What Actually Happens to Your Data in a Fitness Tracker
A fitness app can touch several different data systems at once. Your workout log may live in the app, selected samples may also be written to Apple Health, a purchase provider may hold a receipt, and a diagnostic service may receive technical events.
The useful privacy question is not simply "Does this app collect data?" It is: what data crosses each boundary, for which purpose, with whose permission, and how can you remove or export it?
Start with the five common data stores
1. The app's local database
This is where an app may keep workouts, meals, hydration, sleep notes, preferences, goals, and generated plans. A local database is protected by the operating system's app sandbox, but it still needs careful deletion, backup, and migration behavior.
PrepAI keeps its core wellness records in its local application database. It does not require or create a server-side PrepAI wellness profile.
2. Apple Health
Apple Health is a separate system store controlled through iOS permissions. An app can request read or write access to supported categories, but the permission sheet belongs to the operating system.
Data written to Apple Health is not automatically removed when you delete the originating app. Likewise, deleting local app records should not pretend to delete samples owned by Apple Health. Review Health permissions and records separately.
3. A provider account or cloud backend
Many apps use an account to synchronize history across devices, support web dashboards, or provide remote coaching. That is a legitimate product choice, but it means the provider needs a server-side identity and some server-side data.
If cross-device sync matters to you, read the app's privacy policy for retention, deletion, subprocessors, and whether health content is used for analytics, advertising, or model training. Do not infer those answers from a sign-up screen alone.
4. Commerce systems
App Store purchases create records with the platform and may also be verified by a service such as RevenueCat. These systems need transaction and entitlement information; they do not need your workout or meal history.
PrepAI uses an anonymous purchase identifier and purchase history to verify PrepAI Pro. RevenueCat's record is not a PrepAI wellness account. Deleting the app's local wellness data does not cancel a subscription or remove the Apple purchase.
5. Diagnostics and advertising
Crash tools, analytics, and ad SDKs create another boundary. The important details are whether they are enabled by default, which fields they receive, and whether health context is excluded.
PrepAI diagnostics are optional and consented. Its reviewed event allowlist excludes health values, goals, choices, prompts, photos, generated output, free text, routes, and identifiers. The free iOS experience may show one consent-gated, non-personalized banner; health records are not supplied for advertising.
Follow a record through its lifecycle
For any fitness app, trace one realistic record from beginning to end.
Collection
Was the value entered manually, read from a sensor, imported from Apple Health, inferred by a model, or generated by a rule? Those sources have different confidence and privacy implications.
Storage
Does the original value live locally, in Apple Health, on the provider's server, or in more than one place? Does the app distinguish raw observations from derived insights?
Processing
Are calculations deterministic and local? Does a model run on the phone or receive the data remotely? If the app says "AI," look for the actual processing location and fallback behavior.
Sharing
Can the app send files, reports, or emails? A user-directed export is still a disclosure, but you choose the destination. The app should let you review the content before it leaves.
Retention and deletion
What does "delete my data" cover? Local records, Apple Health samples, exported files, purchase receipts, diagnostic queues, backups, and support emails often have different owners and deletion paths.
How PrepAI maps those boundaries
PrepAI's current public contract is intentionally specific:
- core wellness records stay in the local app database;
- Apple Health access is optional and category-based;
- deterministic guidance and supported AI inference run locally;
- optional model downloads use the network before later local inference;
- Apple and RevenueCat process purchases without receiving wellness history;
- diagnostics require consent and use a sanitized allowlist;
- exports and support messages leave only when you choose a destination;
- manual encrypted backup provides portability without a PrepAI cloud account.
No storage design is risk-free. A local-first app reduces server-side exposure, but the phone can still be lost or compromised and exported files can be shared to an unsafe destination. Use device protections, keep a current encrypted backup, and review files before sharing.
A short privacy audit you can do yourself
Before committing months of history to an app, answer these questions:
- Can I use the core app without an account?
- Where are manual records stored?
- Which Apple Health categories are requested, and why?
- Does AI run locally or remotely?
- Which analytics, diagnostic, advertising, and purchase providers are involved?
- Can I export a restorable backup?
- Can I preview readable reports before sharing?
- What remains after local deletion?
An app that answers these plainly gives you something more useful than a broad privacy slogan: a map of the real data flow and the choices you control.