backups in its R2 object storage) and the European Union (PostHog, Frankfurt). The coaching-agent and Lazy add-in prompts described in Section 3 are sent to Google Vertex AI through Google's global endpoint, so that specific processing may occur in any Google Cloud region worldwide rather than a single fixed location; in all cases it remains governed by the Google Cloud Data Processing Addendum and is not retained or used to train Google's models. Where required by applicable law (including for users in the EEA, UK, and Switzerland), transfers rely on the standard contractual clauses incorporated in our sub-processors' agreements.

10. Changes

If we change this policy we'll update the date above and, for material changes, notify you in-app.

11. Contact

[email protected]