Privacy policy
- Phone firstYour diary lives on your phone. No account needed.
- Sync only if you chooseA copy goes to our server in Germany only after you agree.
- Photos stayYour photos and Apple Health readings never reach our server, unless you attach a screenshot to feedback.
- No ads, no trackingNo advertising, no selling of data. Usage statistics only if you turn them on.
- Yours to takeExport or delete it all, any time.
1. Who is responsible
The controller of your personal data under the EU General Data Protection Regulation (GDPR) is [CONTROLLER NAME], [POSTAL ADDRESS]. For anything about your data, write to privacy@upwell.page.
Representative in the EU (Art. 27 GDPR): [EU REPRESENTATIVE].
We have not appointed a data protection officer.
2. What stays on your phone
Upwell works without an account and offline. What you record is kept in the app’s storage on your phone. We have no access to it, and it reaches our server only if you turn on sync (section 5):
- your diary: the foods and dishes you log, weigh-ins, workouts and sets, plans, routines and programs, challenges, cheat days and supplements;
- your profile: a name and photo if you add them, height, year of birth, sex, goal and targets, and your answers to the first-run questions;
- the photos you take or pick for foods and for your profile;
- your settings and reminders (reminders are scheduled on the phone; nothing is sent to show them).
Body numbers are health data. Before the app uses your height, year of birth, sex and weight, it asks for your explicit consent. You can withdraw it at any time in You › Data & privacy › Body data.
Apple Health. If you connect it, the app reads — never writes — steps, active energy, exercise minutes, walking and running distance, workouts, sleep and body weight, to show them to you. Weigh-ins from Health are copied into the app on your phone for your weight trend; the rest is read when a screen needs it. Readings from Apple Health are never sent to our server, not even with sync on; they are never used for advertising and never shared with anyone. You can disconnect in You › Integrations › Apple Health (which also removes the copied weigh-ins) or in the Health app.
Location. Only when you tap Use my location, the app reads one approximate position, works out on the phone which country it is in (with a map built into the app) and keeps only the two-letter country code, to show that country’s foods first. The position itself is never stored or sent.
Camera. Barcodes and nutrition labels are read on the phone. Camera frames are neither stored nor sent.
Phone backups. If you back up your phone (to iCloud, Google or a computer), the system may include the app’s data in that backup, under your backup provider’s terms.
3. When the app goes online
Even without an account, the app makes a few requests. None of them carries your diary, your body numbers or anything from Apple Health. Like any request on the internet, each one shows the receiving service your IP address.
- Food data. The food catalog and menus are downloaded from our storage at Google Cloud in Frankfurt, Germany.
- Open Food Facts. When you scan a barcode or search products online, the app sends the barcode or the words you typed to Open Food Facts, a French non-profit association, and loads product photos from its image server. Open Food Facts’ own privacy policy applies to those requests.
- Google Sheets. Only if you import from a Google Sheets link you paste, the app downloads that sheet from Google.
- Text recognition on Android. Google Play services downloads the on-device text-recognition model once; your photos and their text stay on the phone.
- Crash reports (section 7).
- Usage statistics, only if you turn them on (section 8).
- Feedback, only when you send it (section 9).
- Remote settings (section 10).
4. Your Upwell account
An account is optional. While Upwell is in private testing, you can create one only with an invite code.
| What | Why | Legal basis |
|---|---|---|
| Email address and password | So you can sign in. The password is kept only as a hash made by the sign-in service; we never see it. | Contract (Art. 6(1)(b) GDPR) |
| Username and display name, if you choose them | So friends can find and recognise you. They are the only account details other people see. | Contract (Art. 6(1)(b)) |
| Invite code | To check that you were invited. We keep only a fingerprint of the code and how often it was used. | Contract (Art. 6(1)(b)) |
| Account events (such as sign-up, sign-in and sign-out) with their time and IP address | To keep accounts safe and to look into abuse. | Our legitimate interest in security (Art. 6(1)(f)) |
Signing in sends nothing from your diary. Your sign-in tokens are kept in the phone’s secure storage (Keychain or Keystore).
5. Sync
Sync is off until you turn it on, for each profile, in You › Account › Turn on sync. Before it starts, the app asks for your explicit consent and tells you what is stored, where, and how to take it back.
What is copied to our server
That profile’s diary: the foods and dishes you made or used, what you logged, the weigh-ins you entered, the daily targets the app worked out, workouts and sets, plans and routines, programs, challenges, cheat days, supplements and when you took them, your body data and goal, your answers to the first-run questions, and the settings that are about you (your own targets, meal layout, workout names, answers to suggestions). Also the list of your phones with sync on: platform, app version and when each last synced.
What stays on the phone
Photos, your name and profile photo, readings from Apple Health, reminders, and this phone’s preferences such as language, appearance and food country.
Why we may
Your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). The app records it on our server: when you agreed, the version and a fingerprint of the exact words you saw, and where in the app you agreed.
Taking it back
- Delete the copy on Upwell withdraws your consent: the copy on our server is deleted at once and sync stops on every phone.
- Turn off on this phone stops sync on that phone only; the copy stays for your other phones.
Either way, the diary on your phone stays. Withdrawing a consent does not affect what was done with it before.
6. Sharing with friends
When you choose to share with a friend, they see only what you chose to share with them, and only after you have both accepted. Each choice is a separate consent that you can take back at any time; your friend then loses access. Other people see your username and display name, never your email address. We keep a record of when a friend opened what you share, so that it can be shown to you; each record is deleted after one year.
7. Crash reports
When the app or our server hits an error, a report goes to Sentry, a service of Functional Software, Inc. in the USA. A report holds the error and where in the code it happened, the app and system version and the phone model, and it may hold a random identifier that Sentry’s software creates for the installation. Sentry also receives a short signal when the app starts and stops, so that crash rates can be counted.
Reports are built to contain none of your diary, foods, amounts, weight, body or Health data, nothing you typed or searched, no screenshots, and not your name or email address. Reports from our server name you only by a pseudonym.
Legal basis: our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR). You can object at any time (section 14).
8. Usage statistics (opt-in)
Off by default. The app records and sends nothing for usage statistics until you turn on You › Data & privacy › Share usage stats. It is a separate choice from sync and needs no account.
What an event holds
That a feature was used, described only by fixed values: the area (such as food or gym), the method (such as search or scan), counts rounded into ranges (such as “2–5 entries today”), the app version, the platform, the app’s language, the calendar day (no time of day), and a random install id that the app makes when you turn statistics on. The app collects events on the phone and sends them about once a day.
What it never holds
No health values (no weight, energy, amounts, body numbers, goals or progress), no food or exercise names, nothing you type or search, no account id or email address, and no IP address: our server uses the address of a request only in memory, to limit how often requests can be sent, and does not store it. Our server drops any event it does not recognise.
Taking it back
Turning it off deletes what is waiting on the phone and deletes on our server everything sent under that install id; turning it on again starts a new id. The install id is not linked to your account, so we cannot find these events from your account or your email.
Kept on our server in Germany for 13 months, then deleted. Used only by us, to see which features are used and whether people keep using the app; shared with no one. Legal basis: your consent (Art. 6(1)(a) GDPR; for the phone’s storage, Art. 5(3) of the ePrivacy Directive).
9. Feedback you send from the app
When you send something from You › Help & feedback, our server receives:
- the category (bug, idea or question) and your message;
- an email address for a reply, if you give one;
- the diagnostics the app shows you before you send: app version and build, platform and system version, language, number of profiles, whether sync is on, the food data version and the id of the last crash report — nothing from your diary;
- a screenshot, if you choose to add one. It may show your diary, including health data; whether to add it is your choice, and we use it only for your message.
It is kept on our server in Germany for up to 12 months, and deleted earlier if you ask. We use it only to answer you and to fix what you report, and we do not log its content. Legal basis: your request (Art. 6(1)(b) GDPR); for a screenshot that shows health data, your explicit consent by adding it (Art. 9(2)(a)). You can also write to support@upwell.page instead.
10. Remote settings
Every few hours the app downloads a small public settings file from api.upwell.page: which features are switched on, the oldest app version that still works, and a short notice in case of an incident. The file is the same for everyone. Nothing about you is sent beyond what any request carries (section 3). When a feature is opened gradually, the app decides on the phone, with a random number that never leaves it, whether yours is among the phones that get it.
11. Who helps us
These providers process personal data for us, under data processing agreements and only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Our server: accounts, synced diaries, sharing, usage statistics, feedback, remote settings, and the backups kept on the server | Germany |
| Google Cloud | The food data the app downloads; copies of the database backups | Germany (Frankfurt) |
| Sentry (Functional Software, Inc.) | Crash and error reports | USA |
| [EMAIL PROVIDER] | Emails you send to support@upwell.page and privacy@upwell.page | [EMAIL PROVIDER LOCATION] |
Others act under their own terms, not on our behalf:
- Apple distributes the app (App Store, TestFlight) and runs Apple Health on your phone. If you test through TestFlight, Apple shares with us what TestFlight shows developers: the email address you were invited with (if you were invited by email), when you installed and used builds, crash logs, and any feedback you choose to send.
- Google distributes the Android app (Google Play) and runs Google Play services on Android phones.
- Open Food Facts answers barcode scans and online product searches (section 3).
- Expo (650 Industries, Inc.) builds the app’s install files for us. The app does not contact Expo when you use it.
We do not sell personal data, and we do not share it for advertising.
12. Outside the EU
We keep your data in the EU, in Germany. The exception is crash reports, which Sentry processes in the USA under the EU Standard Contractual Clauses in its data processing agreement (Art. 46(2)(c) GDPR). Apple and Google process data under their own terms, also outside the EU.
13. How long data is kept
| Data | Kept |
|---|---|
| The diary on your phone | Until you erase it (You › Data & privacy › Erase all data) or remove the app |
| Your account | Until you delete it |
| The synced copy and your list of phones | Until you delete the copy or the account; then deleted at once |
| Your consent records | As long as your account exists |
| Records of a friend opening what you share | One year |
| Database backups | Nightly backups: the last 7 on the server, whole-server backups for 7 days, and copies at Google Cloud for 35 days. A backup taken before each server update: the last 3. Backups are used only to recover from a failure. |
| Account events with IP address | [AUDIT LOG RETENTION] |
| Server logs (no diary content; the sign-in service’s lines include IP addresses) | Overwritten automatically as they fill up |
| Crash reports | Up to 90 days at Sentry |
| Usage statistics (if you turned them on) | 13 months; deleted at once when you turn them off |
| Feedback you sent from the app, with its screenshot | Up to 12 months; earlier if you ask |
| Remote settings | Nothing about you is kept; the app keeps its last copy of the file |
| Emails to support or privacy | [SUPPORT EMAIL RETENTION] |
14. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it (Art. 15);
- have it corrected (Art. 16);
- have it deleted (Art. 17);
- restrict its processing (Art. 18);
- take it with you in a machine-readable form (portability, Art. 20);
- object to processing based on our legitimate interests, such as crash reports (Art. 21);
- withdraw a consent at any time, as easily as you gave it (Art. 7(3));
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22). Upwell makes no such decisions: its targets and trends are calculations shown to you.
Most of this you can do yourself in the app:
| Export the diary on your phone | You › Data & privacy › Export my data |
|---|---|
| Export what our server holds | You › Account › Export the copy |
| Delete what our server holds | You › Account › Delete the copy on Upwell |
| Delete your account | You › Account › Delete account (more) |
| Turn usage statistics off and delete them | You › Data & privacy › Share usage stats |
| Erase the diary on your phone | You › Data & privacy › Erase all data |
For anything else, write to privacy@upwell.page — from your account’s email address if it is about your account. We answer within one month and may ask you to confirm that it is you.
You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you think the infringement took place (Art. 77).
15. Do you have to give us data?
No. Everything in Upwell works without an account. An account needs an email address and a password, and sync needs your consent; without them you cannot use the account or sync, and nothing else changes.
16. Age
Upwell is for people aged 16 and over, and it plans a calorie deficit only for people aged 18 and over. If you think someone under 16 has an account, write to privacy@upwell.page and we will delete it.
17. Security
The app talks to our server only over encrypted connections (HTTPS). The database cannot be reached from the internet, passwords are kept only as hashes, and sign-in tokens stay in your phone’s secure storage. The server can add backup copies to Google Cloud but cannot read or delete them, and restoring the newest backup is tested every night. No system is perfectly secure; if a breach puts your rights at risk, we will tell you as the law requires.
18. This website
upwell.page sets no cookies, loads nothing from other websites and has no analytics. Our web server keeps no log of visits; it logs only errors, which can include the IP address of a request that failed.
19. Changes
When what Upwell does with personal data changes, we update this page before that version of the app is released and change the date at the top. Where a change needs your consent, the app asks you again.