Privacy
Last updated 1 September 2026
2Failure works with no account at all, and that is the default. Everything you log — sessions, sets, records, bodyweight, food, sleep and your training profile — is stored on your device, in the app's own storage. Nothing is uploaded unless you sign in.
If you do sign in, a copy of that training data is kept for you on our backend so it survives a new phone. That is the only thing an account does, and it is described in full below.
What stays on your device
- Every session and every set you log, and the records worked out from them.
- Your training profile: goal, experience, equipment, days per week, session length, age, height and bodyweight.
- Bodyweight, calories, protein and sleep entries.
- Your templates and today's plan.
Settings → Erase all data deletes all of it. Deleting the app deletes it too. With no account, there is no copy anywhere else for us to return or to lose.
Apple Health
If you turn it on, 2Failure reads your sleep, bodyweight and daily calories and protein from Health, and writes finished sessions, hand-typed weights and meals back to it. That exchange is between the app and Health on your own device, under permissions you grant per data type and can withdraw at any time in the Health app.
The permission itself never leaves your device. The daily totals it produces — hours slept, calories, protein, bodyweight — are part of your training data, so they are included in the backup if you are signed in, and are not if you are not.
Accounts and backup
An account is optional. You can use every feature of the app without one, and signing out at any time leaves everything on your phone exactly where it was.
Signing in. You can sign in with Apple, with Google, or with an emailed six-digit code. We never see or handle a password. From Apple or Google we receive an account identifier and, if you allow it, your name and email address; with the email route we hold only the address you type. Sign in with Apple's Hide My Email is supported and we are equally happy with the relay address.
What is backed up. Your sessions and sets, templates, today's plan, weigh-ins, food and sleep entries, your training profile and your reminder settings. It is stored as one record belonging to your account.
What is not. A workout that is currently running, your subscription status, and your Apple Health permissions. Those stay on the device they belong to.
Who can read it. Only you. The record is locked to your account at the database level, so a request carrying anyone else's sign-in cannot return it. It is encrypted in transit and at rest by our hosting provider, Supabase, who process and store it on our behalf and for no purpose of their own. We do not sell it, mine it, train on it or share it with advertisers — there are none.
Deleting it. Settings → Account → Delete account erases the account and the backup for good, from inside the app, without emailing anyone. Your phone keeps its own copy until you erase that too.
Apple Watch
The watch app receives your plan and today's session from your iPhone over Apple's device-to-device link, and sends back what you log. That traffic goes between your two devices, not through a server of ours.
Subscriptions
Subscribing inside the app is handled by Apple. We receive whether a subscription is active — not your card, your address or your Apple Account.
Subscribing on this website is handled by Stripe, who process your payment details and email address to take payment and send receipts. Card details never reach this site or our systems. Stripe's own privacy policy governs what they hold.
Exercise imagery
The app loads equipment photographs and movement thumbnails from the internet when you scroll a list that shows them. Those requests go to the image hosts, who will see your IP address as they would for any web request. No identifier of yours is attached to them. Offline, the app falls back to lettered tiles and makes no request at all.
This website
No analytics, no advertising, no cookies set by us, and no third-party fonts or scripts — the typefaces are served from this domain. Our host keeps standard server logs.
Children
2Failure is not directed at children under 13 and we do not knowingly collect anything from them. Since we collect nothing from anyone, there is nothing held either way.
Changes
If this policy changes, the date at the top changes with it. A change that affected what leaves your device would be announced in the app before it took effect.