Last updated 18 October 2026.
Questlift keeps your training on your phone. Two features send anything anywhere, both are off until you turn them on, and this page says exactly what each one does.
Every session, every set, your baseline, your streak, your quests, your gear, any period dates you log and every health reading are stored in a database on your device. With no account, there is no server holding any of it.
On Android the app reads Health Connect; on iPhone it reads Apple Health. It only ever reads, and only what you allow: sleep, heart-rate variability, resting heart rate, steps, active energy and weight. It writes nothing back. Those readings are used for one thing — deciding how hard each session should be — and are never used for advertising, never sold, and never sent to iCloud by the app.
One thing worth knowing on iPhone: if you use Apple's own iCloud Backup, your phone backs up every app's data, this one included. That backup is Apple's, made by your phone, and you can leave Questlift out of it under Settings → your name → iCloud → Manage Storage → Backups.
On Android you can also sign in to Oura or Garmin directly. The app then fetches your own readings from their service straight to your phone; the sign-in tokens stay in your phone's secure storage and nothing passes through our server. Oura and Garmin's own privacy policies cover what they hold.
If you turn it on, a copy of that database is encrypted on your phone with a key derived from a recovery code we never receive, and the encrypted bytes are stored on our server. We cannot read them. Nobody who works on this app can read them.
That is a property of how it is built rather than a promise: the key never leaves your device. The other side of it is that if you lose your recovery code, the backup cannot be opened by anyone, including us, and there is no reset.
Health readings (from Health Connect, Apple Health or a connected wearable) are covered by a switch in the backup screen. On Android they are included by default; on iPhone they are left out until you turn the switch on. Turning it off and backing up again replaces the stored copy with one that does not contain them. Your sessions, check-ins and any period dates you log are always part of the backup. All of it is inside the encrypted copy, which we cannot read.
If you add friends, we keep a small record that we can read — because your friends' phones have to be shown it. It is exactly this and nothing else:
| Kept | Not kept |
|---|---|
|
Your display name, if you set one Your character and what it is wearing Your current streak (a number of days) The date you last trained Which quests you have finished |
Anything from Health Connect, Apple Health or a wearable Heart rate, HRV, sleep, steps, calories Your weight or any body measurement Any set, rep, load, duration or session count Any time of day |
None of it is visible to anyone until both of you have accepted, and you can hide your streak while staying on the screen.
A wave sends a friend one of five fixed phrases. You cannot type a message, so nothing you write is ever delivered to another person. We store who waved at whom, which phrase, and when; waves are deleted when a friendship ends. On Android, if you allow notifications, we store your phone's notification token so a wave can reach you; on iPhone, waves are shown inside the app.
If you report someone, we keep the report (who reported whom, by friend code, and the reason you picked) and email it to our own inbox so it is reviewed within 24 hours. Rules for the friends feature are in the terms of use.
You sign in with your email address and a password, or with a six-digit code we email you. We store your address so you can sign in again. A code is stored only as a hash and only for ten minutes.
Your password never reaches us. Your phone (or our reset page, in your browser) turns it into two keys. One is sent to us to check that it is you, and we store only a scrambled form of it. The other never leaves your device: it locks a copy of your backup's recovery code, so a new phone can restore with just your password. We store that locked copy and cannot open it.
If you forget your password, we email a one-time link (it expires after an hour) to make a new one. Because we never hold a key that opens your backup, a reset cannot unlock it on its own: the phone you already use keeps everything, and a brand-new phone asks once for your recovery code.
Worth being clear about: your inbox can reset your account. It cannot open your backup. Someone with access to your email could see your friends list; they could not read your training.
| Who | What they handle |
|---|---|
| Cloudflare | Hosting, the database, and storage of the encrypted backups |
| Resend | Sending sign-in codes and password-reset links to your email address, and reports to our inbox |
| Google (Firebase) | Delivering wave notifications to Android phones |
This app is intended for adults. It is not directed at children.