Privacy Policy
Effective July 8, 2026
ShapeUp ("we", "us") is a social fitness app for iPhone. This policy explains what information the app handles, what stays on your device, what is stored on our servers, and what other users can see. The short version: your camera feed never leaves your phone, your weight is never shown to anyone, and the activity numbers you log are shared only with the people you choose to compete with.
1. Information we collect
- Account. You sign in with Sign in with Apple. We receive a unique account identifier and, if you choose to share it, your name and email address (Apple lets you use a private relay address instead of your real one).
- Profile. The username, display name, fitness goal, height, weight, daily step goal, and optional profile photo you enter in the app.
- Activity. Your daily verified rep counts (push-ups, crunches, squats, jumping jacks) and daily step totals.
- Social. Your buddy connections, the groups you join or create, group names and photos you set, and the achievements you unlock.
- Purchases. Your subscription status. Payment itself is handled by Apple; we never see your payment details.
2. The camera
Rep verification runs entirely on your device using Apple's Vision framework. ShapeUp does not record, store, or transmit video or photos from your workout sessions — the only thing saved is the number of completed reps. Nobody, including us, can watch your workouts.
3. Apple Health (HealthKit)
With your permission, ShapeUp reads your daily step count from Apple Health to track your step goal, streaks, and leaderboards. Health data is used only to provide these app features. We do not use HealthKit data for advertising or marketing, and we never sell it or share it with third parties for their own purposes. You can revoke access at any time in the Health app or iOS Settings.
4. What other users can see
- Anyone signed in can find your username, display name, profile photo, achievements, and current streak (that's how buddies find each other), and top daily totals appear on the global leaderboard.
- Accepted buddies and group members can additionally see your daily rep counts and step totals.
- Nobody can see your weight, height, email, or fitness goal. Weight is additionally protected server-side so it is only ever readable by your own account.
5. Service providers
We use a small number of processors to run ShapeUp:
- Supabase — hosts our database and authentication. Your account and activity data are stored there, protected by row-level access rules.
- RevenueCat — manages subscription status. Receives your account identifier and purchase state, not your personal details.
- Apple — Sign in with Apple, HealthKit, and App Store payments.
We do not run third-party ads, and we do not sell your personal information.
6. Data retention and deletion
We keep your data while your account is active. To delete your account and all associated data, contact us at mitchharaburda@gmail.com and we will remove it within 30 days. Deleting the app from your phone does not by itself delete your server-side data.
7. Security
Data in transit is encrypted with TLS. Server-side, row-level security policies restrict every record to the accounts allowed to see it — for example, your activity rows are only readable by you, your accepted buddies, and your group members.
8. Children
ShapeUp is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.
9. Changes
If we change this policy, we will update this page and the effective date above. Material changes will be called out in the app.
10. Contact
Questions about privacy? Email mitchharaburda@gmail.com.