Legal
Privacy
Last updated 1 August 2026 · MindAble Solutions LLC
Back to Beast holds information about an injury you are working around. That is health information, and the way this app is built reflects that — most of the protection here is architectural rather than promissory. Where something is a design decision rather than a policy, this page says which.
The short version
- There is no analytics SDK and no advertising SDK in this app. Not aggregated, not hashed, not “anonymised”. Health data cannot go to either, because neither exists in the build.
- Progress photos never leave your device. There is no photos table on the server, no storage bucket, and no upload path in the code.
- Everything works signed out and offline. An account is optional and only the group needs one.
- Export and delete are one tap from the top of Settings. Not buried, and not a support request.
- Nothing is sold, ever, to anyone. There is no circumstance in which this changes.
What is collected
Only what a feature you used needs. Nothing is collected in the background.
| What | Why | Where it lives |
|---|---|---|
| First name, age, height, weight, sex at birth | Age and a small set of health history answers change how urgently certain symptoms should be looked at. They are weighting inputs for the safety check, not demographics, and are never used to target content. | Device, and your own account row if signed in |
| Your safety-check answers and the result | To tell you who to see and how soon, and to withhold content that shouldn’t be suggested until someone has looked. | Device + account |
| Where it hurts, how it behaves, what you can’t do | To build the plan and pick movements. | Device + account |
| Sessions, sets, loads, reps and pain flags | The record the whole product runs on — progress, load adjustment, and the clinician summary. | Device + account |
| Sleep and resting heart rate, from Apple Health | Only if you connect it. Read-only, and only these two. The app has no ability to write anything to Health. | Device only. The readiness score is synced; the samples behind it are not. |
| Progress photos | Your own before-and-after comparison. | Device only. Never uploaded, by design. |
| Posts you write in the group | To show them to other people in your group. Your first name and phase are attached; nothing else about you is. | Server, visible to your group |
| Your email address, if you join the launch list | To send you one email at launch. | Server, readable only by us |
What is never collected
- Your location. The app never asks for it.
- Your contacts, your calendar, your microphone.
- Any advertising identifier. There is no tracking in this app, and the App Store privacy label says so.
- Your surname. The app never asks for one, so there is none to leak.
- Anything at all if you never open the relevant screen.
Where your data goes
To exactly one place: a Supabase (PostgreSQL) database operated by us in the United States, and only if you are signed in. Every table carrying health data has row-level security scoped to the account that owns it, which is enforced by the database itself rather than by the app asking nicely. We have tested this by attempting to read another account’s rows and being refused.
Payments go through Apple. We never see your card, and RevenueCat — the service that tells the app whether a subscription is active — receives a subscription status and an anonymous identifier, never your health data.
Nothing is transferred to an advertiser, a data broker, or an AI training set.
The group
The group is the only place where something you write is shown to another person. It is grouped by body area and phase, never by anything the app inferred about you — and the app does not infer conditions in the first place.
Posts are moderated. Reports are unreadable by every user, including the person reported, so reporting somebody cannot come back to you. You can delete your own posts and block anyone, and blocking happens on the server, so a blocked person's posts stop reaching your device rather than being hidden on it.
Getting rid of it
Settings → Export everything writes a single file containing everything the app holds about you, and hands it to you.
Settings → Delete everything removes every row you own, on the device and on the server, in one action. It is confirmed twice because it cannot be undone. One honest caveat: the empty authentication account itself remains, because removing it needs a privileged key this app deliberately does not carry. Email us and we will remove it by hand.
Children
Back to Beast is not directed at children and is not intended for anyone under 16. We do not knowingly collect anything from them.
Your rights
Wherever you live, you can have a copy of your data and you can have it deleted — both are in the app, without asking us. If you would rather ask a person, or you want the authentication account removed too, write to support@backtobeast.com and we will do it within 30 days.
If you are in the EU or UK, our lawful basis for processing health data is your explicit consent, which you give on the scope screen before any health question is asked, and which you can withdraw by deleting your data.
Changes
If this policy changes in a way that affects what is collected or where it goes, the app will tell you in the app rather than quietly updating this page.
Contact
MindAble Solutions LLC · support@backtobeast.com
Back to Beast is a general wellness product. It is not a medical device and has not been evaluated by the FDA. It does not diagnose, treat or cure anything.