Escalo Privacy Policy
Effective date: 7 October 2026 Last updated: 7 October 2026
Escalo ("the app") is operated by Minlu Li, an independent developer ("we", "us"). This policy says what the app collects, why, who else handles it, and how to delete it. Questions and requests: support@escalo.app.
1. The short version
- Your training is stored on your phone first and the logging works offline. You sign in to use Escalo, and your account backs your training up so it can be restored.
- No ads, no tracking, no selling. There are no advertising SDKs in the app, and we do not track you across apps or websites or sell or share your data with advertisers or data brokers.
- Apple Health is write-only. If you turn it on, Escalo writes finished workouts to Health and reads nothing back.
- Analytics are anonymous and can be turned off in Settings → Privacy. They never contain the numbers you logged, text you typed, or your email.
- You can export everything and delete your account from inside the app.
2. What Escalo collects
2.1 Training data you create
- Workouts — an optional title, the date, start and end times, the exercises and their order, supersets, planned set counts and an optional target label.
- Sets — whichever of these the exercise uses: load, reps, duration, distance, side (left/right), RPE, whether the set was completed, and whether it was a warm-up.
- Custom exercises and saved workouts — the names you type and the attributes you choose.
- Food log (Pro, if you use it) — the foods you log with their portions and nutrients, foods you add yourself (with the barcode, if you scanned one), meals you save to log again, and your nutrition targets (§2.5).
- Settings — your unit preference, figure style, theme choice, load step, default rest length, whether the screen stays on during a session, how the end of a rest timer is announced, your analytics choice, your training goal if you chose one, and your body weight if you entered one.
Escalo has no notes field, and does not ask for your height, age, or sex.
Body weight is optional and starts out empty. You can log it as dated weigh-ins, which the app smooths into a trend on your phone. It is used to: show your weigh-ins and their trend on the Body weight page; show your best load on an exercise's Progress screen as a multiple of what you weighed when you lifted it; estimate the active energy of a session (on its summary, on the food day, and in Apple Health if that is on — §2.4); and show protein per kilogram on the food day and a protein range when you set targets. It never changes a record, a set or a total. Training goal is one of three choices asked once at setup, and only orders the suggested workouts.
2.2 Account information
You can sign in with email and password, Apple, or Google. The account holds your email address and an account identifier. If you sign in with Google, Google also passes us your name and profile picture link; they are stored with your account record, and Escalo does not use or display them. With Apple's "Hide My Email" we only see Apple's relay address.
Purchases are handled by Apple. We never see your card; we only learn whether your account has Escalo Pro.
2.3 Anonymous usage analytics
Unless you turn them off in Settings → Privacy, the app sends a short list of usage events to PostHog (US cloud) — for example that a workout was finished, with how many sets and which kinds of exercise. The full list, with everything each event contains, is in the Appendix at the end of this policy. Events are tied to a random identifier created on your phone, never to your account. PostHog also records basic app signals (installed, opened, updated), the app version, and the IP address the request came from, which may be used for a country-level location. There is no session replay, screen recording or crash reporting.
2.4 Apple Health (optional, write-only)
Off by default. If you turn it on and allow access, Escalo writes each finished workout to Health: its type, start and end time and, if you entered a body weight, an estimated active energy calculated on your phone. It never reads from Health. Deleting a workout in Escalo also removes the entry it wrote. You can view or delete these entries in the Health app at any time.
2.5 Food log and meal photos (Pro)
- Search and barcodes. Searches first use a food table inside the app. Online searches and scanned barcodes are also sent to our backend to look them up; a barcode we do not have is looked up at Open Food Facts by number only. Searches and barcodes are not stored.
- Meal photos, label photos and descriptions. Only if you ask, and only after you agree once, a meal photo or a photo of a nutrition label (shrunk on your phone), or a description you typed, is sent through our backend to Google Gemini to identify the foods or read the label. Escalo never stores the photo and deletes its temporary copy right away. Google receives no email or account identifier, does not use it to train its models, and keeps it for 55 days to detect abuse. Only the foods you confirm are saved.
- Checks. Our backend confirms your Pro status with RevenueCat and counts how many photos, labels and descriptions your account sends each day, to enforce a daily limit.
The app asks for the camera only when you scan a barcode or photograph a meal, and for your photo library only when you pick a meal photo. It does not use your location, contacts or microphone.
2.6 Messages you send us
Settings → About → Contact us sends us the category you choose, your message, the exercise you were looking at (if any), and your app version, iOS version and device model, with your account email as the reply address. It never includes your workouts or anything else from your log.
3. Where your data is stored
Everything you log is written to a database on your phone first. When you are signed in, it is backed up to our backend on Supabase (AWS us-east-1, United States), where each account can read only its own rows, and all traffic is encrypted.
What is backed up: workouts, their structure, your logged sets, your custom exercises, your workout templates, your food log, your saved meals and your nutrition targets, your body weight and your weigh-ins, your unit preference, your training goal, and whether you have finished the first-run setup. What is not backed up: your display preferences, your training preferences, and your analytics choice — these stay on the phone.
Exercise images and clips are downloaded from our storage through short-lived links; this sends only ordinary network information such as your IP address.
4. Who handles your data
We do not sell your data. These providers process it only to run the app:
| Provider | What for | Where |
|---|---|---|
| Supabase | Account, backup, exercise media | United States |
| PostHog | Anonymous analytics (§2.3), if on | United States |
| RevenueCat | Subscription status, by account identifier | United States |
| Google (Gemini API) | Reading a meal photo or description (§2.5) | United States and other countries where Google operates |
| Open Food Facts | Looking up a barcode number (§2.5) | France |
| Resend | Delivering Contact us messages to our mailbox (§2.6) | United States |
| Apple, Google | Sign-in if you choose them; Apple handles purchases | Under their own policies |
If you are outside the United States, your data is transferred there; where the law requires it, those transfers rely on the Standard Contractual Clauses in our providers' data processing agreements. We may also disclose data when the law requires it.
5. How long we keep it
- Your training, food log and account — until you delete your account.
- Backups and service logs — deleted data leaves them within 7 days.
- Analytics events — kept for PostHog's retention period for our plan, currently 1 year. They are not linked to your account, so deleting your account does not delete them.
- Meal photos and descriptions — not kept by us; Google keeps them for 55 days to detect abuse (§2.5).
- Contact us messages — deleted from our database after 12 months, or at once when you delete your account. The emailed copy is kept as ordinary correspondence while we need it.
6. Your choices and rights
Turn analytics off in Settings → Privacy. The app works the same either way.
Export your data. Settings exports your full history as a CSV file, and your food log and your weigh-ins as files of their own — free, with or without a subscription.
Sign out. The copy of your training on that phone is removed, and it comes back when you sign in again. Before removing anything, Escalo tries to back up what is still waiting and tells you what it could not; those items are deleted for good once you confirm.
Delete your account in You → ⚙ Settings → Account → Delete account, then type DELETE. This deletes your account, everything backed up with it, your subscription record at RevenueCat, and the copy on that phone. It cannot be undone.
Your rights. Depending on where you live, you can ask to access, correct, export, restrict or delete your data, or object to how we use it, by writing to support@escalo.app. In the EEA and UK our legal bases are the contract with you (running the app and your account) and our legitimate interest in improving the product (analytics, which you can turn off). You can also complain to your local data protection authority.
7. Children
Escalo is not for children under 13, or under the older age your country's law sets. If you believe a child has given us data, write to us and we will delete it.
8. Changes
If we change this policy we will update the date at the top, and tell you in the app before a significant change takes effect.
Appendix: analytics events
The complete list of events Escalo sends, and everything they contain:
| Event | Data sent with it |
|---|---|
workout_started |
how the session was started: empty, repeat, template, baseline, composed, starter, or browse; for a session started from the Next session page, which kind of focus was chosen: auto, full, or region — never which muscle group; for the For you focus, which setting it was at: usual, longer, or new |
workout_finished |
number of exercises, number of sets, number of standalone moves, number of supersets, the share that were supersets, the share that used a non-weight-and-reps logging model, the list of logging-model names used (e.g. hold, per_side), and the session duration in whole minutes |
workout_discarded |
that a session was left without finishing, how many sets had been completed when you left, and how long it had been open in whole minutes |
custom_exercise_created |
the logging model chosen (e.g. load_reps) |
onboarding_completed |
how each step of the first-run setup ended: whether the training-goal question was answered (stated or skipped); where you heard of Escalo (app_store, search, friend, reddit, social, youtube, coach_or_gym, other); what you logged with before (hevy, strong, other_app, notes, none); whether you connected Apple Health (connected or declined) — the setup no longer asks, so this is now always not_asked. A step you skipped is skipped, and one you were never shown is not_asked. Both survey questions are only asked while analytics is on, and offer fixed choices with no free text — never which goal, never your units or body weight |
auth_prompt_shown |
that a sign-in prompt was shown, and where: onboarding, you, or settings |
auth_attempted |
which sign-in method you used: apple, google, password, signup, or recovery — never your email address |
auth_result |
the method used (apple, google, password, signup, recovery) and how it ended: succeeded, failed, or cancelled — never your email address, and never the text of the error |
pro_surface_opened |
which Pro screen you opened (the food day included), whether this build gives you Pro as a preview or as a purchase, and how many rows it had — a count only, never the rows themselves |
pro_teaser_tapped |
which locked Pro card you tapped |
pro_cards_reached |
that the Pro cards scrolled into view, and whether this build has Pro locked, as a preview, or purchased |
report_window_changed |
that you changed how far back a Pro report reads: which report (imbalance, trends, or patterns), the length you picked (1M, 3M, 6M, 1Y, 2Y, or all), and how many of that length back from today you stepped — a count only, never the dates, and never what the report showed |
paywall_dismissed |
which Pro card opened the upgrade screen, and how it closed — the close button or "Not now", the back gesture, or because a purchase or restore completed |
paywall_opened |
that the upgrade screen was opened from somewhere other than a Pro card — settings or workouts_chip — or that a purchase was started from the subscription page in Settings, subscription_page |
purchase_attempted |
which plan you tapped: monthly, annual, or restore — never a price, a product identifier, or a transaction |
purchase_result |
the plan (monthly, annual, restore) and how it ended: succeeded, failed, cancelled, or nothing_to_restore — never a price, a product identifier, a transaction, or the text of the error |
No event ever contains the values you logged, text you typed, which exercise you did, or your email, account identifier or name.