RecoverX Privacy Policy

Last updated: September 26, 2026: cycle estimates (phases, the next period, a fertile window) made on your iPhone. September 24, 2026: covers RecoverX 2.0: the new Apple Health types, Apple Watch, background refresh, widgets and Siri, settings in iCloud, and where the AI Coach is offered. Applies to RecoverX 2.0 and later (1.3.1 was never released); the policy for 1.3 and earlier is summarized at the end.

The short version

• Your health readings are never sent to us. RecoverX reads Apple Health on your iPhone and scores your recovery there. Your settings follow you to a new iPhone through your own iCloud, which we cannot read; no health data goes with them.
• Two optional features send something to other people or companies, and only when you use them: the cloud AI Coach on Pro (your typed questions and a coarse summary of today's score go to our proxy and then to Anthropic) and Crew (your display name and three daily scores are stored in your own iCloud and shared with the people you invite).
• We use a crash reporter (Sentry) that receives technical crash details with health values removed.
• There is no account, no login, no advertising, no data broker, and nothing is sold.

Data we read from Apple Health

RecoverX requests read-only access to these HealthKit types. All access is subject to your explicit permission, and you can revoke any type at any time in iOS Settings → Health → Data Access & Devices.

• Sleep analysis, heart rate, heart rate variability (Apple Watch reports SDNN), resting heart rate, VO₂max, and workout records. These produce your recovery, sleep and strain scores and your training history; VO₂max also gives the cardio fitness on the Heart page and, on Pro, your fitness age.
• Steps, walking and running distance, and cycling distance. Read only inside the window of an effort the app has already detected from heart rate, to tell a walk from a run from a ride. Decline them and detection still works from heart rate alone; the app asks you the type instead of guessing.
• Respiratory rate, wrist temperature during sleep, and one-minute heart rate recovery. Shown as your own trends against your own baseline. They do not change your recovery score, and nothing in RecoverX detects, diagnoses or screens for any condition.
• Biological sex, read once. The published fitness-age reference tables are separated by sex. Decline it and RecoverX says it cannot compute the number rather than guessing one.
• Date of birth, read once to pre-fill your age during setup. You can type your age instead and never grant this.
• Menstrual flow, and the nightly wrist temperature Apple Watch records, used only when you turn cycle tracking on (it is off by default). On your iPhone, RecoverX estimates your cycle’s phases, your next period and a fertile window from the periods you log in Apple Health and that temperature, and shows where you are next to your recovery score. These readings and estimates never leave your iPhone: they are not uploaded, not synced to iCloud and not shared. The estimates are not for contraception or pregnancy planning. Deny this type, or turn cycle tracking off, and the app works normally without it. Turning tracking off deletes the readings it kept; “Turn off and clear” also deletes the check-ins you logged.
• Mindful minutes, the sessions the Breathe and Mindfulness apps log. When an HRV reading falls inside one, RecoverX keeps it apart from your nights, because slow breathing raises HRV. Nothing else uses them.
• The effort rating on a workout, the one you gave it or the one Apple Watch estimated. It shows on your sessions and on the share card, and it does not change your score.
• Walking heart rate average, shown on the Heart page against your own last two months. It does not change your score.
• From Apple Watch's heart features, and only if you use them: AFib History, your ECG results (Apple's classification of each recording and its average heart rate, never the recording itself), and the notifications Apple Watch sends about a high or low heart rate, an irregular rhythm or low cardio fitness. The Heart page lists them exactly as Apple recorded them. RecoverX does not interpret, classify or count them, and none of them changes your score.

New users are asked for all of these when they first connect Apple Health. If you used RecoverX before 2.0, the Heart page shows a card that asks for its new types when you tap it, never at launch. Decline any of them and the rest of the app keeps working; that type's card says it is not available.

RecoverX writes one kind of record to Apple Health: workouts. A session it finds from your heart rate and wrist motion is saved as a workout, so it also appears in the Fitness app; naming it rewrites that record, and “Not a workout” deletes it. A workout you log with Quick Log on Apple Watch is saved the same way. A session you add by hand on your iPhone stays inside RecoverX and is not written to Health. Decline write access and found sessions stay inside RecoverX for the day.

On Apple Watch

The RecoverX watch app reads your heart rate for its live heart-rate screen and saves the workouts you log with Quick Log to Apple Health. It never sends anything to us. It does exchange a few things with your iPhone, over Apple's own connection between the two:

• Your iPhone sends the watch today's score, its band, how many points each of the five signals took off, whether you have Pro, and, on Pro, how far away your next race is.
• The watch sends your iPhone the check-ins you answer on it.
• With Motion & Fitness access, the watch records wrist motion in the background and sends your iPhone one short summary per minute: how much and how rhythmically your wrist moved, and the kind of movement watchOS recognised, such as walking or cycling. The raw motion stays on the watch. Your iPhone uses the summaries to tell what kind of session you did, and deletes them after 30 days.
• The watch keeps a 21-day log of its own battery level, whether it was charging and whether Low Power Mode was on, and sends your iPhone the new readings. Your iPhone uses the log to tell a night the watch spent on the charger, or ran out, from a night you slept badly. The watch uses it to post one “Charge before bed” note on evenings the battery probably won't last the night. That needs the RecoverX complication on your watch face, and you can turn it off in Settings.

All of this stays on your watch and your iPhone.

Background refresh, widgets and Siri

RecoverX can update your score without being opened. When Apple Health receives new sleep, HRV, resting heart rate, workout or Breathe data, iOS may wake RecoverX briefly to read it and rescore the day, and RecoverX asks iOS for one scheduled refresh early each morning. This happens on your iPhone, exactly as if the app were open, and nothing is sent anywhere. Settings → Background refresh shows when it last ran and what started it. Turning off Background App Refresh for RecoverX in iOS Settings stops the scheduled refresh.

Widgets and the watch complication show today's score wherever you place them, so anyone who can see your screen can see it. Lock Screen widgets and complications show only the score and its band; Home Screen widgets can also show the day's headline and where the points came off.

If you ask Siri or run a shortcut (“What's my recovery in RecoverX?”), RecoverX answers on your iPhone with today's score, its band and the reason, and Siri shows or speaks that answer. What you say to Siri is handled by Apple under Apple's privacy policy. A check-in logged from Siri, Shortcuts, Control Center or a widget is saved on your iPhone.

What stays on your device

Everything above, plus your score history, your settings, your sport picks, your daily check-ins, the bed and wake times you type for a night the watch missed, and your usage telemetry (which screens you open, whether you tap the daily score) is stored on your iPhone. Your settings are also kept in your iCloud (see iCloud). Usage telemetry does not leave the phone on its own. The only part that ever does is the short trail of recent events inside a crash report (see Crash reporting), and the in-app “Export my usage data” button shows you exactly what would be shared before you choose to send it anywhere.

Uninstalling RecoverX removes all RecoverX data from the device. If you back up your iPhone to iCloud or to a computer, RecoverX's data is in that backup, as every app's is, and Apple manages it. Your Apple Health data is managed by Apple's Health app and is not affected; workouts RecoverX saved there stay until you remove them in Health. Settings kept in your iCloud stay there after you delete the app, and Crew data you created in iCloud is described below.

iCloud

Your settings follow you to a new iPhone through iCloud's key-value storage, under your own Apple Account. RecoverX keeps these there, and nothing else: your training mode; your main sport, your sport picks and any sport you set by hand; the data source the app reads; your pool length; the automatic-refresh switch; how History is laid out; your notification switches; the weekly usage-share reminder; whether the cloud coach is turned on; the workout-detection switches; your Crew display name; and the date you started using RecoverX.

None of these is a health reading, a score, your age or anything about your cycle, and no health data goes to iCloud with them. Your score history stays on your iPhone. The only scores RecoverX ever puts in iCloud are Crew's, and only if you use Crew (see Crew). We cannot read any of it; Apple stores it under Apple's privacy policy. The sync runs whenever iCloud is on for your Apple Account.

AI Coach

The free coach runs entirely on your iPhone, on Apple's on-device language model (iOS 26, on an iPhone with Apple Intelligence turned on). Nothing leaves the device.

On RecoverX Pro, the coach can also answer from a cloud model. It stays off until you have read what it sends and turned it on (Settings → Privacy → Enable AI Coach, or from the Coach tab), and every chat begins by saying that the answers are AI-generated. When you send it a message, the app transmits:

• the text you typed and the earlier messages of that chat;
• a summary of today's score: the score and its three sub-scores (cardiovascular load, muscular load, stress); how many points each of the five signals (sleep, resting heart rate, HRV, training load, how you said you feel) took off, and in which direction; whether each of sleep, HRV, resting heart rate and load was measured, filled in from your usual, cut short, typed by you, still calibrating or missing; how far your baselines have been built; which plan you are on; and the time the score was computed. That time is the only timestamp in it. It contains no raw Health readings: no heart-rate or HRV values, no sleep or bed times. Automated tests in the app hold it to that;
• a count of the topics you asked about in the last four weeks, from a fixed list of ten (for example “sleep 3 times, HRV twice”), never the words you used;
• the App Store's signed proof of your Pro purchase, so our proxy can confirm you are entitled to the cloud coach. Apple puts transaction and product identifiers, dates, the price and currency, and the country of your App Store account in it. It contains no name, email or payment details.

The request goes to a proxy we operate on Cloudflare Workers. The proxy forwards your messages and the summary to Anthropic's API (the Claude model) and streams the answer back. It does not forward your purchase proof, and it adds no identifier of yours. Our proxy stores no message content. It keeps only counters, keyed by your purchase's original transaction identifier: how many messages you sent today and this week, and what they cost us this month. They let us enforce each subscriber's allowance and our own monthly spending cap. The daily and weekly counters expire about an hour after their day or week ends, and the monthly total 45 days after the last message it counted. Like any web server, the proxy sees the network address a request comes from, and it keeps nothing of it. Anthropic processes the text to generate the reply. It deletes API inputs and outputs within 30 days, longer only if a message is flagged under its usage policy, and it does not use them to train its models by default (see Anthropic's retention policy). Cloudflare handles the request as our infrastructure provider under its privacy policy.

Where the coaches are offered. The cloud model is offered only in the countries where Anthropic offers its API (Anthropic's list). Before each message, our proxy checks two things against that list: the country of the App Store account in your purchase proof, and the country the request comes from, which Cloudflare works out from its network address. If either is missing from the list, the proxy replies that the coach is not available there and sends nothing on. Neither country is stored. On an App Store account from mainland China, RecoverX offers no AI coach at all. In Hong Kong, Macau and any other country not on Anthropic's list, only the on-device coach is offered. Where Apple's on-device model is available is Apple's decision (Apple's page).

If you never send a message to the cloud coach, none of this happens.

Crew

Crew is an optional leaderboard for a few friends. When you create or join a crew, RecoverX stores in your own iCloud private database (Apple CloudKit, under your Apple Account): a crew name, your display name, an anonymous member identifier, and each day's three scores (recovery, sleep, strain) as whole numbers. The crew's owner shares that record set with the members they invite, using iCloud sharing, so members can see one another's names and daily scores. Nothing else about you is shared: no Health readings, no history, no location.

We, the developers, do not have access to your Crew records; they live in your iCloud, governed by Apple's privacy policy. Leaving a crew removes your scores from the shared set; deleting a crew you own removes it for everyone. You can hide any member on your device, and report a member by email; the report contains the crew and member identifiers and the name shown, nothing else, and it is sent only when you send it.

Crash reporting

RecoverX uses Sentry (Functional Software, Inc.) to receive crash and error reports so we can fix bugs, including reports of the app freezing. A report contains the app version, device model, iOS version, your region setting, the code path that failed and a short trail of recent in-app events, such as which tab was open. Health values, scores, message text and identifiers are stripped before anything is sent; this scrubbing is covered by automated tests. Sentry's handling of the data is described in Sentry's privacy policy. There is no advertising or behavioural analytics SDK in the app.

Purchases

Subscriptions and the lifetime purchase are handled by Apple through the App Store. We never see your payment details. As described above, the App Store's signed transaction is sent to our proxy only to verify Pro for the cloud coach. Offer codes and promo codes are redeemed through Apple. Manage subscription and Redeem an offer code in Settings open Apple's own screens.

Who receives data, at a glance

Your choices

• Deny or revoke any Health type in iOS Settings; RecoverX adapts and tells you what it can no longer compute. The Heart page's types can be declined on their own.
• Leave the cloud coach off, or turn it off in Settings → Privacy. The on-device coach sends nothing.
• Do not create or join a crew, or leave one at any time.
• iCloud's own settings on your iPhone decide whether RecoverX keeps your settings in iCloud.
• On Apple Watch, turn off Battery warnings in Settings, or remove the RecoverX complication, to stop the charge note. Deny Motion & Fitness to the watch app to stop the wrist-motion summaries; sessions are then found from heart rate alone.
• Turn off Background App Refresh for RecoverX in iOS Settings to stop the scheduled refresh.
• Delete the app to remove all local data.
• Email us to ask what, if anything, our proxy holds under your transaction identifier; we can delete the counters on request.

If you are in the EU, the EEA, the UK or Switzerland

Who is responsible. The controller of the personal data described in this policy is Tong Wu, the individual developer who publishes RecoverX. Contact: allenwu06@outlook.com. The postal address is the one shown on RecoverX’s App Store page in the European Union.

What is processed, and on what legal basis.

• Health readings, scores, check-ins and history are processed only on your device, under the permissions you grant in iOS. We never receive them.
• The cloud coach on Pro: your message and the coarse score summary described above, with your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)). You give it by turning the cloud coach on after reading what it sends, and you can withdraw it at any time by turning it off in Settings or simply not using it. Withdrawing does not affect replies you already received.
• The App Store’s proof of your Pro purchase, checked by our proxy: to provide the service you bought (Article 6(1)(b)).
• The region check for the cloud coach: the country your request comes from and the App Store country in your purchase proof are used for that request only and are not stored, so the coach runs only where our supplier permits it (Article 6(1)(f)).
• Crash reports: our legitimate interest in keeping the app working (Article 6(1)(f)). Health values are removed before anything is sent.
• Crew: your own choice to create or join a crew. The data lives in your iCloud and is shared only with the people you invite; we have no access to it.
• Your settings, kept in your own iCloud whenever iCloud is on, under your Apple Account. They contain no health data, and we have no access to them.

Transfers outside Europe. Cloudflare, Anthropic and Sentry process data in the United States and elsewhere. We rely on the data-protection terms these providers offer their customers, which include the European Commission’s Standard Contractual Clauses.

How long. Data on your device stays until you delete it or the app. On your own devices, the watch keeps its battery readings for 21 days and your iPhone keeps wrist-motion summaries for 30 days. The proxy’s counters expire at most 45 days after your last message. Anthropic deletes API inputs and outputs within 30 days. Sentry keeps crash reports for its standard retention period. Settings in your iCloud stay there after you delete the app.

Your rights. You can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent. Most of your data never reaches us: deleting the app removes it, iOS Settings controls Health access, and iCloud’s own settings control what RecoverX keeps in your iCloud. For anything our proxy holds under your transaction identifier, email us and we will answer within one month. You can also complain to the data protection authority where you live or work.

No automated decisions with legal effect. The recovery score is guidance for your training. It is not a decision that has legal or similarly significant effects on you.

Age. In the EU and the EEA, the cloud coach and Crew are for people aged 16 and over, or the lower age your country sets for consenting to online services.

Children

RecoverX is not intended for children under 13, and we do not knowingly collect data from children.

Changes to this policy

Updates are reflected by the date at the top and posted at this URL. When a new version of the app sends data somewhere new, this page changes before that version ships.

Versions 1.3 and earlier: the app had no cloud coach, no Crew and no active crash reporting; all processing was on the device, as the previous policy stated.

Contact

Questions about this policy, or requests about your data: allenwu06@outlook.com.