The short version
Rounds is an interval timer with an account behind it. It carries no analytics, no advertising and no third-party tracking SDKs, and nothing about you is sold or shared for marketing.
What is stored is what the app needs to give you your training back on another device: your email address, your routines, and the workouts you have finished.
Your account
Signing in creates an account against your email address. Sign in with Apple passes an identifier and, on the first sign-in only, the name you choose to share. The email route stores the address and a hash of the six-digit code, never the code itself, and that code stops working the moment it is used or ten minutes pass.
There is no password, so there is none of yours to leak.
What the server stores
Your routines, your exercise library and any photos you attach to it, the days you have scheduled, and each finished workout: its interval settings, when it started and ended, and how many rounds you got through.
The service runs on Cloudflare. The sign-in email is delivered by Resend, which sees the address and the code. Purchases are handled by Apple, which is what confirms your subscription, so no card details ever reach Rounds.
What the app stores on your device
Your timer settings, and any finished workout that has not yet been uploaded. Those queue on the device so a session completed in a gym with no signal is not lost.
The token that identifies your session is stored in the iOS keychain. It is never written to preferences, logs or backups in plain text.
Strava
Connecting Strava is optional and off until you press the button. Doing it stores the tokens Strava issues, along with your Strava athlete id and name, so finished workouts can be posted there on your behalf.
What is posted is the workout: its name, when it started and how long it ran, and one set per round carrying the movement, the reps and the weight where you recorded them. Nothing that is not part of a workout is sent.
Disconnecting deletes those tokens. Activities already posted stay on Strava, where they are yours to delete.
What is never collected
No advertising identifier. No location. No contacts, photos or health records from Apple Health. No behavioural or usage analytics. No crash reporting beyond what Apple provides to developers in aggregate, which you control in iOS Settings under Privacy and Security, Analytics and Improvements.
Children
Rounds is not directed at children under 13 and knowingly collects nothing from them.
Your control
Deleting the app removes everything it stored on your device, including the queued workouts and the stored token. Signing out clears the token without touching what is on the server.
To close your account and have what is stored with it deleted, write to hello@userounds.app from the address you signed in with. Ask for a copy of it instead and you get one.
Changes
If this policy changes materially, the effective date above will change and the revised policy will be published here before the change takes effect.
Contact
Questions about this policy go to hello@userounds.app.