Privacy Policy

Last updated: 1 October 2026

Upsy watches you through the camera to count your reps. The video it reads to do that never leaves your phone. This page says what that means exactly, what does leave, and what you can do about it.

1. Who we are

Upsy is published by TC ADVANCED ANALITIQ SRL, a company registered in Romania, trading as Tome Apps. For the purposes of the EU General Data Protection Regulation (GDPR) we are the data controller for the personal data described here.

You can reach us at support@tomeapps.com. There is no contact form on this site, on purpose: an email goes nowhere near us until you decide to send it.

2. The camera, and what it does not do

Counting reps is the whole product, and it is done entirely on your device. The camera feed is read frame by frame by a pose model that runs locally. The result of that model is a set of body keypoints, used for a fraction of a second to decide whether a rep happened, and then discarded.

None of the following is ever transmitted, to us or to anyone else:

• Video, or any part of a video stream.
• The camera frames the pose model reads.
• Pose keypoints, skeletons, angles or any other model output.

There is no upload path for these in the app. It is not a setting that could be switched on by accident, and there is no share button anywhere near them.

The one image that is kept is the set photo: a single frame chosen at the end of each set and saved as a picture of you training. It is a separate file from anything the model reads, and section 4.3 says where it goes.

3. What stays on your phone

Upsy is local first. Every screen reads from on-device storage, and the app works with no network connection once the coach's voice has been downloaded. Stored locally:

• Your set photos. One frame per set, kept as a photo of you training, and backed up to your account (section 4.3). You can delete them individually or all at once, and you can switch the feature off in Settings, in which case none are taken.
• Your training log. Which exercises, how many reps, how long you held a plank, when each set happened.
• Your settings and onboarding answers. Your routine, your daily target, your reminder schedule, the difficulty you picked, and the answers you gave during setup.
• The coach's voice clips, downloaded once and kept in app storage.

Deleting the app deletes all of it from the phone. Your training log, settings and set photos are also kept in your account (section 4), so signing in on a new phone brings them back. Deleting the app does not delete the account; Delete Account does (section 9).

4. What leaves your phone

Eight things, and this list is exhaustive.

4.1 The coach's voice clips come down

The spoken count is recorded audio, fetched read only from Firebase Storage during setup. The files are identical for every user. Nothing about you goes up with the request beyond what any HTTP request necessarily reveals, which is your IP address and a request timestamp in the hosting provider's logs.

4.2 Your own training log and settings go up, to your own account

Every install signs in anonymously on first launch and is given an account identifier (a uid). Your training log and settings are mirrored to that account so that they can be handed back to you on your next phone. That is the entire purpose. The mirror holds:

• Days, sets, exercises, rep counts, held seconds and timestamps.
• Your routine, daily target and reminder schedule.
• Your onboarding answers and app settings.
• The name you chose for friends, if you have set one up (see 4.4).
• Your subscription status, written by our server (see 4.5).

There is no feed, no leaderboard and no public profile. Nothing in your account is readable by any other person, and the database rules make that structural rather than a promise. The one thing another person can ever see is the card described in 4.4, and only people you added as friends can see it.

Signing in with Apple or Google attaches that credential to the same account. When you do, the sign-in provider gives us the name and email address you choose to share. If you use Apple's Hide My Email, we receive the relay address and never your real one. That name and email are used to recognise your account and for nothing else, and they are never passed to the analytics or advertising services below.

4.3 Your set photos go up, to your own account

Each set photo is uploaded to your account in Firebase Storage, together with a small record of when it was taken and which exercise it was. This is so that a new phone, or the same phone after a reinstall, gets your photos back, which is the only reason it is done. On a new phone the photos come down when you open them.

• Only your account can read them. Your friends cannot, and nor can anybody else.
• Deleting a photo in the app deletes it from your account too.
• Switching set photos off in Settings means no photo is taken, so nothing is uploaded. There is no separate switch for the upload.
• Deleting your account deletes every photo in it (section 9).

4.4 Friends: a card they can read, and a nudge they can send

Friends are optional and off until you set them up, which needs a name for friends to see and an Apple or Google sign-in. You add a friend by sharing an invite code, and you can have up to four. While you have friends:

• Your friends can read a card about your training. It holds the name you chose, today's sets against your daily target, the time each set happened and which exercises were in it, the minutes you moved, your streak, your badges, and your totals for the last fourteen days. It is a separate document built from your log, not access to your account. It never includes your set photos, your settings, your subscription or your email.
• A friend can send you a nudge, and you can send them one. This is a push notification, delivered through Firebase Cloud Messaging and Apple's push service. To receive one, your phone registers a push token with your account. That only happens once you have at least one friend. The message is put together by our server from the sender's chosen name and a line from a fixed set written by us, so nobody can send you words of their own.

Removing a friend ends both: they stop seeing your card and can no longer nudge you. Regenerating your invite code stops anyone holding the old one from adding you.

4.5 RevenueCat receives your purchase receipts, your account id and device identifiers

Upsy is a subscription app, and subscriptions are handled by RevenueCat on top of Apple's and Google's billing. RevenueCat receives the store receipt, your account id and the subscription events that follow (a purchase, a renewal, a cancellation, a refund). Our server receives those events and writes the resulting status to your account. We never see your card details, which stay with Apple or Google.

RevenueCat also receives the device's vendor identifier and, only if you allowed it at the App Tracking Transparency prompt, its advertising identifier. It uses them for one thing: matching the purchase events it forwards to AppsFlyer (section 4.7) to the install they belong to.

4.6 Mixpanel receives usage events

To understand how the app is used and where people get stuck, Upsy sends product analytics events keyed to your account id: which screens were opened and in what order, navigation between them, and the steps of the first-run setup. Every event carries the platform, the app version and the build number.

The vocabulary of events the app is capable of sending is fixed in the source code, and anything outside it will not compile. What Mixpanel never receives: anything the camera saw, anything you typed, your email address, and any measurement of your body.

Like any server, Mixpanel sees the IP address a request comes from. It uses it to estimate a country and city for the event, and does not keep the address itself.

4.7 AppsFlyer receives the install and two events

This is advertising attribution: working out which advert produced which install, so that money spent on adverts can be pointed at something. AppsFlyer receives the install itself, the device and advertising identifiers it needs for that (on iOS, the advertising identifier only if you allowed it at the App Tracking Transparency prompt), your account id, and two of the app's own events: finishing setup, and starting a subscription, recorded only as a free trial or a paid one.

Not screens, not taps, not the setup funnel, and nothing about your training. The purchase itself, with its amount, renewals and refunds, reaches AppsFlyer from RevenueCat's servers, which hold the receipts, rather than from your phone. On iOS, Apple's own attribution system (SKAdNetwork and AdAttributionKit) also sends AppsFlyer a copy of the postback it sends to the advertising network; that postback names the campaign and a small number describing what happened after install, and by Apple's design it identifies neither you nor your device.

4.8 The app asks Firebase Remote Config for its settings

At launch, and when you come back to the app, it fetches a few values we set centrally: the oldest version of the app that is still supported, what the free plan includes, and which accounts may open an internal screen we use to film adverts. The answer is the same for everybody. The request carries a Firebase installation identifier, a random id for this install of the app that Firebase uses to deliver the values, and nothing about you or your training.

5. Who processes it for us

We do not sell personal data, and we do not share it with anyone outside this list. There is no crash reporting service and no Firebase Analytics in the app, both left out deliberately.

6. Why we are allowed to

Under the GDPR, our legal bases are:

• Performance of a contract (Article 6(1)(b)) for the account, the backup of your training log, settings and set photos, the friends features you choose to set up, and the subscription. Without these the app cannot do what you installed it to do.
• Consent (Article 6(1)(a)) for advertising identifiers and attribution on iOS, which is what the App Tracking Transparency prompt asks for, and for push notifications, which the system permission dialog asks for. You can withdraw either at any time in your device settings.
• Legitimate interests (Article 6(1)(f)) for product analytics, our interest being to understand and improve an app we are responsible for. The events are limited to app usage keyed to an opaque identifier, which is why we consider this proportionate. You can object, see Your rights.
• Legal obligation (Article 6(1)(c)) for the transaction records we are required to keep for tax and accounting purposes.

7. Advertising, and the App Tracking Transparency prompt

On iOS you will be asked, during setup, for permission to track. That prompt is about advertising measurement only. Saying no is a normal answer and is the answer we assume: the app works identically either way, none of the training features change, and attribution falls back to Apple's own SKAdNetwork, which does not identify you.

You can change your mind at any time in iOS Settings, under Privacy and Security, Tracking. On Android the equivalent control is the advertising ID setting in your Google settings.

Upsy does not show adverts inside the app, and it never has.

8. Notifications

The reminders are scheduled by your phone, for your phone. No server is involved in them and nothing about them is registered with us. If you switch reminders off, or deny the permission, nothing about that leaves the device.

Nudges from friends are the one exception, because they come from somebody else's phone. They are push notifications, and section 4.4 says exactly what they involve. If you have no friends in the app, no push token exists for your phone.

9. How long it is kept, and how to delete it

• On your phone: until you delete it in the app or uninstall the app. Set photos can be deleted individually or all together in Settings, which deletes them from your account as well.
• In your account: for as long as the account exists. Delete Account is in the app's profile screen. It marks the account for closure and signs you out immediately. The data is erased by a scheduled job 30 days later: the training log, settings, set photos, friends card, friendships, nudges, invite codes and push tokens, and the sign-in itself. Your friends stop seeing you at that point. Sign back in inside those 30 days and the closure is cancelled, because deleting an account is one tap from a screen people open to change their theme, and it is otherwise irreversible. Without the app, see Delete your account.
• Analytics and attribution: retained according to those providers' own retention periods. We do not extend them, and a deletion request from you is passed on.
• Purchase and tax records: kept for as long as Romanian law requires, independently of the account.

10. Your rights

If you are in the EU or the UK, you have the right to access your data, to have it corrected, to have it erased, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where consent is what we relied on. Withdrawing consent does not affect processing that already happened.

Most of these you can exercise yourself in the app: your training log and photos are on your phone in front of you, and Delete Account erases the account copy. For anything else, write to support@tomeapps.com and we will answer within one month.

If you think we have handled your data badly, you can complain to your local supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

If you are in California, you have the right to know what is collected, to delete it and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we do not discriminate against anyone who exercises these rights.

11. Where the data goes

We are based in Romania. The services listed in section 5 are operated by companies in the United States, so personal data is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses, and where applicable on the EU-US Data Privacy Framework, together with the safeguards each provider commits to in its own data processing agreement.

12. Children

Upsy is not directed at children. It is not intended for anyone under 16, and we do not knowingly collect data from anyone under that age. If you believe a child has given us data, write to support@tomeapps.com and we will delete it.

13. Security

Data in transit is encrypted with TLS. Data at rest in Firebase is encrypted by Google. Access to your account in the database is enforced by server-side rules rather than by the app being polite about it: an account can read and write only its own data, the one exception being the friends card, which the people on its owner's friends list can read. The subscription and the friends list cannot be written by any client at all, and a nudge can only be created by our server. No system is perfect, and we do not claim ours is.

14. Changes to this policy

If this policy changes we will update the date at the top. If the change is material, meaning it affects what leaves your phone or who receives it, we will tell you in the app before it takes effect.

15. Contact

TC ADVANCED ANALITIQ SRL, Romania.
support@tomeapps.com