Privacy Policy

1. Who we are

Pumpa ("Pumpa", "we", "us") is an iOS application that provides structured strength-training programs and workout tracking. This policy explains what we do with your personal data when you use the app or this website.

For the purposes of the EU General Data Protection Regulation (GDPR), the data controller is:

Pumpa
Gísli Guðmundsson Bergs
gisli.g.bergs@gmail.com

2. What data we collect

We do not collect your precise location, your contacts, or your payment card details. Payments are handled entirely by Apple — we never see your card number. The app contains no advertising SDKs and it does not read from or write to Apple Health. Photos and videos you take with the PR Cam or attach to a share card are never uploaded to us — see section 7.

3. What stays on your device

Some of what the app records never leaves your iPhone. It is stored in the app's local storage, is not sent to our servers, and is removed when you delete the app:

• the individual sets you log — exercise, reps and weight — and the records, history and muscle-recovery figures the app derives from them;
• workouts you save, exercise swaps and rest-timer overrides, your weight unit, your language choice and whether you have seen the app tour;
• PR Cam recordings and pump pics, until you share or save them (see section 7).

Because this data is only on your phone, it is not included in a copy of your data we can provide, and it is not restored if you reinstall the app or move to a new device.

4. Why we use it, and our legal basis

• To match you to a training program and adjust it from your onboarding answers. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); for the health-related answers, your explicit consent (Art. 9(2)(a)).
• To create and run your account, keep you signed in, and sync your program and workout log across sessions. Legal basis: performance of our contract with you (Art. 6(1)(b)).
• To track your workouts, streaks and milestones so you can see your history and progress. Legal basis: performance of our contract with you (Art. 6(1)(b)).
• To run the leaderboard, which shows your display name, workout count and streak to other members. Legal basis: our legitimate interest in providing the app's community features (Art. 6(1)(f)) — see section 6.
• To verify your subscription, unlock paid features and understand how the subscription performs (trials started, conversions, renewals, cancellations). Legal basis: performance of our contract with you (Art. 6(1)(b)) and our legitimate interest in running a viable service (Art. 6(1)(f)).
• To fix bugs, prevent abuse, and keep the app working. Legal basis: our legitimate interests in running a secure and reliable service (Art. 6(1)(f)).
• To respond to your support requests. Legal basis: our legitimate interests, or performance of our contract with you.

We do not use your data for advertising, we do not sell it, and we do not make automated decisions about you that produce legal effects. The program match is made from your answers by a fixed scoring rule, and you can switch programs at any time.

5. Health-related data and explicit consent

Some of what you can tell us during onboarding — injuries, health conditions, food allergies and intolerances, sleep — is health-related and may be a special category of personal data under GDPR Article 9. We process it only on the basis of the explicit consent you give when you answer those questions and create your account, and only to shape your program. Every one of those questions can be skipped.

You can withdraw that consent at any time by deleting your account (see section 12). Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

6. The leaderboard — what other members see

Pumpa has a leaderboard that ranks members by workouts logged and current streak. If you use the app with an account, other members can see:

• your display name — taken from your Apple or Google account name;
• your total workouts logged;
• your current streak.

Nothing else is visible to other users — not your email address, your fitness profile, your health-related answers, or the contents of your workouts. The avatars shown on the leaderboard are stock images bundled with the app, not photos of you. If you prefer a different display name than the one from your Apple or Google account, contact us and we will change it.

7. Camera, microphone, photos and Instagram

The PR Cam uses your camera and microphone to record a lift, and the share cards let you add a pump pic from your camera or photo library. iOS asks for each permission the first time it is needed, and the app works without them — you just can't use those two features.

• Recordings and photos are processed entirely on your iPhone. The overlay is drawn on your device, and nothing is uploaded to our servers.
• A clip or image leaves your phone only when you choose to share it or save it: "Save to Photos" writes it to your photo library; "Share to Instagram" hands it to the Instagram app on your device, after which Instagram's own privacy policy applies; the system share sheet passes it to whichever app you pick.
• We do not access your photo library beyond the single photo you pick.

8. Who we share data with

We share data only with the service providers we need to run the app. Each acts as our processor under contract:

We may also disclose data if we are legally required to do so, or where necessary to establish, exercise or defend legal claims. We do not sell your personal data, and we do not share it with advertisers or data brokers.

9. International transfers

Our providers may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses, together with additional safeguards where required.

10. How long we keep data

• Account, profile, program and workout data — for as long as your account is active.
• After you delete your account — erased from our live systems within 30 days, and from encrypted backups within 90 days.
• Subscription analytics — kept by Superwall under its own retention schedule; we ask for deletion of your identifier when you delete your account.
• Support correspondence — up to 24 months.
• Records we must keep by law (e.g. transaction records) — for the period the law requires.

11. Your rights

If you are in the EEA or the UK, you have the right to:

• access the personal data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing;
• receive your data in a portable, machine-readable format;
• withdraw your consent at any time;
• lodge a complaint with your national data protection authority.

To exercise any of these, email gisli.g.bergs@gmail.com. We will respond within one month.

If you are in California, you have comparable rights under the CCPA/CPRA, including the right to know, delete, and correct — and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under the CCPA.

12. Deleting your account

You can delete your account and all associated data from inside the app — open Account from the Workout tab and choose Delete account. You can also email us and we will do it for you. Full instructions are on our account deletion page.

Deleting your Pumpa account does not cancel your App Store subscription. Manage that in iOS Settings → your name → Subscriptions.

13. Security

Data is encrypted in transit using TLS and encrypted at rest by our database provider. Access to production data is restricted, and row-level security policies mean your profile and workout records are only readable by your own authenticated account. No system is perfectly secure, but we take these safeguards seriously and will notify you and the relevant authority of a breach where the law requires it.

14. Children

Pumpa is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy. If the change is significant, we will notify you in the app or by email before it takes effect. The "last updated" date at the top always reflects the current version.

16. Contact us

Questions, requests, or complaints: gisli.g.bergs@gmail.com