Privacy policy

This Privacy Policy explains how Monarchia LLC (“Monarch,” “Monarchia,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use the Monarch mobile application, the companion Apple Watch app, our websites, and related services (collectively, the “Service”). It applies to everyone who uses Monarch, anywhere in the world, with additional region-specific rights set out in Section 12.

Monarch is a premium fitness application. We collect information that lets us coach you, track your training and recovery, help you find verified gym buddies and spotters nearby, and run the subscription that pays for the Service. We do not sell your personal information for money. We do not use your HealthKit data for advertising. We use precise location data only with your explicit permission, and we do not store your precise GPS coordinates on our servers.

1. At a glance

This summary is for convenience only and is qualified by the rest of this Policy.

2. Who we are

Monarch is operated by Monarchia LLC, a limited liability company with a registered place of business at 3424 Long Beach Blvd, Long Beach, CA 90807, USA. For the purposes of the EU and UK General Data Protection Regulations (“GDPR” and “UK GDPR”) and similar laws, we are the data controller of personal information processed through the Service, except where this Policy says otherwise.

Data Protection Officer

You can reach our privacy team, including any matters that would otherwise be handled by a Data Protection Officer, at legal@monarch.coach.

3. Information we collect

We collect personal information in three ways: (a) directly from you, (b) automatically from your device when you use the Service, and (c) from third parties acting on your behalf or ours, such as Apple Sign In, our identity-verification partner, and the App Store.

3.1 ACCOUNT AND IDENTITY

• Authentication identifiers: your email address, your Apple Sign In identifier (where used), a one-time password sent to confirm your email, and a unique Firebase user ID we assign you.

• Display name and username shown on your profile and on the map.

• Identity verification data: if you choose to upload a map profile photo, our partner Persona performs a liveness check and a government-ID review to confirm you are a real adult. Monarch receives the result of that check (verified / failed / pending), the underlying inquiry ID, your date of birth, and a confirmation that you are at least 18. Monarch does not store your selfie or your government ID image; Persona processes those under its own privacy notice as our processor.

3.2 PROFILE INFORMATION

• Sex, height, weight, goal weight, fitness level, training experience, fitness goals, training days per week, available equipment, training style preference, AI coach personality preference, foods and exercises you love or hate, calorie and macronutrient targets.

• Profile photo, optional bio, optional Instagram handle, optional home gym name and address.

• Up to three additional map photos used on your gym-map profile.

3.3 HEALTH AND FITNESS DATA

• Workout logs: exercises performed, sets, reps, weight lifted, rate of perceived exertion, form notes, completion times, planned and completed templates.

• Body composition: body-fat estimates, scan photos you choose to capture, weight log entries, body measurements.

• Recovery: per-muscle recovery scores, manually logged sleep duration, manually logged subjective metrics.

• Nutrition: logged meals (including photos you choose to send for recognition), macronutrient and calorie totals.

• Apple HealthKit (with your permission only): step count, active energy burned, heart rate variability (HRV), resting heart rate, blood oxygen saturation, wrist temperature, respiratory rate. Per Apple’s HealthKit terms, we never use HealthKit data for advertising, never sell it, and never share it with data brokers. HealthKit data is read on your device and uploaded to your private Monarch account only to the extent needed to compute your stats.

• Discipline Score: a daily score we compute from the inputs above; it is shown to your accepted connections and on team leaderboards you join.

3.4 LOCATION INFORMATION

• Gym selection: when you check into a gym, we record the gym identifier (a place from Google’s places directory), not your precise device coordinates. Where the map needs an approximate point to display you, your device adds randomised jitter before the position is sent to our servers.

• Coarse location from IP: our servers may derive your approximate city, region, and country from your IP address using a third-party IP-geolocation service. We use this to populate your default region, to apply regional content (such as currency on the App Store side), and for fraud prevention.

• Map availability: when you make yourself visible on the gym-social map, your verified gym membership and presence status are shown to the audience you select (everyone, or accepted connections only).

3.5 SOCIAL INTERACTIONS

• Connection requests you send or receive and their status (pending / accepted / declined).

• Messages you send through map chat, including text, attachments, timestamps, and read receipts.

• “Spotter” broadcasts you initiate or respond to, including the responder list and expiry.

• Team memberships, team leaderboard data, and team messages.

• Reports of other members you submit, including reason, target user, and any context you provide.

3.6 DEVICE, TECHNICAL, AND DIAGNOSTIC DATA

• Apple Push Notification Service (APNs) token and Firebase Cloud Messaging (FCM) token used to deliver push notifications.

• Device model, operating system version, locale, time zone, and app version — collected through Firebase to make the Service work and to diagnose crashes.

• Crash reports, error traces, and performance diagnostics collected through Firebase Crashlytics and Cloud Functions logs.

• Online/offline presence and last-seen timestamps used to show whether you are at the gym now.

• Aggregated usage events used to understand which Monarch features people use (Firebase Analytics).

3.7 SUBSCRIPTION AND PAYMENT DATA

• The Monarch tier you are on (Essential, Elite, Black, or the earned Reserve tier), the renewal cadence (monthly, quarterly, annual), and the transaction identifiers Apple issues when you subscribe.

• We do not receive or store your full payment card details. Apple processes all payments under its own privacy policy and gives us only the data we need to keep your subscription active and to honour refunds, taxes, and entitlements.

3.8 INPUTS YOU GIVE TO THE AI COACH

• Prompts you type or speak, photos you submit for body-composition or meal recognition, and the context Monarch sends with them (your profile, recent workouts, current goals). These are sent to our AI providers (OpenAI and Anthropic) under contracts that prohibit them from training their models on your inputs.

3.9 INFORMATION FROM APPLE AND OTHER SIGN-IN PROVIDERS

• If you sign in with Apple, Apple sends us a unique identifier and, if you allow it, your name and a relay email. We do not request any other Apple ID data.

3.10 CATEGORIES OF SENSITIVE INFORMATION WE MAY PROCESS

Under several privacy laws (California, Colorado, Connecticut, Virginia, Quebec, EEA, UK, Brazil, and others), certain categories are treated as “sensitive,” “special category,” or “particular” personal data. With your consent or another lawful basis, Monarch processes the following sensitive categories:

• Health and fitness data you log or grant from HealthKit.

• Biometric-derived data — body composition estimates inferred from photos you submit.

• The contents of communications you send through Monarch.

• A government identifier processed by Persona only to verify that you are an adult; Monarch does not store the identifier itself.

• Precise device-side location, used briefly on-device to determine your nearest gym; only the gym identifier (not the coordinates) is uploaded.

We do not use sensitive personal information for purposes other than those listed in Section 4. California residents may limit our use of sensitive personal information; see Section 12.4.

4. How we use information

We use the categories of information described above for the following purposes:

What we never do

• We do not sell your personal information for money.

• We do not use Apple HealthKit data for advertising or share it with data brokers.

• We do not run third-party advertising networks inside Monarch.

• We do not use the content of your AI prompts to train third-party models; our agreements with OpenAI and Anthropic prohibit that use.

5. Legal bases for processing (EEA, UK, Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Articles 6 and 9 GDPR (and equivalent provisions of the UK GDPR and Swiss FADP):

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you have the right to object (see Section 12.1).

6. How we share information

We share personal information only in the limited circumstances described below.

6.1 With other Monarch members

Other members see what your visibility settings allow them to see: your display name, profile photo, optional bio, optional Instagram handle, Discipline Score, verified-gym membership, and presence on the map. Members you accept as connections can also message you and see your gym check-ins. You can hide yourself, restrict visibility to connections only, or remove individual connections at any time.

6.2 With service providers acting on our behalf

We use a small number of trusted vendors to host data and run features. They act as our processors (or, under US laws, our service providers) under written contracts that limit how they can use your information. See the table in Section 7.

6.3 In the context of a corporate event

If Monarch is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal information may be transferred as part of that transaction, subject to confidentiality and to the rights described in this Policy.

6.4 To comply with law and protect rights

We may disclose information to courts, regulators, law-enforcement authorities, and other third parties where we believe in good faith that disclosure is required by law, necessary to investigate fraud or abuse, or necessary to protect the rights, property, or safety of Monarch, our members, or the public. Where we are legally permitted to do so, we will notify you of the request first.

6.5 With your direction

We share information at your direction — for example, when you choose to broadcast a spotter request to nearby members, or accept a connection request.

6.6 No sale of personal information

Monarch does not sell personal information for monetary consideration. As explained in Section 12.4, we also do not “share” personal information for cross-context behavioural advertising as that phrase is defined under California law.

7. Service providers and third-party processors

The categories of vendors below help us deliver the Service. Each is bound by a written agreement that limits how they may use the information they process for us.

Where required by law, the privacy notice or data-processing agreement of each provider applies in addition to this Policy. We update this list as our processors change.

8. International data transfers

Monarch is operated from California, United States, and our main service providers are located in the United States. When personal information is transferred from the EEA, the United Kingdom, Switzerland, Brazil, Quebec, or other jurisdictions with cross-border rules, we use the following safeguards:

• European Economic Area → United States: the European Commission’s Standard Contractual Clauses (Decision 2021/914) supplemented by the EU-US Data Privacy Framework where applicable to a specific recipient, and a transfer impact assessment.

• United Kingdom → United States: the UK Addendum to the Standard Contractual Clauses, or the UK extension to the Data Privacy Framework.

• Switzerland → United States: the Standard Contractual Clauses with the Swiss-FADP-specific amendments, or the Swiss-US Data Privacy Framework.

• Brazil → United States: the ANPD-approved Standard Contractual Clauses or your explicit consent under Article 33 LGPD.

• Other jurisdictions: equivalent contractual safeguards or your consent.

A copy of the relevant clauses is available on request from legal@monarch.coach.

9. How long we keep information

We keep personal information only for as long as it is needed for the purposes described in this Policy and to meet our legal, accounting, and reporting obligations. Specifically:

• Account, profile, training, and Discipline Score history: while your account is active, plus a short grace period after deletion to recover from accidental loss (no more than 30 days unless we are legally required to retain it longer).

• Map photos, messages, and social interactions: until you delete them, you delete your account, or another member you contacted exercises their own deletion rights.

• Identity-verification result: for the duration of your map eligibility plus a reasonable period to defend against fraud and abuse claims (typically up to 24 months).

• Subscription, billing, and tax records: for the period required by applicable tax, accounting, and consumer-protection law (typically 5–7 years).

• Diagnostics, crash logs, abuse-prevention logs: typically 90 days, longer if needed for an investigation.

• Backups: rolling backups expire within 35 days.

When the retention period ends we delete the data or irreversibly anonymise it.

10. How we protect information

We use administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include encryption in transit (TLS) and at rest, access controls, least-privilege engineering practices, audit logging, secure software development practices, and incident-response procedures. No service is completely secure; if you suspect that your account has been compromised, contact us immediately at support@monarch.coach.

11. Your choices and controls

You can exercise the following controls from inside the Monarch app, regardless of where you live:

• Profile: edit or remove any field on your profile, including height, weight, bio, photos, and Instagram handle.

• HealthKit: revoke Monarch’s access at any time from Settings → Health → Data Access & Devices → Monarch on your iPhone.

• Map visibility: hide yourself from the map, restrict visibility to accepted connections only, or remove individual connections.

• Notifications: turn off push notifications system-wide or for a specific Monarch category. Email opt-out links appear in every non-transactional email.

• Subscription: manage and cancel your subscription in the App Store at any time. Cancellation prevents the next renewal but does not retroactively refund completed periods.

• Account deletion: delete your account from Settings → Account → Delete account, or by writing to legal@monarch.coach.

12. Region-specific rights

The rights below apply in addition to the controls above. To exercise them, write to legal@monarch.coach with the words “Privacy request — [your region]” in the subject line. We will verify your identity using information already in your account and respond within the time required by the applicable law.

12.1 EUROPEAN ECONOMIC AREA

If you are in the EEA, you have the following rights under the GDPR:

• Access (Art. 15) — obtain a copy of the personal information we hold about you.

• Rectification (Art. 16) — correct inaccurate or incomplete data.

• Erasure (Art. 17) — have your data deleted, subject to exceptions.

• Restriction (Art. 18) — restrict how we use your data while a dispute is being resolved.

• Portability (Art. 20) — receive the data you have given us in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible.

• Objection (Art. 21) — object to processing carried out under legitimate interests or to direct marketing.

• Withdraw consent (Art. 7(3)) — withdraw any consent you have given, at any time.

• Lodge a complaint with the supervisory authority of your habitual residence or place of work (Art. 77). A directory is available at edpb.europa.eu/about-edpb/about-edpb/members_en.

• Automated decision-making (Art. 22) — we do not subject you to decisions producing legal or similarly significant effects based solely on automated processing.

12.2 UNITED KINGDOM

If you are in the United Kingdom, the rights listed in 12.1 apply under the UK GDPR and the Data Protection Act 2018. You may lodge a complaint with the Information Commissioner’s Office at ico.org.uk.

12.3 SWITZERLAND

If you are in Switzerland, the rights listed in 12.1 apply under the revised Federal Act on Data Protection (revFADP) of 25 September 2020. You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

12.4 CALIFORNIA (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties to whom we disclose it.

• Right to delete personal information we have collected from you, subject to legal exceptions.

• Right to correct inaccurate personal information.

• Right to opt out of sale and sharing. Monarch does not sell or “share” personal information as those terms are defined in the CCPA. If this ever changes, we will provide a clear “Do Not Sell or Share My Personal Information” link.

• Right to limit use of sensitive personal information. You may direct us to limit our use of health, biometric, government-ID, communications-content, and precise-location data to what is necessary to provide the Service. We already restrict these uses; you can confirm or further restrict them by writing to legal@monarch.coach.

• Right to non-discrimination for exercising your privacy rights.

• Right to designate an authorized agent to make a request on your behalf.

Categories collected in the past 12 months (CCPA §1798.140): identifiers; customer records; commercial information (subscription and purchases); internet/network activity; geolocation (approximate); audio/visual (photos, voice prompts); professional/employment-related info if you choose to share it; inferences (e.g., training preferences); and sensitive personal information as described in Section 3.10.

Categories disclosed for a business purpose: all categories above, to the service providers listed in Section 7, for the purposes listed in Section 4.

Categories sold or shared: none.

Retention: as described in Section 9.

Submitting a request: write to legal@monarch.coach. We will acknowledge within 10 business days and respond within 45 calendar days, with one 45-day extension where allowed.

Shine the Light (Cal. Civ. Code § 1798.83): California residents may request information about disclosures, if any, to third parties for direct-marketing purposes. We do not make such disclosures.

Global Privacy Control: where you visit our website through a browser that sends an opt-out preference signal (such as the Global Privacy Control), we will treat that signal as a valid request to opt out of sale or sharing for that browser and, where you are logged in, for your account.

12.5 OTHER UNITED STATES STATES

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska, or another US state with a comprehensive privacy law in force, you have rights to access, correct (where the state law provides), delete, port (where the state law provides), and opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) certain profiling. Monarch does not engage in (i), (ii), or solely-automated profiling that produces legal or similarly significant effects, so the opt-out is effectively pre-applied. For sensitive data, we obtain consent as the state law requires. You may appeal a denied request by replying to our response email; we will inform you of the relevant Attorney General’s office if your appeal is unsuccessful.

12.6 CANADA AND QUEBEC

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, under An Act respecting the protection of personal information in the private sectoras amended by Law 25, to access, correct, withdraw consent for, and (in Quebec) request the deletion, de-indexing, and portability of personal information about them. Quebec residents may also object to automated decision-making and request human review. Our Privacy Officer for these purposes can be reached at legal@monarch.coach. Complaints may be filed with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information (cai.gouv.qc.ca).

12.7 BRAZIL (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (Law 13.709/2018) to confirm processing, access, correct, anonymise, block, delete, port, withdraw consent, be informed about data sharing, and be informed about the consequences of refusing consent. The data-protection officer (Encarregado) can be reached at legal@monarch.coach. The supervisory authority is the ANPD (gov.br/anpd).

12.8 AUSTRALIA

If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles give you the right to access and correct personal information we hold about you. You can complain to us at legal@monarch.coach and, if you are not satisfied, to the Office of the Australian Information Commissioner (oaic.gov.au). We will normally respond to a complaint within 30 days.

12.9 JAPAN

If you are in Japan, you have rights under the Act on the Protection of Personal Information (APPI) to disclosure, correction, addition, deletion, cessation of use, cessation of provision to third parties, and disclosure of records of provision to third parties. You can write to legal@monarch.coach.

12.10 SOUTH KOREA

Under the Personal Information Protection Act (PIPA), Korean residents may request confirmation, access, correction, deletion, and suspension of processing. The Personal Information Protection Commission is the supervisory authority (pipc.go.kr).

12.11 MAINLAND CHINA

Where the Personal Information Protection Law (PIPL) applies, you have rights of knowledge and decision-making, access and copy, portability (subject to CAC rules), correction, deletion, withdrawal of consent, explanation of processing rules, and post-mortem rights for close relatives. Cross-border transfers from China are made on the basis of standard contracts, certification, or security assessment as required, and with your separate consent where mandatory.

12.12 SOUTH AFRICA

Under the Protection of Personal Information Act (POPIA), you have rights to be notified, access, correction, deletion, objection, and to lodge a complaint with the Information Regulator (inforegulator.org.za). Our Information Officer can be reached at legal@monarch.coach.

12.13 INDIA

Under the Digital Personal Data Protection Act, 2023, Indian residents may request access, correction, completion, updating, erasure, and grievance redress. You may write to legal@monarch.coach and may also approach the Data Protection Board of India.

12.14 ISRAEL, TURKEY, THE UAE, SAUDI ARABIA, AND OTHER JURISDICTIONS

If you reside in a jurisdiction with comprehensive data-protection law (including but not limited to Israel’s Privacy Protection Law, Turkey’s KVKK, the UAE PDPL, and Saudi Arabia’s PDPL), you have equivalent rights to access, correct, and (where the local law provides) delete or object to processing. Contact legal@monarch.coach.

12.15 ILLINOIS BIOMETRIC NOTICE (BIPA)

If you reside in Illinois, the only biometric-style processing that Monarch initiates on your behalf is (i) the liveness check Persona performs to confirm you are a real adult before you appear on the map, and (ii) on-device computer-vision analysis of body-composition photos you submit. Persona retains and uses biometric identifiers only as described in Persona’s policy; Monarch does not store biometric identifiers itself. By initiating identity verification, you provide written consent within the meaning of 740 ILCS 14/15(b). Biometric data is retained only as long as needed for the verification purpose or 3 years after your last interaction with Monarch, whichever is shorter.

13. Children and minors

Monarch is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. The gym-social map gates access behind an adult-verification check by Persona. If you believe a child has provided personal information to us, please contact legal@monarch.coach and we will delete the information promptly.

14. Cookies, SDKs, and tracking technologies

The Monarch mobile app uses identifiers stored on your device (Apple identifiers, the Firebase Installation ID, push tokens, and our own session tokens) to authenticate you and run the Service. The Monarch website uses only strictly-necessary cookies needed to serve the site; it does not run third-party advertising cookies. Where local law requires consent for non-essential cookies, we ask for that consent through a cookie banner before any are set.

15. Apple App Tracking Transparency

Monarch does not track you across apps or websites owned by other companies for advertising or measurement purposes, and therefore does not show the App Tracking Transparency prompt. If we ever introduce a feature that would, we will request your permission through the system prompt first and disclose it here.

16. Artificial intelligence and automated processing

Monarch uses large-language models from OpenAI and Anthropic to generate training plans, parse meal logs, estimate body composition from photos you submit, and power the voice coach. These features are designed to help you train better; they are not medical, diagnostic, or therapeutic services. AI output can be wrong — use your own judgement and consult a qualified professional for medical questions.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. You can ask us to explain a particular suggestion, contest it, or request a human review by writing to legal@monarch.coach.

17. Changes to this Privacy Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top and, for material changes, give you advance notice inside the app or by email. Continuing to use the Service after the effective date of an update means you have read the update.

18. How to contact us

Monarchia LLC
3424 Long Beach Blvd, Long Beach, CA 90807, USA
Privacy: legal@monarch.coach
General support: support@monarch.coach