Where your fitness data actually goes (and where it shouldn't)

A serious fitness log is one of the most intimate documents you’ll ever produce: every weigh-in, every meal, your sleep, your injuries, your progress photos. Assembled in one place, it’s a health dossier that would make an insurer, an advertiser or an ex blush. So it’s worth asking the question almost nobody asks before tapping “Sign up”: where does this actually live?

The default architecture is a server you’ll never see

Most fitness apps are thin windows onto someone else’s database. You log a meal; the meal is uploaded; the copy on your phone is a cache. This isn’t malice — it’s the standard way apps get built — but it has consequences worth saying plainly:

• Your ledger’s lifespan is the company’s lifespan. Apps get acquired, pivoted and shut down constantly, and the export tools are always an afterthought. Years of training history can end as a farewell email and a CSV that doesn’t import anywhere.
• The data outlives your intent. Deleting the app rarely deletes the account; deleting the account rarely deletes the backups, the analytics events, or whatever already went to third parties.
• “Free” is usually an exchange rate. Running servers costs money. When the app is free and the company isn’t a charity, the business model is somewhere in the ads, the analytics SDKs, or the aggregate data — and a health dossier is premium inventory.

And a fact many people find genuinely surprising: in the US, consumer fitness apps are generally not covered by HIPAA. HIPAA binds healthcare providers and insurers, not the app on your phone. The privacy policy — the document nobody reads — is usually the only contract that governs your weigh-ins.

Aggregation is where “harmless” data turns

Any single data point is boring. The aggregate is not. The famous demonstration was a global running-heatmap that inadvertently outlined military bases — nobody’s individual jog mattered, the sum did. The same logic applies at personal scale: a weight trend plus meal times plus workout locations plus photos is a profile, and profiles migrate — to ad networks, to data brokers, and to anyone who successfully breaches a server that held a few million of them in one place.

None of this requires a villain. It only requires defaults: data flows to wherever the architecture sends it, and the architecture was chosen before you arrived.

Five questions that sort the market

1. Does it work offline, signed out? The most honest architecture test there is. If nothing works without an account and a connection, your data’s home is the server, full stop.
2. What exactly does the account sync? “Everything, always” and “only what the features you asked for need” are very different answers wearing the same toggle.
3. Are there advertising or third-party analytics SDKs inside? The privacy policy’s “partners” section answers this, reluctantly.
4. Where do photos go? Progress photos are the most sensitive object in any fitness app. Uploaded-by-default is a choice someone made about your body.
5. Can you actually delete it — and does deletion include the backups? A real answer names a mechanism, not a support email.

What local-first means, concretely

Momentum’s answer to the architecture question was made before the first feature: the app is local-first. Your workouts, meals, weigh-ins and XP live in a database on your own device — logging works with no account, no connection, forever. That’s not a privacy setting; it’s the shape of the product, which is why everything works signed out.

The rest follows from the architecture, and it’s stated as policy:

• No ads, no trackers. No advertising SDKs, no third-party analytics, no data sold or shared. There’s no aggregate inventory to monetize, because there’s no aggregate.
• An account is optional and narrow. Sign in only if you want real leaderboards and cross-device backup — and it syncs only the stats those features need, not the ledger.
• Progress photos never leave by default. They’re not uploaded, and they’re not even included in the cloud backup. They leave your device in exactly one case: you explicitly run an AI analysis on them.
• Deletion is a mechanism, not a promise. Deleting the app — or Settings → Reset all local data — removes the on-device copy, because on-device is where it lives. If you made an account, the account deletion page removes it and its cloud backup too. The full detail is in the privacy policy — which is short, because there’s mercifully little to disclose.

The trade, stated honestly

Local-first has a cost, and you should know it: your phone is the source of truth, so protecting the ledger means keeping a backup (that’s what the optional account is for), and a second device doesn’t magically hold your history without one. That’s the trade — mild inconvenience at the edges in exchange for a health dossier that has no server-side twin to leak, sell, subpoena or sunset.

Your training data should compound for decades — that’s the entire point of keeping it. Decades is a long time to trust a stranger’s database. It’s a very reasonable time to trust your own pocket.