UPSHIFT Privacy Policy

Version 2026-10-11

Draft — under legal review. This document is a draft and has not been reviewed by a lawyer yet. Highlighted text in [brackets] is a placeholder that will be filled in during the review.

This policy explains what information the UPSHIFT apps (iPhone/iPad and Android) handle, where it is kept and the choices you have. UPSHIFT is operated by [Operator legal name] ("UPSHIFT", "we", "us"), [postal address]. Contact: [contact email].

1. The short version

UPSHIFT works without an account. By default, your profile and training stay on your device.
An account is optional. If you create one (with your email address), your data is backed up to our server so you can sync between devices.
Usage analytics and crash reports are off unless you turn them on. This version keeps analytics on your device only and does not send crash reports.
We do not show ads, we do not sell or rent your personal information, and we do not track you across other apps or websites.
You can export your data and delete it, on your device and on our server, from inside the app.
Athletes 12 and younger can use UPSHIFT only on their device. Cloud accounts are not available to them.
Some exercises have a demonstration video hosted on YouTube. Nothing is loaded from YouTube until you tap play. Then the video plays from YouTube (a Google service) in privacy-enhanced mode, and YouTube's own terms and Google's privacy policy apply to that playback.

2. What we never ask for

UPSHIFT does not ask for your date of birth, body weight or other body measurements, photos, location, contacts or a free-text biography.

3. Information stored on your device

The app stores this information in its own storage on your device:

Profile: optional nickname, sports and positions or event groups, age band (12 or younger, 13–15, 16–17, 18 or older), optional school level, experience, goal, season phase, equipment, training places, training days, session length, whether a qualified coach supervises your loaded training, and exercises you chose to exclude.
Training: programs you follow, finished workouts with the sets you logged (for example reps, time, distance and weight lifted), effort and soreness ratings, notes you type, favorite exercises, custom workouts, schedule changes and performance test results.
Calendar: games, matches, meets, team practices and other activity you add, with details you enter (such as title, opponent, minutes played and effort). For Baseball, whether you pitched and an optional pitch count.
Check-ins: voluntary readiness answers (sleep, energy, soreness) and pain reports. These are about your health. We use them only to adjust your training suggestions, for example to suggest rest after a pain report.
Settings: units, appearance, accessibility, reminders, privacy choices and which version of our legal documents you accepted and when.

Training reminders are scheduled by the app on your device. We do not use a push notification server.

Your phone's own backup feature (for example iCloud or Google device backup) may include this data, depending on your device settings. Apple and Google handle those backups, not us.

4. Optional account, backup and sync

If you are 13 or older, you can create an account with your email address. We send a 6-digit sign-in code to that email. If you are under 18, the app asks you to check with a parent or guardian before creating an account. Backup and sync may require a subscription.

When you are signed in, the information in section 3 (except device settings and a workout still in progress) is copied to our server so it can be restored and synced between your devices. We also store your email address, the device platform (iOS or Android) where a workout was recorded, and technical information needed for sync (record IDs, versions and timestamps). The sign-in service may keep security logs, such as the IP address and time of sign-ins.

Your sign-in session is stored in your device's secure storage (Keychain on iOS, Keystore-protected storage on Android).

5. Purchases

Subscriptions are bought through Apple's App Store or Google Play. They process your payment; we never receive your card or bank details. To give you access, the app sends us the store's proof of purchase, and we store the store name, product, purchase status (for example trial, active or expired), expiry date, transaction identifiers and selected non-personal details of the store's response. Apple and Google also send us updates about renewals, refunds and cancellations. To link a purchase to your account, the app gives the store an internal account identifier (on Android, a scrambled form of it). It never gives the store your email address or nickname.

6. Analytics, crash reports and feedback

Analytics are off by default. If you turn them on, the app records a small number of events on your device: a session started (with its source, such as program or custom, and the sport) and a workout finished (with its status and source). Events never include your name, email, notes or detailed training data. You can view and clear this log in You › Privacy, and turning analytics off clears it. This version does not send analytics anywhere.
Crash reports are off by default. This version does not collect or send crash reports.
If a future version sends analytics or crash reports to our server, it will do so only for signed-in users who turned the setting on, and we will update this policy first.
Feedback: Help & feedback opens your device's share sheet or email app. Nothing is sent unless you choose to send it. You can see the short technical summary (app version, content version, primary sport, units, appearance, reminder and account status) before including it. If you email us, we receive your email address and whatever you write.

7. Program content updates and demonstration videos

If your version of the app is connected to our server, it may check for and download updated program content. These requests do not include your profile or training data, but like any internet request they reveal technical information such as your IP address to our server.

Some exercises link to a demonstration video that someone else published on YouTube. Until you tap play, the app shows a picture drawn on your device and does not contact YouTube. When you tap play, your device connects directly to YouTube, a Google service, and the video plays inside the app in YouTube's privacy-enhanced mode (youtube-nocookie.com). If you choose "Open in YouTube", the video opens in the YouTube app or your browser instead. Like any video service, YouTube then receives technical information such as your IP address, device and browser details, and that the request comes from the UPSHIFT app. YouTube's Terms of Service and Google's Privacy Policy apply to that playback. We do not send YouTube your profile, training data or account details, and we do not receive information from YouTube about what you watch. Videos need an internet connection; without one, the setup steps and coaching cues still work.

8. How we use information

We use information only to run UPSHIFT for you: to build your training suggestions, save and sync your data, give you subscription access, keep accounts secure, answer your messages and meet legal obligations. We do not use it for advertising or to build profiles about you for anyone else.

We do not sell or rent personal information, and we do not share it for advertising. We share it only with:

Supabase ([Supabase legal entity]), which hosts our database, sign-in service, file storage and server functions on our behalf, in [server region];
[email delivery provider], which sends sign-in code emails on our behalf;
Apple and Google, to process and verify purchases (and as the app stores you use);
YouTube (Google), only when you tap play on a demonstration video (or open it in YouTube): your device then connects to YouTube directly, as described in section 7. We do not send YouTube your personal information;
authorities or others when the law requires it, or to protect someone's safety.

10. Keeping and deleting information

On your device, data stays until you delete it. In You › Your data you can delete training history, programs and schedule, your profile, favorites and custom workouts, reminders, or everything on the device.
On our server, data stays while you have an account. When you delete an item while signed in, it is marked as deleted and removed from your other devices; the marked record stays on the server until your account is deleted. [Engineering/lawyer to confirm whether deleted records should be purged sooner.]
Deleting your account (You › Account & backup) permanently removes your account, email address, backed-up training, purchase records and any files stored for you from our server. You choose whether to keep the copy on your device. We keep only an anonymous record that a deletion happened (date, platform and how many items were removed), with no account ID or email. Server backups kept by our hosting provider may hold deleted data for up to [backup retention period].
Deleting your account does not cancel a store subscription, and Apple and Google keep their own purchase records.

11. Your choices and rights

You can view and edit your profile, export all your UPSHIFT data to a file (You › Your data), import it again, turn analytics and crash reports on or off, and delete data or your account at any time. Depending on where you live, you may have further rights, such as to access, correct or delete your information, or to complain to a data protection authority. Contact us at [contact email] to make a request. [Lawyer to add region-specific rights, for example for US states, the EU and UK.]

12. Children and teens

12 and younger: UPSHIFT works on the device only. The app does not offer accounts or cloud backup, and our server refuses profiles in this age band. Their profile and training are not sent to us. A parent or guardian should help set up and supervise use.
13 to 17: accounts are optional. The app shows a notice to check with a parent or guardian before creating one and asks athletes to review our documents with a parent or guardian.
Parents and guardians can contact us at [contact email] to ask about, or delete, information connected to their child's account.

We designed these limits with children's privacy laws, such as the US Children's Online Privacy Protection Act (COPPA), in mind. Whether UPSHIFT meets the requirements of COPPA and of other laws for young users (for example in the EU or UK) has not yet been confirmed and requires review by a qualified lawyer before publication. Age bands are self-reported, so we cannot verify them.

13. Security

Data sent between the app and our server is encrypted in transit (HTTPS). Each account can access only its own records on the server. Sign-in codes expire after 15 minutes and sign-in sessions are kept in secure device storage. Data on your device is protected by your device's security, so please use a screen lock. No system is completely secure, and we cannot guarantee security.

14. International transfers

Our server is located in [server region]. If you use UPSHIFT from another country, your information may be processed there. [Lawyer to add transfer safeguards if required.]

15. Changes to this policy

When we change this policy, we update its version. If a change is significant, we will tell you in the app before it applies.

16. Contact

[Operator legal name], [postal address], [contact email].