Privacy policy

Who we are

Cairn: Form is made and published by ASACE Labs Ltd, a company registered in England and Wales (company number 16516913).

ASACE Labs Ltd is the data controller for the personal information we actually receive. For Cairn: Form that means subscription and entitlement information, your Form account, the messages you send to Rowan while they are being answered, and anything you choose to send us by email. The training information described below stays on your device: we hold no copy of it.

You can contact us about anything in this policy at support@asacelabs.com.

What this policy covers

This policy covers the Cairn: Form app. The asacelabs.com website has its own, separate website privacy notice, and our other products carry their own notices.

The short version

• You sign in with Apple or Google to create a Form account. The account holds an identifier and your sign-in sessions, not your training.
• There is no sync. Your training data lives on your device.
• Your programme, workouts, profile and progress are stored locally. We keep no copy.
• When you message Rowan, the in-app AI coach, your message and a summary of your training are sent to an AI provider to write the reply, after you have agreed to this in the app. Nothing is stored on our server.
• Subscription and entitlement information is processed by Apple or Google and by RevenueCat, linked to your Form account so that your membership follows you.
• There is no advertising, no behavioural advertising, no advertising identifier and no analytics.
• No remote crash-reporting service is used in this release.

Training information Form keeps on your device

To build and adapt a programme, Form works from a training profile you fill in and from the work you log. Depending on what you enter, that can include:

• your body weight;
• your training experience and recent training status;
• movement limitations, and movements or exercises you have excluded;
• the equipment and facilities available to you;
• how many days a week you train and how long a session can be;
• your goal and any muscle groups you have prioritised;
• exercises you prefer or would rather avoid.

Form also stores and derives, on the device: your completed workout history, including sets, loads, repetitions and effort; your current programme and block state; block reviews and the evidence behind them; the figures shown on Progress; and the training context Rowan reads when it explains something.

Where that information is stored

All of it is written to the app's own storage inside its container on your device, protected by the operating system in the same way as other app data. Your Form account does not hold it and there is no cloud sync in this release, so a new device or a reinstall starts with an empty history. We keep no copy of this information. The only time any of it leaves your device is when you message Rowan, as described below.

If your device is backed up, your device backup may include the app's data. That backup is between you, your device and your backup provider, under their terms rather than ours.

Why Form uses it

It is used to do the thing you opened the app for: to compile a programme that fits your equipment, schedule and limitations; to prescribe the next session; to record what you did; to review a block of training and decide what should follow it; and to show your progress back to you.

Because this processing happens on your device under your control, we do not hold this data as a controller. It is described here so that you can see exactly what the app keeps. Rowan is the one exception, and is covered in its own section.

Body weight and movement limitations

Body weight and movement limitations are health-related by nature, so we treat them carefully: they are entered by you, used on the device to shape your programme and stored on the device. They leave it only as part of the training summary Rowan needs to answer a message you send.

They are training-programming inputs, not diagnoses. Recording a movement limitation tells Form to avoid or substitute certain work. It is not a clinical assessment, Form does not interpret it as one, and the app does not provide medical advice or treatment. See our Terms of Use for more on this.

Your Form account

You create a Form account by continuing with Apple or Google. Our account service, which runs on Cloudflare and is operated by us, stores a Form account identifier, which sign-in provider you used together with that provider's opaque identifier for you, and your sign-in sessions (with the session tokens stored only in hashed form). It stores no name and no email address. If you sign in with Apple, it also keeps the token Apple issues so that deleting your account can revoke Form's access with Apple.

The account exists so that your membership and Rowan work for you, and can be restored when you sign in again. It does not hold your training: that stays on your device.

You can delete your account at any time in the app, under Profile, then Delete account. That removes your sign-in identities and sessions from our service, leaving only an anonymous record that the account was deleted, revokes Sign in with Apple where it was used, and clears the account's training data from the device. Deleting your account does not cancel an App Store or Google Play subscription; you manage that in your store account.

How to delete your account sets out both routes, step by step, with exactly what deletion removes and what is kept afterwards.

Rowan

Rowan is the AI coach inside the app. It explains your programme and answers questions about your training. The app asks for your permission before your first message is sent.

When you send Rowan a message, the app sends what you typed together with a summary of your training record: your profile (including body weight, movement limitations and equipment), your programme, your recent sessions and your progress figures. If you ask about a particular session or lift, its weights and repetitions are included too. The request carries a short-lived sign-in token that identifies your Form account, so that it can be answered for you; it carries no name, email address or device identifier.

It goes to a server we operate, hosted by Fly.io in London, which passes it to OpenAI to write the reply. Our server has no database and keeps no copy of your message or your training data; its logs record only that a request was made, whether it succeeded and how long it took. OpenAI processes the request on our behalf under its API terms, which do not allow it to use the data to train its models and allow it to retain requests for up to 30 days for abuse monitoring before deleting them.

Because this summary can include health-related information, we only send it when you choose to message Rowan, after you have agreed to it in the app. We rely on your consent to do so, and you can stop at any time by not using Rowan: nothing is sent unless you send a message. Conversations are kept on your device for a day, or until you delete them, unless you choose to keep one.

Subscriptions and purchases

Some features require a subscription. Purchases are made through Apple's App Store or Google Play, and the store processes the payment. We never see or store your card details.

To know whether your subscription is active, Form uses RevenueCat, Inc. as a processor. RevenueCat receives the store transaction and returns your entitlement state: which tier you have, whether it is in a trial, when it expires and whether it will renew. Form keeps a copy of that state on the device so that it can still work while the store is unreachable.

The app is configured so that RevenueCat's automatic device-identifier collection is switched off, which means your advertising identifier (IDFA), vendor identifier (IDFV) and Android advertising ID are not sent to it. Form uses your Form account identifier as your RevenueCat user identifier, so that your membership follows your account to another device. It sends no name, no email address and no subscriber attributes.

Apple or Google handles the purchase itself under Apple's privacy policy or Google's privacy policy, and RevenueCat processes what it receives under its privacy policy and our agreement with it.

No advertising, analytics or tracking

Form contains no advertising SDK and shows no adverts. It does no behavioural advertising and no tracking for ad targeting. It does not ask for permission to track you across other companies' apps and websites, because it does not do so. There is no analytics SDK in the app and no product-usage telemetry is collected.

Crash reports and diagnostics

No remote crash-reporting or diagnostics service is enabled in this release. The app records internal diagnostic events so that faults can be handled gracefully, but with no reporting service installed those events are simply counted and discarded on the device.

Separately from the app, Apple's and Google's own systems may still make crash and performance diagnostics available to us in aggregated form, if you have chosen to share them with app developers in your device settings. That sharing is controlled by Apple or Google and by your device settings, not by Form. If we ever add a crash-reporting provider, this policy will be updated first.

Permissions Form does not ask for

The app declares and requests no device permissions. It has no access to Apple Health or HealthKit, motion and fitness data, the camera, photos, your location, your contacts or notifications.

Keeping and deleting information

Training and profile data stays on your device until it is removed from it. Deleting your account in the app clears it from the device, and so does deleting the app. There is no export path in this release, so anything you want to keep should be recorded elsewhere first.

Because we hold no copy, we cannot restore your training data, and we cannot delete it for you. Your account record is kept until you delete it, and sign-in sessions expire on their own.

Purchase and subscription records are kept by Apple and by RevenueCat under their own retention periods, which is also what allows a purchase to be restored on a new device. Email correspondence with us is kept only for as long as it is useful for the matter it relates to and for our ordinary business records, and then deleted.

Your rights

Under UK data protection law you have rights over personal information a controller holds about you, including the right to ask for a copy of it, to have it corrected, to have it deleted or its use restricted, and to object to its use where the controller relies on legitimate interests.

In practice, for Cairn: Form: information held on your device is already in your hands, and you remove it by deleting the app. For your Form account and subscription information, exercise your rights with us at support@asacelabs.com, or directly with Apple or RevenueCat where they hold the record. We will help where we can, and tell you plainly where we cannot.

If you are unhappy with how we have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk.

Where information is processed

Your training data is processed on your own device, wherever you are. Rowan messages pass through our server in London and are processed by OpenAI in the United States. Your Form account is held by our account service on Cloudflare's network. Apple, Google and RevenueCat operate internationally, and RevenueCat, Inc. is based in the United States, so subscription and entitlement information may be processed outside the United Kingdom. Those transfers are covered by the safeguards in our agreements with them and in their own published terms.

Children

Cairn: Form is a resistance-training product intended for adults. It is not directed at children, and we do not knowingly handle information relating to a child through it.

Changes to this policy

If the app's behaviour changes in a way that affects this policy (a change to how Rowan works, a crash-reporting provider, analytics, or sync), we will update this page before that change is released, and change the date shown at the top.

Contact

Questions about this policy, or about anything Form does with your information: support@asacelabs.com. For help with the app itself, see support.