Privacy.
How Lodestone collects, uses, and protects your data.
1. Who we are
Lodestone is built by 288 Labs, based in California, USA. Contact: privacy@288labs.com.
2. The short version
Lodestone is local-first and account-free. There is no sign-up, no email, and no password. Your cycle, symptom, and daily check-in data never leave your phone. That is not a settings toggle — the app has no code path that transmits them. The only data that leaves the device is anonymous usage analytics and, if you allow tracking, ad-measurement event names.
3. What we collect
Stored only on your device — never transmitted
- Your cycle log (period days, flow), estimated phases, and cycle mode
- Your daily check-ins: energy, sleep, soreness, and any symptoms
- Your readiness scores and how each session was adjusted
- Your training profile (age, height, weight, goal, experience, gym days)
- The machines you add to your gym and their weight-stack settings
- Every workout and set you log, and your stone collection
You can erase all of it at any time in Settings → Your data, or by deleting the app.
Device + telemetry
- App version, OS version, device model
- Anonymous usage events (for example: app opened, onboarding step completed, a check-in happened, a workout was completed) via PostHog, under a random identifier that is not connected to your name or email. These events are structurally filtered in the app: no cycle day, phase, symptom, score, or any health value can be attached to them. The fact that a check-in happened is sent; its contents never are.
- Ad-measurement events (app installed, finished onboarding, completed your first workout) sent to Meta so we can measure which ads brought people to Lodestone. We send the event name only — never a cycle event, a symptom, a workout, or anything you typed. Your device’s advertising identifier (IDFA) is included only if you allow tracking when iOS asks; if you decline, measurement falls back to Apple’s privacy-preserving SKAdNetwork, which is not tied to your identity.
4. What we don't do
- No accounts, no email collection, no contact upload
- Cycle, symptom, and check-in data are never transmitted anywhere — not to us, not to analytics, not to advertisers
- No ads inside Lodestone — we use Meta only to measure our own ad campaigns, never to serve you ads in the app
- We do not sell your data
5. Sub-processors
The following services handle data on our behalf:
- PostHog — anonymous analytics. US region.
- Meta Platforms — advertising measurement and install attribution. Receives ad-measurement event names, plus your advertising identifier only if you allow tracking. Never receives your cycle, symptom, check-in, or workout data.
- Apple — App Store distribution and (via SKAdNetwork) privacy-preserving ad attribution.
6. Children
Lodestone is a training tool for adults. We do not knowingly collect data from anyone under 13 (or 16 in some jurisdictions).
7. Retention
- On-device data — until you delete it in Settings or delete the app.
- Anonymous analytics — kept in aggregate for product decisions.
8. Your rights
Your health data never reaches our servers, so it is always under your control: erase it in Settings or delete the app and it's gone. For anything server-side (anonymous analytics), you may request access or deletion by emailing privacy@288labs.com. EU / UK / EEA residents have rights under GDPR; California residents under CCPA. We honor both globally.
9. Security
All data in transit is encrypted (TLS). Health data does not transit at all — it stays on your device, protected by your device's own encryption.
10. Changes
We'll post material changes here with a new date. For significant changes we'll also notify you in-app.