Barcall
Privacy Policy
Last updated: 8 August 2026
Barcall is a lifting app that decides what you should lift next. Almost everything it needs to do that stays on your phone. This page says exactly what does not, and it is written from the code rather than from a template — every claim below can be checked against the app's source.
The short version
Your training — every plan, session, set, load and note — is stored on your phone. It is never sent to us.
Your body measurements and anything read from Apple Health are used on your phone and nowhere else. They are never sent to us, never used for advertising, and never shared with anyone.
Your progress photos never leave your phone. Not the images, not thumbnails, not a count, not a flag saying they exist.
An account is optional. You can skip it during setup and the app works in full.
If you make one, we hold your email address and your six onboarding answers. That is the whole of what we hold — one row, in one table.
There is no analytics SDK, no crash reporter, no advertising SDK and no tracking of any kind in this app.
You can delete your account and everything on your phone from inside the app, in Settings, without asking us.
Who we are
Barcall is published by Nikhil Kumar, Bhartiya City, Bangalore, Karnataka 560064, India. Questions about this policy, or about the data we hold, go to support@barcall.fit.
What we collect, and why
Your account
An account is optional. Setup offers you one and you can skip it; the plan, the prescriptions, the logging and the photos all work without it, because none of them are on our server to begin with. The account exists so your plan survives a new phone, and so we can reach you. You can create one later from Settings, or never.
If you do create one, you give us:
Your email address. It identifies the account, it is how you sign back in on a new phone, and it is the only way we can reach you.
A password. We never see it. It goes straight to our authentication provider, which stores a hash of it; the app keeps only the resulting session token, in the iOS Keychain.
Your email address is also cached on your own phone so the app knows who is signed in without a network call at launch.
Your six onboarding answers
When your plan is built, six answers from setup are saved against your account:
How many days a week you train
Your goal
Where you train (gym, home, and so on)
How long you have been lifting
Any movements you asked to avoid
Whether you ticked the box asking for training tips and product news
These are stored so your plan can be rebuilt if you move to a new phone. The marketing box is unticked by default; if you leave it unticked we do not send you marketing email.
Nothing else about your training is sent with them. Not a single set.
Your purchase
Subscriptions and the lifetime purchase are handled entirely by Apple through the App Store. Payment details are entered into Apple's own interface, never ours — we never see a card number, a billing address or your Apple ID. The app asks Apple one question, "is this person entitled?", and gets back yes or no.
What stays on your phone
All of the following is stored on your device and is never transmitted to us:
Your training data. Plans, training days, exercises, sessions, every set, every load, every rep, every note. This is stored in the app's local database.
Your body measurements. Shoulder circumference, and a local copy of your waist measurement if Apple Health declined to take it.
Everything read from Apple Health — see below.
Your progress photos — see below.
Your settings, reminders and notification schedule. All notifications are scheduled locally by iOS; there is no push server.
Your subscription state, which is held by Apple's own on-device receipt cache.
iCloud backup
If you are signed in to iCloud, your training data syncs through Apple's CloudKit into your own private iCloud database. This is a copy Apple holds for you, on your account, under Apple's privacy policy. We cannot read it, and we have no access to it of any kind. Settings tells you which of the two states your phone is actually in — "Synced to your iCloud" or "On this phone only".
Deleting the app's data from inside the app clears that iCloud copy too. Managing iCloud itself is done in iOS Settings, not by us.
Apple Health
The app reads five values from Apple Health, and only these five:
Body mass
Body fat percentage
Lean body mass
Height
Waist circumference
It writes back three things: your finished lifting sessions (so an hour of training counts toward your rings), and any body mass or waist measurement you typed into the app yourself, so that number is not trapped here.
It does not read sleep, heart rate, heart rate variability, or anything else. It asks for permission the first time you open the body section, not at launch, and the app works without that permission.
Health data is used only to draw your own charts and to work out what a bodyweight exercise actually loads. It is read on demand, drawn, and discarded. It is never sent to us or to any other server, never used for advertising or marketing, never shared with any third party, and never used to make decisions about anything other than what is shown on your screen. Your most recent bodyweight is cached on the phone only, so the set card can be drawn instantly.
You can revoke Health access at any time in iOS Settings → Privacy & Security → Health.
Progress photos
Progress photos are the most sensitive thing this app holds, and the storage is built on the assumption that everything else will eventually be wrong about something.
They are written into the app's own private storage with complete file protection, which means they cannot be read while the phone is locked — not even by this app, not by a backup extraction.
The photo section is behind Face ID, Touch ID or your passcode, every time you open it. If the phone has no passcode at all, the section does not open.
They are never written to your photo library. The only route out is you explicitly exporting a comparison you chose to make.
Nothing about them ever reaches our server. Not the image, not a thumbnail, not a hash, not a count, not a boolean saying photos exist. There is no network code anywhere near this feature.
There is no analytics event carrying photo data, because there is no analytics.
Deleting them in Settings deletes them. There is no other copy anywhere, which also means we cannot recover them for you.
Tracking and analytics
There are none. No analytics SDK, no crash or error reporting service, no advertising or attribution SDK, no session recording, no device fingerprinting, no App Tracking Transparency prompt because there is nothing to ask about. The app builds against exactly one third-party library — the client for our authentication and profile database, described next.
We do not sell your data, we do not share it with data brokers, and we do not build advertising profiles.
Who else processes your data
Supabase hosts the authentication service and the one table we have. It holds your email address, your password hash, and the six onboarding answers above, in a single profiles row. Nothing else is ever sent there — there is no file storage on the project at all, so there is nowhere for a photo or a Health reading to go even if something tried to send one. Every row is behind row-level security scoped to your own signed-in session, so an account can read its own row and no other.
Apple processes your purchase, hosts the App Store, and — if you use iCloud — holds your own private backup of your training data. Apple's handling of both is governed by Apple's privacy policy, not ours.
There is nobody else.
Where your data is held
The Supabase project runs in AWS us-west-2, in the United States. If you are outside the US, the email address and six answers described above are transferred there and stored there. Nothing else is, because nothing else is ever sent.
Your training, your Health data and your photos are not transferred anywhere at all — they stay on your phone, and your iCloud copy is held by Apple under Apple's own terms and regional arrangements, which we have no part in.
Your account email and the six setup answers are stored by Supabase in the United States (AWS us-west-2). For anyone in the EEA or the UK that is a transfer out, and we rely on the Standard Contractual Clauses approved by the European Commission, and the UK Addendum where the UK GDPR applies. They reach us through Supabase's Data Processing Addendum, which incorporates the SCCs and binds Supabase as our processor. You can ask us for a copy of the relevant terms at any time.
How long we keep it
Your account row and its six answers are kept until you delete your account. Deleting the account is a hard delete: the login is removed and the profile row is deleted with it, immediately, and it cannot be undone or recovered.
Data on your phone is kept until you delete it, or until you delete the app.
Deleting your account and your data
All of this is in the app, under Settings. None of it requires emailing us.
Delete account removes your account and your onboarding answers from our server, then deletes the plan, every logged session and every progress photo from this phone.
Delete all data wipes the plan, sessions, sets and photos from this phone and from your iCloud copy, and leaves your account in place.
Delete all photos removes every progress photo and nothing else.
Each is behind a confirmation that states plainly what goes and what stays.
If you would rather we did it, write to support@barcall.fit.
Your rights
Depending on where you live, you may have the right to ask for a copy of the data we hold about you, to correct it, to have it deleted, or to object to how it is used. For the data on our server that is your email address and six answers — the in-app delete covers the deletion case completely and instantly. For anything else, write to support@barcall.fit.
Marketing email, if you opted in, has an unsubscribe link on every message, and unsubscribing changes nothing about your account.
Children
Barcall is not designed for or directed at children. It prescribes barbell training loads, which is not something we intend to put in front of a child, and we do not knowingly collect any information from anyone under 13, or the older age your own country sets for agreeing to this on your own. If you believe a child has created an account, write to support@barcall.fit and we will delete it. In India that older age is 18, and the next section says what follows from it.
India's data protection law
We are based in Bangalore, which makes us what India's Digital Personal Data Protection Act 2023 calls a Data Fiduciary, and makes you a Data Principal. The Act applies to us wherever you are reading this. This section says what it adds to everything above.
Consent, and taking it back
Indian law starts from consent. It has no "legitimate interests" ground to lean on — the alternatives it allows are things like a court order, a medical emergency or an employment relationship, and none of them is why we hold your email address and your six answers. We hold them because you made an account and told us to.
The Act wants that consent asked for against an itemised list: exactly which data, for exactly which purpose. That list is above, and it is short. Your email address, so you can sign back in on a new phone and so we can reach you. Six answers, so your plan can be rebuilt on a new phone. One of the six is whether you want marketing email. There is no seventh thing.
It follows that withdrawing your consent and deleting your account are the same act. Delete account, in Settings, takes the consent back and removes the data in one move — in the app, without asking us, as directly as the account was made in the first place. The Act requires that taking consent back is as easy as giving it. Here it is the easier of the two.
The one piece you cannot yet change in the app is the marketing tick from setup. Until you can, every marketing email carries an unsubscribe link, and one line to support@barcall.fit does the same thing. A switch in Settings is the right answer and it is not built yet.
Your rights as a Data Principal
Access. A summary of what we hold about you, and who else has handled it. Both are already on this page — one row with your email address and six answers, and the only company that touches that row is Supabase. Ask and we will confirm it for your own account.
Correction. The six answers are written once, when the account is made; there is no screen that edits them afterwards. Write to us and we will correct them.
Erasure. Delete account, in Settings. Immediate, and it takes everything on the phone with it.
Nomination. This one has no European equivalent. You can name someone to exercise these rights for you if you die or become unable to exercise them yourself. There is no screen for it — write to us with who they are and how to reach them. Given how little we hold, what it really buys them is the standing to have your account deleted.
Grievance redressal. Below.
All of these go to support@barcall.fit.
Grievance redressal
If we have got something wrong with your data, tell us first — the Act asks you to come to us before you go to the regulator.
Write to support@barcall.fit and put "Grievance" in the subject line. It reaches Nikhil Kumar, and there is no team for it to get lost inside. We will resolve it within 30 days. The Rules allow up to ninety; we do not intend to use them.
If we do not resolve it, or you are not satisfied with how we did, you can take it to the Data Protection Board of India.
No Data Protection Officer, and no Consent Manager
A Data Protection Officer is required of a Significant Data Fiduciary — an outfit the Central Government has specifically named as one, on grounds like the volume and sensitivity of what it processes. Nobody has named us, and one email address and six answers per person is not the kind of processing that gets you named. So there is no DPO. The person who answers questions about your data is Nikhil Kumar, at support@barcall.fit, and that is the contact the Act requires us to publish.
The Act also creates Consent Managers — registered services through which you could give, review and withdraw consent across many companies in one place. Using one is your option, never our requirement, and we are not connected to any. Consent to us is given and taken back in the app.
Children: eighteen, not thirteen
Indian law counts anyone under 18 as a child — a higher line than the one in the section above, and the highest of any regime this app answers to. Processing a child's data requires verifiable consent from a parent, and tracking, behavioural monitoring and advertising aimed at children are prohibited outright, consent or no consent.
We have no way to verify a parent, so Barcall is not offered to anyone under 18 in India. Do not make an account. We do not ask your age and we cannot check it, so this one rests on you.
The other half we meet by construction: there is no tracking, no behavioural monitoring and no advertising in this app, for anyone, at any age.
Language, breaches, and the timetable
Language. This is written in English. If you would rather have it in one of the languages listed in the Eighth Schedule to the Constitution, ask at support@barcall.fit and we will get you one.
Breaches. If the one row we hold is ever breached, we will tell you and the Data Protection Board of India, without waiting to be asked.
The timetable. The Act is arriving in stages. The Rules under it were published in November 2025, and most of the duties in this section formally bite in May 2027. We are not waiting for the date.
Changes to this policy
If this changes in a way that affects what we collect or where it goes, the date at the top changes and the new version is published here before it takes effect.
Contact
support@barcall.fit
Nikhil Kumar, Bhartiya City, Bangalore, Karnataka 560064, India
Barcall — Nikhil Kumar