Privacy Policy — Go Lifter

Version 8 · 11 October 2026

This policy covers the Go Lifter application for Android. It is written to be read in full: it runs a few pages, and nothing in it assumes you already know something.

What changed in this version. One thing, and it only applies if you turn it on:

• the Workout soundtrack reaches every build of the app. It keeps what was playing while you trained, and for that it asks for Android's notification access. It starts off, the app offers it at most twice, and what it records stays on the device. The switch that sends each workout's most played track to the Coach also starts off now. The details are under The workout soundtrack.

What changed in version 7, and still holds:

• the comments the Coach wrote in the last seven days, about a workout or about one day's nutrition, now travel with your questions, so it knows what it already told you. That text was written by the provider itself, from what you were already sending, so no new data of yours leaves the phone. And when you turn off a privacy switch, or restore a backup, the comments written before that stop travelling. The details are under What travels.

What changed in version 6, and still holds:

• the list of which part of the app produced the question, which already travelled to our server, gains a fifth value: correction. It is the second request the app makes to the Coach, without you seeing it, when the Coach said it had proposed a change and did not call the tool that creates the card. Until now it travelled as conversation, so nobody knew how often it happened.
• the counts those headers already allowed now also serve to know how many installations use the Coach, and each of its features, per day, week and month. They are summed figures, stored with no identifier at all — neither yours nor the device's. The details are under The named exception: Go Lister.

What changed in version 5, and still holds:

• the profile's name can travel with your questions to the Coach, so it knows whose profile it is, and it has a switch of its own. Until now this policy said the name never travelled, so for anyone who already had the app it starts off, and nothing changes until you turn it on. In a new installation it starts on. The default profile, Eu ("Me"), is never sent. The details are under What travels.
• This is not medical advice now says outright that the Coach is an artificial intelligence agent, and that it is not a health professional or a physical education professional. Nothing changed in what it does; what changed is how plainly that is said.

What changed in version 4, and still holds:

• the Coach now has a paid part, and there is a section about it. The payment happens entirely inside Google Play; we receive neither your name, nor your email, nor your card. What comes to exist on our side is a purchase token, which identifies the purchase and not you. Paying changes nothing about what travels — no other line of this policy changed because of it, and that is why that version did not ask you to agree again.

What changed in version 3, and still holds:

• the Coach keeps a summary of each conversation, with the date and time, and the three most recent travel along with your questions. It is a paragraph about what was discussed and decided, not the text of the messages — that still never leaves the device. You can read the summaries in Settings → Coach → Coach memory, delete them one by one, and Erase data → Conversations deletes all of them.

The summary

Go Lifter has no account and no login. Everything you record stays on your device. There is no advertising, no tracking, no usage reporting, and the app never requests the Android advertising identifier.

Your data leaves the device in three situations, and this policy describes all three in detail:

1. When the Coach talks to the AI provider — in your questions and, if you leave it on, in the comments it writes on its own when it sees a workout or a day of eating. The provider may be one whose key you supplied yourself, or our own server (api.golister.app), which is the path a fresh installation uses by default. The named exception: Go Lister describes what happens on that server, with an account or without one.
2. In Android's automatic backup, which copies your history to your own Google Drive, as it does for any app, until you turn it off.
3. When you export a file, or press send on an email the app prepared for you to read first.

Outside those three, nothing leaves. We keep no copy of what you record: your training history, your measurements and your photographs have no server to go to. What our server sees are questions in transit on their way to the model, and what it holds at all is described under that exception — which is now the default path, and so is an exception in name only.

What stays on the device

There is no copy of ours of what you record. What exists off the device is your Google's backup, described at the end of this section. (Your questions are a different matter: they pass through a server of ours when the Coach uses the default path or your Go Lister account, and what it holds at all is described under The named exception: Go Lister.)

• Workouts, sets, routines, records, body measurements, nutrition, goals, health facts and Coach conversations — in one database per Profile, in the app's private storage, which only it can see.
• The Coach's memories — what it distilled from your conversations in order to remember you later —, the conversation summaries, the coaching notes it wrote per exercise, the automatic comments already generated, the Training Score snapshots, and your gyms with the equipment they hold.
• The readings that already came from Health Connect — sleep, resting heart rate and steps are stored here once read. Revoking the permission stops new readings and does not erase old ones; to erase them, use Erase data.
• Progress photographs — in a private app folder, one per Profile.
• The text read from a training sheet, until you accept or decline the import. The image is not kept: it is already in your gallery, and the app reads it and forgets it. Recognition happens on the device, through a text reader built into the app itself: there is no service, no upload, and nothing from the photograph leaves here.
• AI keys and preferences — encrypted with AES-256-GCM, under a key held in the Android Keystore that never leaves the device.

Uninstalling the app erases all of that from the device, and there is no copy of ours anywhere to be requested back.

Android's automatic backup, which is your Google's and not ours

Go Lifter keeps Android's automatic backup on, as most apps do. That means your Profile database — workouts, sets, body measurements, the health readings already stored, the nutrition diary, the goals, the health facts and the Coach conversations — is copied to your own Google Drive, in the area reserved for app backups, and comes back when you install the app on a new device.

It stays on for a simple reason: turning it off would make you lose your entire history when you change phones, and this app has no cloud sync to act as a safety net.

Three things are deliberately excluded from that backup:

• the progress photographs — the promise that erasing them means no copy exists would not survive a copy on Drive that you neither see nor delete;
• your AI keys;
• the Soundtrack preferences and the exercise catalogue, which the app rebuilds by itself.

In a direct device-to-device transfer the photographs do travel, because that copy is local and end-to-end encrypted — it passes through no server.

That backup is yours, it sits in your Google account, and it follows Google's rules rather than ours. You can turn it off under Android Settings → Google → Backup, and delete what is already there from the same screen.

Health Connect

If — and only if — you grant permission, the app reads from Health Connect:

• Sleep, Resting heart rate and Steps — for the Recovery Score and the Coach's load suggestion.
• Weight, Body fat, Lean body mass and Height — to fill the body table without you typing what your scale already knows.
• Nutrition — to avoid logging the same meal twice.

And it writes back exactly one type: nutrition — the meals you logged yourself, so they appear in the other apps you use. No other type is written.

Thirty days, and no more. The app requests the thirty-day window Health Connect grants by default. It does not request READ_HEALTH_DATA_HISTORY or READ_HEALTH_DATA_IN_BACKGROUND: it does not read your older history, and it reads nothing while closed.

This data is used only for the features above. It is not sold, not shared with third parties for their own purposes, does not feed advertising and does not train any model.

It leaves the device in two circumstances, and only those: to the Coach, if you turn on a switch that starts off — described in the next section, in full —, and to your own Google's backup, along with the rest of your history, as any app does and as the previous section explains.

You can revoke any of these permissions at any time in Health Connect itself, and the app keeps working without them. Revoking stops new readings and does not erase old ones — what was already read is stored on the device, and is erased under Settings → Data and health → Erase data.

The workout soundtrack

If — and only if — you turn it on, the app keeps what was playing while you trained, music or podcast, to tell you later what you were listening to when you set a record and what you heard most in each workout.

It asks for the widest permission in the app, and there is no narrower one. Android only tells an app what is playing if it has notification access, and that access allows reading every notification on the device. The app reads none: the two functions that receive notifications are empty, and an automated check in the app's code confirms they stay empty. What it uses is the media session only — the title, the artist and the app that played it — and only during a workout.

• It starts off. The app offers it at most twice — once when you open the version that brought it, if you already had the app, and once after your first saved workout — always saying this before asking. Turning it on is a tap of yours, and the Android screen that grants access only opens with another.
• Turning it off removes the access. Off, the part of the app that receives notifications is disabled, and Android removes the access with it. It is not the app promising not to look: the access stops existing.
• What it records stays on the device, with your history, and goes in the backup you export and in your own Google backup, like the rest. Its preferences stay out of that backup.
• For the Coach, one line, and only if you want. The Workout soundtrack switch, under Settings → Coach → Privacy, starts off, and it is the same box that appears, unticked, when the app offers the soundtrack. On, each workout's most played track, with its minutes, goes to the AI provider — never the timeline, the artist ranking, or any other day.

The Coach, and everything it takes from here

The Coach is optional. The whole app works without it — logging workouts, building routines, reading history, charts, records and the entire nutrition side need neither network nor key.

It talks to the AI model by one of two paths:

• through our server (api.golister.app), which is the default path on a fresh installation and needs neither a key nor an account. The server talks to the model and pays for it; what happens there is described in The named exception: Go Lister and in The same server, with no account at all.
• with your own key from an AI provider (Gemini, DeepSeek, OpenAI, OpenRouter, Groq, or any compatible endpoint). Then requests go straight from your phone to the provider you chose, with no server of ours in between.

No key ships inside the app.

What travels

The context the question requires. The complete list, because "the necessary context" is not a description anyone can check:

• Training — recent sessions, exercises, sets, loads, records, volume per muscle group, routines and the weekly target.
• Goals and health facts — the targets you wrote and the injuries you declared, with region and severity. These always travel: they are what the Coach is for, and a trainer who does not know about your shoulder programmes on top of it. The same sentence appears on the Settings screen, above the switches.
• Nutrition — calories, protein and your target, when you use the diary. The Coach also consults the food catalogue and may propose an entry.
• The Coach's memories — what it distilled from earlier conversations in order to remember you.
• The summary of your three most recent conversations, with the date and time — a paragraph about what was discussed and decided in each. It is what lets you say "carry on from yesterday" and have the Coach know what you mean. The text of the messages never travels, neither from the old ones nor from the current one beyond what the running conversation already shows on screen.
• The Coach's comments from the last seven days — what it wrote about a saved workout or about one day's nutrition, which you see on the workout screen and on the home screen. It is the provider's own text, and it travels so the Coach knows what it already told you. A comment written before the last time you turned off a switch in this section, or restored a backup, does not travel: it may quote exactly what you closed.
• Your default gym and its equipment, the focus you declared, the Training Score broken down, the direction (losing, gaining or maintaining) and the device's date and time.

The profile's name goes with it, and it has a switch of its own, under Settings → Coach → Privacy. It is the name you gave the profile in the app, so the Coach knows whose profile it is when you talk about that person. The default profile, Eu ("Me"), is not sent. The switch starts on in a new installation and off for anyone who already had the app before version 1.13.5, because until then this policy said the name never travelled. When it is off the name does not leave the device, and an automated check in the app's code confirms it only gets in through the switch.

Three switches control the rest, under Settings → Coach → Privacy:

• Body measurements — starts off. Releases weight, body fat, lean mass and circumferences.
• Device health readings — starts off. Releases sleep, heart rate and steps.
• Workout soundtrack — starts off. Releases each workout's most played track, if the soundtrack is on (see The workout soundtrack).

With the first two off, no measurement of your body and no reading from your device leave here — neither on their own nor attached to a goal: the target "reach 78 kg" still travels, and what you weigh today does not. The Coach is told those sections were withheld rather than simply not receiving them — it knows that it does not know.

What those two switches do not cover, and it is fair to say so: the health facts you declared. An injury is what makes the Coach programme around it, and withholding it would be asking for a workout from someone who is not allowed to know why they cannot give it. If you do not want an injury to travel, delete it rather than turning off a switch — and the same sentence appears on the screen where the switches live, so that the two cannot disagree.

And the app has a screen that proves this: Settings → Coach → What the Coach sees assembles exactly the text the next question would send, and sends nothing. You do not have to take this page on trust.

When the Coach speaks without being asked

This switch starts on, and it is the only one on this page that starts on while having a network consequence. It is called Automatic Coach comment, under Settings → Coach, and it has existed since version 1.5.1.

With it on, the app talks to the AI provider in three situations where you wrote nothing:

• when you open the screen of a finished workout, to comment on that session;
• when you open the nutrition tab, to comment on the day;
• when you start a new conversation, at which point it reads the whole previous conversation to extract what is worth remembering — the memories, the health facts and that conversation's summary, all of them in the list above.

What travels in those three is the same context as one of your questions, under the same switches, plus a summary of what is on the screen. Turning off the automatic comment does not turn off the Coach: it goes back to speaking only when you ask.

We say this here because a sentence like "nothing leaves unless you talk to the Coach" would be false for anyone who never opened that Settings screen, and it is that person this paragraph is for.

The named exception: Go Lister

If you hold an Ultimate or higher subscription to Go Lister — another product by the same author — you can connect it instead of bringing a key. Then your questions pass through a server of ours (api.golister.app), which talks to the model and pays for it — the same one that serves, with no account at all, anyone who did not bring a key, as the next section says.

The content that travels is the same as for any other provider, subject to the same three switches. Four extra headers travel on this route only, and not to other providers: an identifier for the question, one for the conversation, whether it asked the model for reasoning, and which part of the app produced it — conversation, workout comment, nutrition comment, distillation or correction. Both identifiers are scrambled here before they leave: the server receives a digest of them, never ours. They exist so the server can count usage against your subscription and can tell that two questions belong to the same conversation; none of them carries content, and what they reveal is how often you use each feature. Since version 6 they are also counted, nightly, into daily totals — how many installations and accounts used the Coach, and each of its features — and what is kept of those totals is the number alone, with no identifier.

*If you have turned on Show the Coach's reasoning, there is one more thing. Some models reason before they answer and, when they use tools, require their own reasoning back in order to continue. In that case the Go Lister server holds that reasoning — what the model thought, not what you wrote* — in volatile memory, under the scrambled conversation identifier, and erases it by itself after an hour without use. It is never written to a database and never comes back to this app. With the option off, it never comes into existence.

The connection is made in your own browser using OAuth and PKCE: no password of yours ever reaches this app, and what it stores is a token, encrypted like any other key.

That token's deadline is one of use, not of calendar. It is valid while you use the Coach and expires after thirty days without use — and never runs beyond ninety days from the authorisation, at which point you authorise again. The ceiling exists because the reason a deadline is short at all is so that a leaked credential dies, and one that renews without limit would only die in the hands of someone who does not use it. The expiry date is visible on the Provider's line, under Settings.

You can disconnect whenever you want, and disconnecting also drops the token on the server, not only the local copy — when it cannot, the app says so rather than pretending it worked.

The same server, with no account at all

You can also use the Coach through that server without having a Go Lister account and without connecting anything. It is what a fresh installation does by default, and what travels is exactly what is described above, under the same switches.

The difference is that, with no account to identify whose use it is, the device has to prove it is itself. For that the app uses Google's Play Integrity API: it asks Google to attest that this is the genuine Go Lifter — the same binary and the same signature Play distributes — on a real device, and sends that attestation to our server, which checks it with Google.

The attestation answers "this app is ours, and it has not been tampered with", and not "this copy came from Play": an identical installation made outside it passes, and a modified one fails even when it came from there. The distinction is written down because it is what the mechanism actually verifies, and describing it as more than it is would be the same dishonesty as describing it as less.

That has a price, and it is only honest to name it:

• Google learns that this app is being used on this device, once per session. It already knew the app was installed here; what is new is the frequency.
• A per-device record comes to exist on our server, to count how many free conversations have been used. It carries nothing that identifies you, is tied to no account, and exists so that free conversations can exist at all without being drained by whoever automates them.
• No conversation content enters into this. The rule in the section above holds entirely.

You are not obliged to come this way: bringing your own AI key remains available and involves neither Google nor our server.

Free conversations cost money to whoever keeps the app running, and that is why they are counted. When they run out the Coach stops answering by this path and the app says so — with the alternatives beside it. There is no automatic renewal.

The Coach has a paid part, and it does not change what travels

The Coach can be bought in two ways — a one-time purchase, to run it on your own AI key, and a subscription, for those who would rather have the AI costs included. The payer is Google Play, and the payment happens entirely inside it.

We do not see your payment. We receive neither your name, nor your email, nor your card, nor your address; Play does not hand them over, and we do not ask for them. What exists on our side is a purchase token — a code Play issues for that purchase, and which we ask it about: for example, whether the subscription is still valid.

That token is not an identifier of yours. It does not say who you are, does not serve to link two purchases to the same person outside Play, and is not used for analytics, advertising or personalisation. It sits beside the same per-device record the section above describes, and serves one question only: may this device keep on conversing?

The one-time purchase does not even reach this. It unlocks the use of your own AI key, which is something that happens inside your device — our server never learns of it, and does not need to.

And what matters more: what travels does not change. Paying opens no new data, turns on no switch, and alters no line of the sections above. What the money decides is who may use the Coach and for how long, and nothing beyond that.

Progress photographs

They stay on the device, compressed, in a private app folder. They are never uploaded anywhere — not to us, not to the Coach, and not to Google's backup, from which they are explicitly excluded so that this sentence is true.

They go to two places, both yours: the archive you export, and a direct transfer from one device to another, which is local and passes through no server. They are deleted when you erase everything or delete the Profile.

Exercise photographs

The catalogue's illustrations do not fit inside the app — roughly 96 MB — so they are fetched when there is a network and cached. They come from a public repository on GitHub (raw.githubusercontent.com). That is a third party, and it is fair to say it was not chosen by you.

That request carries no identifier: no account, no token, no indication of who is asking. What it carries is what any internet request carries — your IP address — and the name of the exercise, which goes in the image's address. Before a workout the app fetches the illustrations for the whole routine at once, so anyone observing that traffic would see which exercises you are about to do, though with no way of knowing who you are.

Deleting

Settings → Data and health → Erase data, with five scopes: Coach memories, conversations (together with their summaries), goals, the nutrition diary, or everything. Each one shows how many rows will go before you confirm.

A single conversation summary can also be deleted on its own, in Settings → Coach → Coach memory, under the conversations tab.

Deleting a Profile deletes its database and its photographs. Uninstalling erases everything from the device.

There is nothing to ask us for: no copy of ours of your data exists to be deleted. The only copy off the device is your own Google's backup, and it is deleted where it lives — Android Settings → Google → Backup.

What the app does not do

• No account, login or registration.
• No advertising, and no ads SDK.
• No usage analytics, telemetry or crash reporting.
• Does not request the Android advertising identifier.
• Does not request location.
• Does not access the camera — photographs arrive through Android's own picker, which needs no permission.
• Does not send your training sheet anywhere. It is read on the device.
• Does not sell, rent or share any data.

Children

Go Lifter is not directed at anyone under 18.

Your rights, and how to exercise them

Since there is no account and no copy of ours on a server, every control is already on your device: the data is yours, it stays with you, and erasing it is immediate and permanent through the five scopes above. Your Google's backup is deleted in that account, as the section What stays on the device explains.

For anything concerning this policy — including rights under Brazil's LGPD — write to [email protected]. For general support, [email protected].

Go Lifter is operated by Joao Ferrete, based in Brazil.

This is not medical advice

The Coach is an artificial intelligence agent, made to help you train. It is not a health professional or a physical education professional: it does not diagnose, does not prescribe, and does not replace someone who can look after you. It adapts training around what you told it, and if you ask what it is, it says so. Pain that persists, gets worse, or appears out of nowhere is a matter for someone who can examine you.

The app reads sleep, heart rate and steps from Health Connect when you authorise it, and uses that to adjust volume and rest. That is training programming, not clinical assessment.

Reporting a problem

The app has Report a problem under Settings → About, which opens an email pre-filled with the app version, the device model, the Android version, which AI provider and model you configured, and how many rows your profile holds — never your AI key. Nothing is sent until you press send in your own mail application, where you read all of it first.

Reporting a Coach response

Press and hold a Coach response to flag it as dangerous, wrong or inappropriate.

This is the one thing in the app that sends health data out on purpose, which is why it is described here separately. A report is only useful if it carries the sentence being reported, and the question that produced it goes with it — because "double your volume" is dangerous or unremarkable depending on what was asked, and the question is usually where you mentioned an injury.

What goes out: the reason, whatever you write, the configured model and provider, the app version, the question and the response. What does not: your AI key, the rest of the conversation, your training history, your measurements and your photographs.

As with everything else here, the email opens for you to read and edit before sending, and the app never sends anything on its own.