Privacy Policy

This Privacy Policy explains what personal data BulkUp collects when you use the BulkUp app for iOS and Apple Watch and the website getbulkup.com (the "Service"), why we collect it, who we share it with and what rights you have. We have tried to keep it short and plain. If anything is unclear, write to privacy@getbulkup.com.

In short: we collect the data needed to run a workout and diet tracker, we do not show ads, we do not sell your data, we do not track you across other apps or websites, and you can delete everything from inside the app.

1. Who is responsible for your data

The data controller is BulkUp ([Legal entity name and address]), based in Spain. Contact: privacy@getbulkup.com.

2. What data we collect

2.1 Account and profile

• Email address and password (stored hashed), or the identifier and email provided by Sign in with Apple (which may be a private relay address).
• Name, and optionally date of birth and a profile photo. Profile photos are stored on our image host at images.getbulkup.com.
• Food allergies, likes and dislikes, if you choose to enter them.
• A friend code generated for your account, used to connect with other users.

2.2 Training, diet and body data (stored on BulkUp servers)

This data is stored on our servers at api.getbulkup.com so that it syncs between your iPhone and Apple Watch and is available if you change device:

• Training plans and diet plans, including plans you import from a PDF or photo or create yourself.
• Logged weights, reps and sets, and workout sessions (date, duration, volume).
• When you use the Apple Watch app during a workout: average and maximum heart rate and active energy, read from Apple Health (see section 5).
• Personal records (estimated one-rep max).
• Body measurements and the body composition values computed from them.
• Meal tracking (what you ate from your plan) and days you marked as skipped.
• Friendships, training streaks and plan codes you share with other users.

2.3 Files you upload for AI import

When you upload a PDF or a photo of a training or diet plan, or ask for an AI-generated recipe, the file or text you submit is processed to extract the plan or generate the recipe. The extracted plan or recipe is then stored in your account like any other plan. See section 4 for the AI providers involved.

2.4 Data that stays on your device (never uploaded)

• Workout photos and set videos you record in the app.
• Post-workout feedback notes and ratings.
• On-device caches used to make the app fast and work offline.

This data lives only on your iPhone or Apple Watch (and in your own device backups, if you use them). We cannot see it.

2.5 Technical data

• Standard server logs when the app talks to our API (IP address, request time, app version, device type), kept for security and debugging.
• Crash and diagnostic data that Apple shares with developers if you have opted in to it in iOS settings. This data is aggregated and does not identify you to us.

2.6 Website and waitlist

If you join the waitlist on getbulkup.com we store your email address to send you the launch notice and related updates. You can unsubscribe at any time from the link in each email. The website does not use advertising or cross-site tracking cookies.

3. Why we use your data and on what legal basis

Purpose	Data	Legal basis (GDPR)
Create and operate your account; sync your plans, logs and progress between devices; show you your history and records	Account, training, diet and body data	Performance of a contract (art. 6(1)(b))
Read heart rate and active energy during a workout and save them with the session	Apple Health data	Your explicit consent, given through the Apple Health permission prompt (art. 6(1)(a) and 9(2)(a)). You can withdraw it at any time in the Health app.
Store an optional profile photo and date of birth	Profile photo, date of birth	Consent (art. 6(1)(a)). You can remove them at any time in your profile.
Turn an uploaded PDF or photo into a plan; generate recipes	Uploaded files and text	Performance of a contract (art. 6(1)(b)); you trigger the processing yourself
Friends, shared plans and streaks	Friend code, friendships, shared plan codes, streaks	Performance of a contract (art. 6(1)(b))
Keep the Service secure, prevent abuse, fix bugs	Technical data, server logs	Legitimate interest (art. 6(1)(f)) in running a secure, reliable service
Send you service emails (account, security, important changes)	Email address	Performance of a contract / legitimate interest
Waitlist and launch updates	Email address	Consent (art. 6(1)(a)), withdrawable at any time
Comply with legal obligations (e.g. tax or responding to lawful requests)	Account and purchase records	Legal obligation (art. 6(1)(c))

Health-related data (heart rate, energy, body measurements, allergies) is sensitive data. We process it only to provide the features you use it for, and never for advertising, profiling for marketing, or sale.

4. Who we share your data with

We do not sell your personal data and we do not share it with advertisers. We share it only with the service providers below, who process it on our behalf and under our instructions (as processors), or where the law requires it.

• Apple. Sign in with Apple, App Store purchases and subscriptions, Apple Health (HealthKit) on your device, and iCloud/device backups you control. Apple handles all payment data; we never see your card details. Apple's privacy policy: apple.com/legal/privacy.
• AI providers (Anthropic and OpenAI). When you import a plan from a PDF or photo, or request an AI recipe, the content you submit is sent to Anthropic and/or OpenAI through their APIs to extract the plan or generate the recipe. We send only the content needed for that task. Under their API terms, these providers do not use API data to train their models. We recommend that you do not include unnecessary personal information (for example, other people's names) in files you upload.
• Image hosting. Profile photos are stored at images.getbulkup.com on a cloud storage and delivery provider.
• Cloud hosting. Our API and database run on cloud infrastructure located in the EU and/or the US, as applicable.
• Vercel. Hosts the website getbulkup.com and the waitlist form.
• Email delivery. A transactional email provider sends waitlist and account emails on our behalf.
• Other users. If you add a friend or share a plan code, the friend you connect with can see your name, profile photo, training streak and the plans you share with them. You choose who to connect with.
• Authorities. If required by law, a court order, or to protect the rights, safety or property of BulkUp or others.

5. Apple Health (HealthKit)

If you allow it, the BulkUp Apple Watch app reads your heart rate and active energy from Apple Health while a workout is in progress, and writes the completed workout to Apple Health. The average and maximum heart rate and the active energy of each session are saved with that session in your BulkUp account so you can see them on your iPhone.

We use Apple Health data only to provide the workout features of the app. We never use Health data for advertising or marketing, never sell it, never share it with data brokers or third parties for their own purposes, and never use it for any purpose other than the one you granted access for. You can revoke BulkUp's access at any time in the Health app (Sharing → Apps → BulkUp).

6. How long we keep your data

• While your account exists. Your account and all the data in section 2.2 are kept for as long as you have an account, so that your history is available to you.
• When you delete your account (Profile → Delete account in the app), all data linked to your account is deleted from our live systems immediately. Copies in encrypted backups are purged within 30 days.
• Uploaded files. The PDFs or photos you upload for AI import are kept only as long as needed to extract the plan, then deleted; the extracted plan remains in your account.
• Server logs are kept for up to 90 days.
• Waitlist emails are kept until you unsubscribe or until the launch campaign ends.
• We may keep limited records longer where the law requires it (for example, purchase records for tax purposes) or to defend legal claims.

7. Your rights

Under the GDPR and Spanish data protection law (LOPDGDD) you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data (most of it you can edit directly in the app).
• Erase your data (use Profile → Delete account, or write to us).
• Portability: receive the data you provided in a structured, machine-readable format.
• Restrict or object to processing based on legitimate interest.
• Withdraw consent at any time where processing is based on consent (Apple Health permission, profile photo, waitlist), without affecting the lawfulness of processing before withdrawal.
• Complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. You can also complain to the authority of the EU country where you live.

To exercise any of these rights, email privacy@getbulkup.com from the address linked to your account. We will answer within one month. We may ask you to verify your identity first.

8. Security

All traffic between the app and our servers is encrypted with TLS. Passwords are stored using a one-way hash. Access to production systems is limited to the people who need it to operate the Service. No system is completely secure, so if we become aware of a breach that affects your data we will inform you and the relevant authority as required by law.

9. Children

The Service is not intended for people under 16 and we do not knowingly collect data from them. If you believe a child under 16 has created an account, contact us at privacy@getbulkup.com and we will delete it.

10. International transfers

Some of our providers (for example the AI providers, Vercel, and parts of our cloud infrastructure) are located in or may process data in the United States. Where personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework, together with additional safeguards where appropriate. You can ask us for more information about these safeguards.

11. Changes to this policy

We may update this policy as the Service evolves or the law changes. If the change is material, we will notify you in the app or by email before it takes effect. The effective date at the top tells you when the current version came into force.

12. Contact

Privacy questions and requests: privacy@getbulkup.com.
General support: support@getbulkup.com.

Read this policy in Spanish: Política de privacidad. See also our Terms of Use.