Privacy Policy

Effective date: July 22, 2026

1. What TallUp is

TallUp is a fitness and habit app that combines guided stretching, posture work, nutrition and sleep tracking, and an adult-height prediction estimate. It is general fitness software — not a medical device and not medical advice.

2. Data stored on your device (local-first)

By default, everything you enter stays on your device in the app's local storage and never leaves it:

• Profile details: gender, age group, birthdate, current and target height
• Parents' heights and self-reported puberty stage (used only for the height prediction)
• Workout completions, streaks, and achievements
• Height check-ins, sleep logs, food and water logs
• Settings such as reminders, coach voice, and sleep target

You can erase all of it at any time with Settings → Reset profile & progress, or by uninstalling the app.

3. Optional account (email)

Creating an account is entirely optional — every feature works without one. If you choose to create an account (to back up and sync your progress across devices), we collect:

• Your email address (used for sign-in, confirmation, password recovery, and transactional emails such as a welcome message and purchase receipt)
• A copy of the progress data listed above, stored in our Supabase-hosted database (Postgres with row-level security) and tied to your account id so it can sync to your other devices

We do not collect your name, contacts, precise location, photos, or device advertising identifiers.

4. Health-adjacent data

Height, birthdate, parents' heights, puberty stage, sleep, and nutrition logs are health-adjacent. We treat them with extra care: they are used only to power features you see in the app (your plan, predictions, and charts), they are never used for advertising, and they are never shared with or sold to third parties. Without an account they never leave your device.

5. Purchases (RevenueCat and the app stores)

TallUp Premium subscriptions and lifetime purchases are processed by the Apple App Store or Google Play. We never see or store your payment card details. We use RevenueCat to manage subscription status; RevenueCat processes purchase and entitlement information tied to an anonymous app-user id (and your account id if you sign in) solely to unlock Premium features. No purchase data is used for advertising.

6. No ads, no tracking, no data sale

• No third-party advertising SDKs
• No analytics or behavioral tracking SDKs
• No "tracking" as defined by Apple's App Tracking Transparency — we do not link your data with third-party data for advertising, and we do not share it with data brokers
• We never sell your personal data

7. Children's privacy (COPPA) — 13+

TallUp is designed for users aged 13 and older. We do not knowingly collect personal information from children under 13. During onboarding, a birthdate indicating an age under 13 blocks profile creation entirely. If you believe a child under 13 has provided us personal information, contact us and we will delete it promptly.

8. Data retention and deletion

• Local data: deleted instantly via Settings → Reset profile & progress, or by uninstalling the app.
• Account data: delete your account any time in the app via Settings → your account → Delete account. This permanently erases your account, your email, and all cloud-stored progress. You can also request deletion by email — see How to delete your account.
• Purchase records: retained by the app stores and RevenueCat as required for receipts, refunds, and tax/legal obligations; deleting your TallUp account does not delete the store's own transaction records.

9. Service providers

We use a small number of processors to operate the optional features above:

• Supabase — account authentication and cloud progress storage
• Resend — transactional email delivery (confirmation, welcome, receipt)
• RevenueCat — subscription and entitlement management
• Apple / Google — payment processing and app distribution

Each processes only the data needed to provide its service, under its own privacy policy.

10. Security

All network traffic uses HTTPS/TLS. Cloud data is protected by row-level security so only you can read or write your own progress row. No system is perfectly secure, but we follow least-data principles: the less we collect, the less there is to protect.

11. International users

If you use the optional account features, your data may be processed in the region where our database is hosted. By creating an account you consent to that processing. Depending on your jurisdiction (e.g. GDPR/UK GDPR, CCPA), you may have rights to access, correct, export, or delete your personal data — the in-app tools above cover access and deletion, and you can contact us for anything else.

12. Changes to this policy

If we change this policy we will update the effective date above and, for material changes, announce them in the app. The current version is always available at this URL and from within the app.

13. Contact

Questions or privacy requests: privacy@tallup.app