Lissom privacy policy

Your quiz answers (goals, focus areas, how long you sit each day), your session history and streak, favourites, custom routines, program progress, reminder time and other settings are stored on your device. We don't receive them.

iCloud backup (iPhone only). Lissom copies that data to your own iCloud key-value storage so it comes back on a new iPhone. Apple holds this copy under your Apple ID; we can't see it. If iCloud is off, nothing is copied.

Apple Health (iPhone only, optional). If you allow it, Lissom saves each finished session to Apple Health as a Flexibility workout (start time, end time, minutes). Lissom never reads data from Apple Health, and what it writes is not sent to us.

Reminders are notifications scheduled on the phone. We don't use push notifications.

On first open, Lissom creates a random ID for that installation. It isn't linked to your name, email, phone number or advertising ID. The services below use it in place of an account. Reinstalling the app creates a new one.

Purchases (RevenueCat). Payments are taken by Apple or Google; we never see card details. To check whether you have Lissom Pro, the app sends the install ID and the store's purchase receipt to RevenueCat, which keeps your purchase history, country and device type. Our server keeps a copy of whether that install ID has an active subscription, to apply the AI limits below.

AI routines. When you use "Describe your session", the text you type is sent to our server and passed to an AI model through OpenRouter, limited to model providers that don't keep the data. Our server does not store or log what you typed. It keeps the install ID and a count of requests, so the free and Pro limits work. On iPhone the app also proves it is a genuine copy using Apple's App Attest; the server keeps the resulting key for that install. On Android it asks Google Play for an integrity check instead: Google Play services sends Google information about the app and device (whether this is the copy of Lissom from Google Play and whether the device is genuine and unmodified), and our server asks Google for the result, which it uses for that request only and doesn't store. Please don't type health details you don't want sent to the model.

Usage analytics (PostHog). The app sends a small set of events, such as a session started or completed, the paywall shown, a trial started, or whether you allowed reminders or Apple Health, with the install ID, app version, device model and operating system. These go to PostHog on its EU servers. We don't send quiz answers, focus areas, the text of AI requests or any data from Apple Health. Session replay and automatic tap tracking are off.

Crash reports. If the app crashes, a report with the error, app version, device model and operating system goes to our own error tracker on Prograsec's server. It carries no name, email or IP-based identity, and no quiz answers.

Exercise content. The app checks our server (lissom.prograsec.com) for updated exercises and routines. Like any web server, it sees your IP address while answering. We use IP addresses only for rate limiting and security and don't store them with the install ID.

To run the features you use, to unlock what you paid for, to stop abuse of the AI feature, to fix crashes, and to understand which parts of the app help people keep stretching. We don't use your data for advertising and we don't sell it.

Data on your phone stays until you delete it or the app. Request counts and subscription status on our server are kept while the install ID is in use and removed when we no longer need them for the limits. RevenueCat keeps purchase records for as long as we use it for Lissom, as tax and refund rules require. Analytics events and crash reports are kept only as long as they help us improve the app and fix errors, then deleted.

In Lissom, Settings > Delete all my data erases everything on the phone and the iCloud backup. Data Lissom wrote to Apple Health can be deleted in the Health app. To remove what our server and our providers hold for your install, email business@prograsec.com from the app (Settings > Contact support) and ask us to delete it; we reply within 30 days. Deleting data does not cancel a subscription; see how to cancel.

Depending on where you live, you may have the right to ask for a copy of your data, to correct it, to delete it or to object to how we use it. Because Lissom has no account, we can only find data linked to an install ID, so please write from inside the app. You can also complain to your local data protection authority.

Lissom is not directed at children under 13, and we don't knowingly collect data from them. If you think a child has used the AI feature, email us and we'll delete what we hold.

Our server and error tracker run on a server we rent and manage. RevenueCat and OpenRouter are based in the United States, and PostHog stores Lissom's data in the EU. Each provider protects the data under its own terms and the law where it operates.

If we change what Lissom collects, we'll update this page and the date at the top before the new version of the app ships.

M/S Prograsec, Punjab, Pakistan. Email business@prograsec.com.