cave — Privacy Policy

Last updated: 19 October 2026

cave is a training coach. This policy explains exactly what it collects, where that goes, and what you can do about it. It is written to be checkable against the app's behaviour rather than to sound reassuring.

Who we are. Abdullah Ahmed ("we", "us"), an individual developer based in Egypt. cave is operated from Egypt; your data is stored in the United Kingdom (see §3). Contact: abdullah@getcave.app.

Who publishes it. cave is distributed on the App Store through the Apple Developer account of Yaseen Ahmed, so that is the seller name shown on the App Store listing. That account is the publisher only: it has no access to your data, and everything described in this policy is done by, and answerable to, the operator named above.

1. Your account

cave asks you to sign in before anything else. There are two ways in:

• Sign in with Apple, the normal route. cave is an iPhone app, so you already have an Apple ID. When you tap the button, cave asks Apple for your name and email address; Apple's own sheet lets you edit the name and hide the address before anything is shared.
• Sign in with email, for accounts we issue directly: an address and a password, handed to you by us. It exists for people whose Apple sign-in will not complete on their handset, and for App Store review. You cannot register this way inside the app. The password is checked by Supabase Auth (§3), which stores only a salted hash of it; we never see it in plain text.

The account exists for one reason. Your plan, your logs and everything the coach has learned about you are attached to it rather than to the handset, so a new phone, a reinstall or a mis-tap on Delete App does not end your training history. Signing back in anywhere brings it with you.

What we receive when you sign in

• A user identifier for you. This is what every row of your data is keyed to.
• Your email address, if you let the provider share it. With Sign in with Apple you can choose Hide My Email, in which case Apple gives us a relay address instead of your real one, or nothing at all. An issued email account carries the address we issued it to. cave works exactly the same either way; nothing in the app needs your address, and we do not email you.
• Your name, as you choose to share it on Apple's sheet. It is used for one thing: the coach addresses you by it, and onboarding skips the question because Apple has already answered it. Apple shares the name only the first time you authorize cave, so we store it with your account to avoid asking you again on a new phone. You can edit it on Apple's sheet before sharing.

We do not ask Apple for your profile photo, your contacts, or anything else, and we never receive your Apple password.

Signing out is not deleting. Me → Settings → Sign out leaves your data with us so you can sign back in and pick it up. Delete account, in the same place, is the one that erases it, and the account with it. See §6.

2. What cave collects

When you sign in

• The user identifier, the email address if shared, and the name if shared, described in §1.

Things you tell it, to build your plan

• A first name, if you choose to give one, typed in onboarding or under Me → Settings → Account. Onboarding never asks for it after Sign in with Apple. It is used to address you and nothing else.
• What you are training for, how many days a week you can train, and when.
• Constraints you select or type — including self-reported injuries or physical limits ("knees", "shoulder", "no gym", or anything you write yourself).
• Anything you type or say to the coach in conversation.

Things cave records as you train

• Sessions you log: what you did, how long, how it felt, whether you completed or skipped it.
• Sets and loads you record against an exercise.
• The training plan itself, and each approved change to it.
• Durable facts you approve for it to remember ("no barbell this month", "hip needs care").

Things you attach, if you choose to

• Photos and PDFs you attach in the onboarding chat or the coach chat: a timetable, a physio's letter, a screenshot of a coach's message. They are read in two ways. Text is recognised on your device. The picture itself is sent to the coaching model (§3.3, Google, or a fallback when Google is unavailable) so it can read what the text layer cannot, and only if you have agreed to that on the consent screen. What it finds is offered back to you as chips; only what you tap is kept. The photo itself is not stored on our server.

Things your device provides

• Microphone audio, only while you hold the mic, and only if you grant permission (see §3 for what happens to it).

How you use the app

• cave records a short log of product usage events: which screens you reached in onboarding, that the app was opened (once a day at most), that a workout was started or finished and whether it was completed or skipped, and that a message was sent to the coach. Each event is a name, a time, and sometimes one word of detail (for example "skipped"), together with the app version that wrote it. It does not contain what you typed or said. These events are linked to your account and are used for one thing: to see where people get stuck or stop, so the app can be improved. They are recorded by cave itself, with no third-party analytics or SDK, are not used for advertising, and are deleted with your account (§6).

Notifications cave sends no notifications. It does not ask for notification permission, schedules no reminders, and uses no server push or notification provider. An earlier test build could schedule an optional local reminder the evening before a training day; the current app removes any it left on your phone the first time it opens.

What cave does NOT collect

• No phone number, contacts, photo library access, precise location, or device advertising ID. A photo reaches cave only when you pick it and attach it. The only email address we may hold is the one described in §1, and we do not use it to contact you.
• No third-party analytics, attribution, advertising, or crash-reporting SDK of any kind. The app links no third-party tracking libraries. The only usage data is the first-party event log described above, which goes to our own database and nowhere else.
• No health data from Apple Health. cave does not read HealthKit.
• We do not track you across apps or websites, and we do not sell or share your data for advertising. Our App Store privacy label reflects this.

3. Where it goes

On your device

Your plan, memories, chat history, attached photos, your quiet hours setting, and your consent decision are stored locally. Chat transcripts and attached photos never leave your device except as described in §3.3.

Our server (Supabase)

Your profile, training plan, workout logs, exercise sets, approved memories, the date you agreed to the coaching model (§3.3), and the product usage events described in §2 sync to a Postgres database hosted by Supabase in London, United Kingdom. That is the one place your data is stored. Sign-in for issued email accounts is handled by Supabase Auth in the same project. Every table is protected by row-level security keyed to your account: one user's rows cannot be read by another. The only analysis we run over this data is reading the usage events in aggregate, to see where people get stuck or stop; no third-party tool is involved, and nothing is shared or used for advertising.

If you are in the EU, storage in the UK is covered by the European Commission's adequacy decision for the United Kingdom, so no further transfer safeguard is needed for it. The transfer that does need your consent is the one to the coaching model, described next.

The coaching model

cave's coach, the refinement of your first week, the plan-mode questions in onboarding, and the reading of photos you attach all run on large language models operated by outside companies. Requests go through OpenRouter, which routes them like this:

• Most messages, and the plans cave drafts, go to xAI (Grok 4.3).
• Anything with a photo or file in it goes to Google (Gemini 2.5 Flash). Some short replies, and the tidying of a dictated message, go to Google (Gemini 2.5 Flash-Lite).
• When one of those is unavailable, the request goes to a fallback instead: DeepSeek (deepseek-v4-flash) or OpenAI (gpt-4.1-mini) for messages and photos; Anthropic (Claude Sonnet 4.5), OpenAI (GPT-5) or Google (Gemini 2.5 Pro) for plans; OpenAI (gpt-4.1-nano) for short replies.

What is sent is your message plus the context needed to answer it: your name if you gave one, your goals, your current training week, your approved memories (including self-reported injuries and limits), a summary of recent sessions and logs, and the photos and files you attach.

Nothing is sent until you agree. Before the onboarding chat, cave shows a consent screen that names these companies, lists what is sent, and links this policy. It needs an explicit Agree. If you choose Not now, onboarding still builds your plan, entirely on your phone, from the answers you tap and type; the plan-mode questions use a fixed set; and the coach chat says that sharing is off and where to turn it on. You can change your decision at any time under Me → Settings → Privacy → Model providers, and the app records the date you decided. When the list of companies changes, the coach stays off until you agree to the new list.

Three things about this you should know:

• We instruct OpenRouter to route only to providers that do not retain or train on the request (data_collection: "deny"). We rely on OpenRouter and the providers to honour that; we cannot independently verify it.
• DeepSeek is based in the People's Republic of China. It receives a request only when xAI or Google is unavailable, and then your coaching context is processed outside the UK/EEA and outside the United States. Your stored data sits in the UK (London), so sending it to the coach is an international transfer, in DeepSeek's case to a country the UK and EU have not found to offer equivalent protection. We rely on your explicit consent for that transfer, which is what the consent screen asks for. xAI, Google, Anthropic and OpenAI are based in the United States.
• The coach is optional: if that is not acceptable to you, choose Not now. The plan, the calendar, logging and everything else work without it.

Our own proxy passes these requests through and stores none of them. We keep no log of your conversations, or of the photos you attach, on our servers.

Apple

• Sign-in. When you tap Sign in with Apple, Apple authenticates you and tells us the identifier and, as you choose, the name and email address described in §1. Apple learns that you signed in to cave, and handles that fact under its own privacy policy. We send Apple nothing about your training: not your plan, not your logs, not a word you have said to the coach.
• Speech. When you use voice, cave asks iOS to transcribe it. On devices that support on-device recognition this happens entirely on your phone. On devices that do not, Apple performs the transcription on its servers under Apple's privacy policy. cave never stores the audio itself.
• Purchases. cave is currently free and makes no purchases, so nothing is sent to Apple's payment systems and no subscription record exists. If subscriptions are introduced, they will be processed by Apple, we will never see your payment details, and we would store only whether an active subscription exists.

4. Why we are allowed to do this (UK/EU users)

Where UK or EU data protection law applies, our lawful bases are:

You can withdraw consent for health-related information at any time by deleting those entries under Me → Memory, or by deleting your data. You can withdraw consent for the coaching model under Me → Settings → Privacy → Model providers, which stops every model call from that moment. Withdrawing does not affect processing already carried out. You can object to the usage event log at any time by emailing abdullah@getcave.app, and deleting your account removes it entirely.

5. Health information

Some of what you tell cave — an injury, a joint that hurts, a limit a clinician gave you — is information about your health. We treat it as sensitive:

• It is used only to shape your training plan and to keep sessions off your week that would aggravate it.
• It is stored under the same row-level security as everything else.
• It is included in what is sent to the coaching model, once you have agreed on the consent screen, because it is the reason the plan changes.
• It is never sold, never shared for advertising, and never disclosed to anyone except the processors named in §3.
• cave is a coach, not a clinician. When you record an injury, the app says so on the spot and asks you to check with a doctor. Working around an injury is not treating it.

Residents of Washington State, Nevada, and Connecticut have specific rights over consumer health data. See §9.

6. How long we keep it

We keep your data until you delete it. There is no automatic expiry, except:

• Temporary constraints you set ("no gym this week") expire on their own date.

Delete account (Me → Settings → Account) deletes your account itself, and with it your rows from every table we hold them in: profile, workout logs, exercise logs and sets, memories, plans, plan snapshots, win days, product usage events, entitlement, and rate-limit records. It also clears everything stored locally on the device. The deletion runs on our server, in one step, from inside the app; it needs no email, no support request and no verification, because it acts from the signed-in device itself. It is immediate and irreversible, and the sign-in screen that follows confirms it happened. Sign out, next to it, does none of that: it releases the device and leaves your data with us until you come back.

Deleting your account does not by itself remove cave from the list of apps using your Apple ID. You can do that in the iPhone Settings app, under your name, Sign-In & Security, Sign in with Apple.

7. Security

Data in transit is encrypted with TLS. Data at rest is encrypted by Supabase. Access is restricted by row-level security tied to your account, so no other user of cave can read your rows. The password you use with Apple is never sent to us. For an issued email account, Supabase Auth stores a salted hash of the password, never the password itself. No system is perfectly secure, and we do not claim otherwise.

8. Children

cave is not intended for anyone under 18, and we do not knowingly collect data from them. If you believe a child has provided us data, contact abdullah@getcave.app and we will delete it.

9. Your rights

Wherever you are, you can see everything cave remembers about you (Me → Memory), correct or delete any of it, and delete your account and everything with it (Me → Settings → Account → Delete account).

Depending on where you live you may also have the right to access a copy of your data, to object to or restrict processing, to portability, and to complain to a regulator — in the UK, the Information Commissioner's Office; in the EU, your national authority.

California. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. Exercising your rights will never get you worse service.

Egypt. cave is operated from Egypt, and Law No. 151 of 2020 on the Protection of Personal Data may apply to that processing. Under it you can ask what we hold about you, have it corrected, and have it erased. The fastest route to all three is inside the app — Me → Memory shows and edits everything cave remembers, and Me → Settings → Account → Delete account erases the lot, account included — because neither needs us to identify you first.

Washington, Nevada, Connecticut. Where the My Health My Data Act or equivalent applies, the health-related information described in §5 is consumer health data. We collect it only with your consent, use it only to provide the app, and do not sell it. To exercise a right or withdraw consent, use Delete account or contact abdullah@getcave.app.

To make a request, email abdullah@getcave.app from the address attached to your account, which is how we identify you. If you signed in with Apple and chose Hide My Email, write from the relay address Apple gave you — it reaches us and it matches your account. If you have an issued email account, write from that address. If Apple gave us no address at all, we have no way to connect an email to your rows, and the complete route is Me → Settings → Account → Delete account inside the app, which needs no verification because it acts from the signed-in device itself.

10. Changes

If we change what we collect or who we send it to, we will update this policy and its date, and show a notice in the app before the change takes effect.

11. Contact

Abdullah Ahmed · abdullah@getcave.app

The current version of this policy is published at https://getcave.app/privacy, and the same text is bundled inside the app under Me → Settings → Privacy Policy. They are rendered from one source, so if the two ever disagree, that is a bug worth reporting.