Privacy Policy
Last updated: 12 August 2026
The short version
The app keeps to itself. Your workout history and settings sit in one file on your iPhone, state.json, and I never see it. No account, no server of mine, no ads, no analytics, no tracking.
There is one exception, and it is Apple's rather than mine: if your language has no on-device speech model, or that model keeps failing, the audio of a voice command goes to Apple to be recognized. Details below.
The website is the noisy half. It uses Yandex Metrica for traffic statistics, it sits behind Cloudflare, and the subscribe field stores the email you type.
If you remember one line from this page: I never see your workouts unless you decide to email me a recording yourself.
Who is behind this
Cornish Reps is made by one person. I am a private individual, not a company, and I am the only one who handles anything described here.
This page covers the iOS app Cornish Reps, iOS 18 and later, currently a TestFlight beta, and the website cornishreps.com.
Contact: hi@cornishreps.com. English or Russian, both work.
The app: what stays on your device
Everything the app knows about your training is one file, state.json, in the app's own folder: workouts, reps, test results, where you are in the program, streak, settings. It stays there, because the app has no server to send it to and no code that would.
Next to it the app keeps CSV recordings of the headphone sensor, one per set. They exist for one reason: so you can send me one if the counter gets your reps wrong. Until you do that, they just sit on the phone.
Both live in the app's Documents folder, which means two things. You can open that folder in the Files app, and you can share or delete the recordings straight from the counter screen, one by one or all at once. And a copy of the folder goes into the ordinary iPhone backup, to iCloud or to your computer. That backup is between you and Apple. I have no access to it.
Deleting the app deletes the file and the recordings with it.
Motion data from the headphones
Counting works off the motion sensor in AirPods and compatible Beats, through Apple's CMHeadphoneMotionManager. While a set is running, the app reads head orientation, acceleration and rotation.
The stream is processed on the phone as it arrives. Nothing is uploaded. What is left after a set is the number of reps in your history and the local CSV recording described above.
When the set ends, the app stops reading the sensor.
Microphone and voice commands
Voice commands, start, stop, plus N, minus N, need the microphone and Apple's speech recognition. The app listens only while a counting screen is open and voice control is switched on.
If your iPhone can recognize your language on the device, the app insists on that, and the audio never leaves the phone. If it cannot, or if on-device recognition fails three times in a row, the app lets iOS pass the audio to Apple's speech recognition service, where Apple's privacy policy applies. Either way it never reaches me.
The app does not record audio, keeps no transcripts and sends audio nowhere itself. It acts on the few words it understands, and that is the end of them.
Permissions the app asks for
Motion and fitness: to read the headphone motion sensor and count reps.
Microphone and speech recognition: for voice commands. Both are optional. Say no and everything still works with taps.
That is the whole list. No HealthKit, no notifications, no location, no contacts, no photos, no camera, no advertising identifier, no tracking prompt.
Sending me a CSV recording, if you want to
If the counter misses reps or counts ones you did not do, you can share the CSV recording of that set and email it to me, and I will use it to tune the detector. This only happens if you do it: pick the file, attach it, send it. The app never sends anything on its own.
What is inside: one row per sensor sample with a timestamp in seconds from the start of the set, accelerometer, gravity and rotation values, head pitch, the detector's own working numbers, the running count and any correction you made by voice. The file name says which exercise it was and when.
What is not inside: your name, your contacts, your location, device identifiers, your other workouts, any audio, any account data. There is nothing in the file that points back at you.
What I do with it: replay the signal, find where the detector went wrong, move the thresholds. Nothing else. It is not shared, not published, not sold, not fed into anything.
How long I keep it: until the fix ships, and no longer than twelve months. Ask me to delete it earlier and I will.
The email itself sits in my mailbox like any other email. Ask, and I delete the thread.
What the app does not do
No account, no login, no profile. No server of mine, so there is nothing to sync and nothing to leak. Apart from Apple's speech recognition, the app makes no network calls at all.
No ads, no ad network, no analytics SDK, no crash reporting SDK, no third party SDK of any kind. Yandex Metrica runs on the website only, it is not in the app.
No tracking across apps or sites, nothing sold, nothing shared. In App Store terms, this app collects no data.
The app is free, with nothing to buy inside it and no subscription.
TestFlight
The beta is handed out through Apple TestFlight, so Apple stands between you and the install. Apple runs the tester list, collects crash logs and whatever else TestFlight collects, under Apple's own privacy policy rather than mine.
If you send feedback from inside TestFlight, it reaches me with whatever TestFlight attaches to it, usually a screenshot, the device model and the iOS version. I read it, fix what it points at, and delete it when it is done.
The website: statistics and cookies
cornishreps.com uses Yandex Metrica with webvisor turned on. It sets cookies and records how the page is used: pages viewed, clicks, scrolling, mouse movement, referrer, screen size, browser, and a rough location from the IP address.
Webvisor means a visit can be replayed as a recording of the page. I use it to see which parts of the page people read and where they get stuck, not to watch individual people. The only input field on the site is the email field for the news list, and that is an address you are handing me on purpose anyway.
This data lives on the Yandex side, under their terms and their retention period. I only see the reports and the recordings in the Metrica interface.
If you would rather not be counted: block cookies or scripts for this domain in your browser or with an extension, or use the opt out that Yandex publishes for Metrica. The site works fine without any of it.
The website: hosting, Cloudflare and server logs
The site is a static page on my server, with the domain proxied through Cloudflare. Cloudflare terminates the connection and filters junk traffic, and in doing that it processes IP addresses and request data under Cloudflare's own privacy terms.
The web server keeps ordinary access logs: IP address, time, requested URL, referrer, user agent. They are there for debugging and for abuse, they rotate away on their own after a short time, and nobody else gets them.
The page loads no external fonts and no ad code. Apart from the page itself, the only outside request is the Metrica tag.
The website: news subscription
If you type your email into the subscribe field, it goes into one text file on my server: the time, the address, and the page you came from. Your IP address is not written next to it, although the request itself shows up in the server log like any other. The file sits outside the web root, so it cannot be pulled off the internet.
It is used for one thing: a rare email when a new build or a new exercise is out. It is never sold, rented or passed on, and it does not go through any mailing platform.
The basis for it is your consent, given by typing the address and pressing the button. You can take that back at any time with one line to hi@cornishreps.com.
Why this data is processed, and on what basis
For the people who need the legal wording:
Consent: the news list, and any CSV recording you choose to email me.
Legitimate interest: server logs and website statistics, so that I know the page works and the traffic is real. Where your local law treats analytics cookies as something you have to agree to, refusing them is the browser and opt out route described above, and the site keeps working either way.
The app: nothing in it is processed by me at all. Motion, microphone and history are handled on your device, because that is what makes the app do the thing you opened it for.
Withdrawing consent takes one email. It changes things going forward, it does not undo what was already done while the consent stood.
How long anything is kept
On your device: state.json and the CSV recordings stay until you delete them or delete the app. Nothing expires, nothing is cleaned up behind your back.
A CSV you emailed me: until the fix ships, twelve months at the outside.
Your subscription email: until you ask me to take it off the list.
Website statistics: on the Yandex side, for their standard retention period.
Server access logs: a short time, then they rotate out.
Who else sees any of this
Apple: TestFlight distribution, and speech recognition when there is no on-device model for your language or it keeps failing.
Yandex: website statistics.
Cloudflare and my hosting provider: serving the site.
That is the entire list. No advertisers, no data brokers, no analytics resellers, no training sets. I do not sell data, and to be honest there is very little here to sell.
If the law ever forced me to hand something over, I would comply, and I would say so on this page unless I were forbidden to.
Children
The app is not aimed at children, and it has nothing to collect from anyone. If a child does pushups with it, nothing about them leaves the phone.
The website differs on one point, the news list: do not subscribe if you are under 16, unless a parent is fine with it and your local law allows it.
If you think a child's address ended up on my list, write to me and I will remove it.
Your rights, and how to ask for deletion
You can ask what I hold about you, ask for a copy, ask for a correction, ask me to delete it, or object to a use. In practice it comes down to one line: delete my email, or delete the recording I sent you.
Write to hi@cornishreps.com from the address in question, or name the file you sent, and I will do it and confirm. I answer within 30 days, usually within a few days.
To wipe everything the app knows: delete the app. I hold no copy of it, so that is the whole procedure. A copy can still sit in your own iPhone backup until that backup is replaced or deleted, and that part is in your hands.
If you are in the EEA or the UK and you think I handled something badly, you can complain to your local data protection authority. I would rather you wrote to me first.
Terms, license and Apple's part
Privacy is this page. The terms of use are the next page over, at https://cornishreps.com/terms/, and here is the short version of what they say.
The app is licensed to you, not sold: a personal, non-transferable license to run it on Apple devices you own or control, under Apple's standard terms for App Store and TestFlight software together with mine. Do not resell it, rent it out or take it apart to ship your own version of it.
It counts reps. It is not a coach and not a doctor. Sensors miscount, a program written for an average person was not written for your body, and training is a way to get hurt. You train at your own risk. As far as the law allows, the app comes as is, with no warranty, and support and any complaint about it are mine to answer, at hi@cornishreps.com.
Apple only distributes it. Apple has no obligation to provide you with maintenance or support for the app, and any claim about the app, including a claim that it infringes someone's rights, is directed at me and not at Apple. For a paid app Apple's only duty would be to refund the price, and here the price is zero.
Use it only where the law lets you: not from a country under a US embargo, and not if you are on a US list of prohibited or restricted parties.
Apple and Apple's subsidiaries are third party beneficiaries of the terms, and Apple has the right to enforce them against you.
Changes to this page
When something changes in the app or on the site, I update this page and change the date at the top. Anything that matters, for example if the app ever started sending something somewhere, gets said here in plain words and in the release notes, not buried in a paragraph.
The current version always lives at https://cornishreps.com/privacy/.
Questions, complaints, deletion requests: hi@cornishreps.com.