IronSage requests permissions only when needed to power specific features. Most permissions are optional—you can use core workout logging and tracking without granting them. We explain each permission in plain language before requesting it.
Core principles
- Request on use: Permissions are requested when you try to use a feature, not at app startup
- Clear explanation: You'll see a plain-language explanation before any permission request
- Optional by default: Most permissions are optional; declining won't prevent core workout tracking
- Revocable: You can revoke permissions anytime via Android Settings → Apps → IronSage → Permissions
| Permission | Purpose | When requested | Required? |
|---|---|---|---|
POST_NOTIFICATIONS |
Send rest timer alerts, sync status updates, and workout reminders. You control notification types in app settings. | When you enable notifications in Settings or start your first workout with timers. | Optional |
BODY_SENSORSBODY_SENSORS_BACKGROUND |
Read heart rate data during workouts via Health Connect or connected devices. Background access allows continuous monitoring during an active workout session. | When you enable heart rate tracking in workout settings. | Optional |
BLUETOOTH_SCANBLUETOOTH_CONNECT |
Scan for and connect to Bluetooth heart rate monitors and fitness devices (e.g., chest straps, smartwatches). | When you tap "Pair Device" in heart rate settings. | Optional |
ACCESS_FINE_LOCATIONACCESS_COARSE_LOCATION |
Android 11 and below only: Required by Android OS for Bluetooth LE scanning. IronSage does not track or store your location. | Only on Android ≤ 11, when scanning for Bluetooth devices. | Optional* |
ACTIVITY_RECOGNITION |
Detect movement patterns to auto-pause rest timers when you're actively exercising and resume when you rest. | When you enable "Smart rest timer" in workout settings. | Optional |
READ_MEDIA_IMAGES(Android 13+) |
Access photos you select to attach to workout notes. Only selected images are accessed, never your full photo library. | When you tap "Attach photo" in workout notes. | Optional |
READ_EXTERNAL_STORAGE(Android 12 and below) |
Legacy permission for accessing selected images on older Android versions. | When you tap "Attach photo" on Android ≤ 12. | Optional |
CAMERA |
Scan QR codes to import workout templates shared by other users or trainers. | When you tap "Scan QR code" in the routines screen. | Optional |
USE_BIOMETRIC |
Lock the app with fingerprint or face unlock for privacy when others use your phone. | When you enable "Biometric lock" in Settings → Security. | Optional |
FOREGROUND_SERVICE |
Run workout timer and heart rate monitoring while you're using other apps or the screen is off. Required for reliable timer operation. | Automatically when you start a workout with active timers or heart rate monitoring. | Required for timers |
VIBRATE |
Provide haptic feedback for timer alerts and button presses. | Granted automatically (no prompt required). | Auto-granted |
WAKE_LOCK |
Keep the screen on during active workouts to display timer and metrics. | Granted automatically (no prompt required). | Auto-granted |
* On Android 11 and below, location permission is required by the Android OS for Bluetooth LE scanning, even though IronSage never tracks your location.
Permission details & data usage
Heart rate & sensors
When you enable heart rate monitoring, IronSage accesses data from Health Connect or Bluetooth devices. This data:
- Is stored only on your device by default
- Syncs to your private Firebase account if you're signed in
- Is never sold to advertisers or third parties
- Is used only to display workout metrics and track your fitness progress
Location (Android ≤ 11 only)
IronSage does not track your location. On Android 11 and below, location permission is required by the Android operating system for Bluetooth Low Energy scanning. This is an Android OS requirement, not an IronSage feature. On Android 12+, we use the new Bluetooth-specific permissions that don't require location access.
Photos & camera
When you attach photos to workout notes or scan QR codes:
- Photos: Only images you explicitly select are accessed. We don't scan your photo library.
- Camera: Used only for QR code scanning. No photos are saved unless you choose to.
- All media stays on your device unless you sync your account.
Notifications
IronSage sends notifications for:
- Rest timer completion (vibration + sound)
- Background sync status (when sync fails or completes after connectivity issues)
- Workout reminders (if you enable them in settings)
You can customize notification types in Settings → Notifications. We never send marketing or promotional notifications.
Health Connect integration
IronSage integrates with Health Connect (Google's health data platform) to read and write heart rate data. When you connect to Health Connect:
- You control which data IronSage can access via Health Connect's permission screen
- IronSage reads heart rate data during workouts to display live metrics
- IronSage writes workout summaries (duration, intensity) back to Health Connect
- All data sharing follows Health Connect's privacy policies
You can revoke Health Connect permissions at any time via Settings → Apps → Health Connect → App permissions → IronSage.
Managing permissions
To review or change permissions after granting them:
- Open Android Settings → Apps → IronSage
- Tap Permissions
- Select any permission to change it to "Allow", "Ask every time", or "Deny"
Revoking a permission will disable related features but won't affect your core workout tracking.
For information about how we store and protect data collected via these permissions, see our Privacy Policy.