Privacy Policy

Effective date: October 13, 2026

Pumped Fitness is operated by Punk Labs LLC ("Punk Labs," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use the Pumped Fitness mobile application and related services (the "Service").

1. SCOPE AND CONTROLLER

Punk Labs LLC is responsible for the personal information described in this Policy. This Policy applies to the Pumped Fitness mobile app, the Punk Labs website pages that support Pumped Fitness, account services, cloud backup, and support communications. Our separate Consumer Health Data Privacy Policy at https://www.punklabs.dev/consumer-health supplements this Policy for consumer health data. Third-party websites and services have their own privacy practices.

2. INFORMATION WE COLLECT

If you choose a profile photo, Pumped Fitness requests access to your photo library only when you use the photo picker, processes the image you select, and uploads a resized copy to your private account area in Firebase Storage. Before upload, the app re-encodes the copy to remove source metadata such as embedded location information. Pumped Fitness does not upload the original image or the rest of your photo library.

These health-related inputs are self-reported fitness preferences. Body-profile and training-limitation personalization is optional and is collected only after you make a separate in-app choice. Hydration logs are collected only when you choose to enter them. Pumped Fitness is not a medical-record system and does not verify the accuracy of this information.

Mental feature information is self-directed personal content used to provide the features you request. Pumped Fitness is not a mental-health provider, therapy service, crisis service, or medical-record system. Do not enter clinical records, diagnoses, information about another person, or content you do not want stored with your account.

3. OPTIONAL HEALTH PERSONALIZATION AND CONSUMER HEALTH DATA

Body-profile and training-limitation personalization is optional. Before using those entries, Pumped Fitness presents a separate notice explaining that they will adjust your body map, starting hydration goal, and exercise recommendations. You can decline and continue with neutral defaults.

When you enable this personalization, we record the choice, notice version, and time. You can withdraw the choice in Settings. Withdrawal stops that personalization and clears the saved body profile and training limitations from the active app data. It does not automatically erase workout history or hydration logs, which are separate records you created; you can remove those by clearing app data or deleting your account.

When you choose to enter a hydration log, we process the amount and date at your direction to display hydration history and progress. Do not enter medical diagnoses, clinical records, or information about another person.

Connected Health is a separate optional feature. If you choose Connect in Settings and grant the operating-system permission, Pumped Fitness writes future completed workout name, type, and timing information to Apple Health or Health Connect. It does not read data from those services and does not add invented calorie, heart-rate, step, sleep, or body-measurement values. Disabling automatic export stops future exports. On Android, Disconnect also asks Health Connect to revoke Pumped Fitness permissions. On iOS, Apple Health permissions remain under your control in the Health app. Records already exported remain controlled by Apple Health or Health Connect and must be reviewed or deleted there unless Pumped Fitness successfully removes its Android Health Connect records at your request.

We do not sell consumer health data or use it for advertising. We disclose it only to the infrastructure providers and other recipients described in Section 6 when necessary to provide a feature you request, secure the Service, comply with law, or complete a direction or consent from you.

4. WHERE INFORMATION IS STORED

Pumped Fitness stores app data locally on your device. Sensitive local fields are protected with app-level encryption where the runtime supports it, in addition to device security controls.

Updated native iOS builds use AES-256-GCM through Apple's CryptoKit for protected local fields, with the device encryption key stored in Apple Keychain. Earlier installed versions may use a different implementation. This protects those local fields; it does not mean every app file, exported file, operating-system record, or cloud backup is encrypted with that device key. The web version does not provide the same device-keystore protection as the native app.

When you choose cloud backup, account-linked profile, workout, hydration, plan, routine, progress, and Mental feature information is transmitted to and stored in Google Firebase. Cloud backup is optional. Firebase Authentication necessarily stores account information required for sign-in, and Firebase Storage stores the optional profile photo you choose until you replace it, remove it, or delete your account. Connected-health permission state and export de-duplication records are kept locally and are not part of Pumped Fitness cloud backup.

Cloud backup uses encrypted network transport and provider-managed storage protection, but is not end-to-end encrypted with a key available only on your device. Firebase processes backup records to provide the backup and restore service described in this Policy. Using Apple's local encryption does not move those records to iCloud or change the recipients or purposes described here.

Workout, habit, task, and Mental notifications are scheduled locally through your device. Their content and push-notification tokens are not stored by the billing-email backend. Trial-email processing is separate from optional workout cloud backup. Google Firebase and Google Cloud host the reminder service and account-to-purchase mapping. Resend processes the recipient address, message content, and delivery information to send billing reminders. Temporary copies of the recipient and message are also stored in our server delivery records to prevent duplicate sends.

If the operating system temporarily refuses to remove a workout notification while you dismiss or replace a rest timer, resume a workout, finish a workout, or leave an account, Pumped Fitness may retain a minimal device-cleanup marker for automatic retry. It can contain a format version, retry revision, notification-only or workout-cleanup scope, up to 32 random native notification identifiers, and—only for a cleanup targeted to one continuing workout—a random workout-session identifier. It contains no account identifier, notification message, profile, photo, exercise, set, workout-content, hydration, planning, Mental feature, or health information. The marker remains only on that device, is not uploaded, and is removed as soon as cleanup succeeds. A pending notification or Live Activity may remain visible until that retry succeeds or the operating system expires it. The marker is not used for advertising or analytics.

The Punk Labs website is hosted by Vercel. Website request logs and aggregate Web Analytics records are processed on Vercel systems under Vercel's applicable service terms and privacy obligations. A noncanonical legal-page copy may temporarily be hosted by GitHub Pages as described above.

5. HOW WE USE INFORMATION

We use subscription information to verify access, restore purchases, check renewal status, and provide transactional trial reminders where available. These messages are not promotional. Reminder messages are sent from reminders@notify.punklabs.dev, with replies directed to support@pumpedapp.net.

We do not use verification or security messages for advertising. We do not send marketing email unless you separately request or consent to it.

6. HOW WE DISCLOSE INFORMATION

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and Pumped Fitness does not contain third-party advertising.

We require service providers and other third parties that receive user data from us to provide the same or equivalent protection described in this Policy and required by applicable platform rules and law. They may process information only for the specified services and purposes, subject to applicable agreements and privacy obligations.

7. DATA RETENTION AND ACCOUNT DELETION

For trial reminders, our cleanup schedule removes account-to-purchase mappings, notification-deduplication records, and delivery records after the verified trial end plus 30 days. A verified trial extension changes that date. Registration rate-limit records are scheduled for removal after one day. Scheduled cleanup can be delayed by outages or processing backlogs. Recipient and message copies are removed from our delivery record after confirmed provider acceptance or suppression; failed or interrupted attempts may retain their temporary copies until cleanup. Provider acceptance does not prove inbox delivery.

Starting account deletion blocks new reminder work and triggers asynchronous cleanup of that account's reminder records. A message already accepted by the email provider cannot be recalled. Deleting Pumped data does not automatically delete email in your inbox, Apple's transaction records, or Resend's copies. Resend stores email and log data in the United States and publishes a 30-day retention period for Free, Pro, and Scale plans, with backups persisting for seven days. Earlier deletion of a particular message requires a provider request. These periods are separate from Pumped's cleanup schedule; deleting your Pumped account does not terminate Punk Labs' provider account. Contact support@pumpedapp.net for help with a privacy or deletion request.

We retain account and cloud-backup information while your account remains active and as needed to provide the Service. Local information remains on your device until you clear it, delete your account, uninstall the app, or the operating system removes it.

For the October 2026 pre-release iOS encryption transition, the affected testers agreed to reset obsolete local beta records. Updated builds remove known app records in that retired format when they start, including records belonging to accounts not currently signed in and matching local recovery copies. This can reset old workouts, onboarding answers, habits, goals, settings, and locally saved consent choices, together with setup-completion markers tied to the old records. The retirement step does not delete Firebase accounts, Apple purchases, existing cloud backups, or local records encrypted in current supported formats. Removed old local records cannot be recovered merely by reinstalling an earlier app version. This limited beta reset is not a general policy of deleting current user data on updates.

You can initiate account deletion in Settings. If you cannot access the app, visit https://www.punklabs.dev/delete-account to request deletion without creating a new account. We may need to verify that you control the account before acting on a web or email request. When deletion succeeds, Pumped Fitness deletes known account-linked profile documents, workout records, routines, exercise history, hydration records, Mental feature records and events, user-owned Firebase Storage files, and the Firebase Authentication account. The app also clears locally stored account, fitness, and Mental feature data and requests immediate cancellation of locally scheduled workout notifications and Live Activities.

If iOS temporarily refuses that device cleanup during automatic account deletion after Apple reports that a Sign in with Apple credential was revoked, deletion may complete only after the cleanup succeeds or Pumped Fitness has stored the minimal device-cleanup marker described above for automatic retry. Before destructive deletion starts, that marker is escalated to all-workout cleanup, drops any workout-session identifier, and may retain one or more random native notification identifiers needed for exact cancellation. It remains only on that device, is not uploaded, and is removed as soon as cleanup succeeds.

If you used Sign in with Apple and initiate deletion in Settings, the app asks you to confirm your Apple identity and requests revocation of the Apple authorization as part of the deletion flow. Deletion spans Apple and Firebase systems, so Pumped Fitness reports a failure and lets you retry if every step cannot be completed. You can independently review connected apps at any time in your Apple Account settings.

Before clearing an account or local workout history on Android, Pumped Fitness makes a best-effort request to delete that account's exported Health Connect workouts by their app-generated record identifiers. If Health Connect is unavailable or permission was already removed, exported records may remain and can be reviewed or deleted in Health Connect. Apple Health records remain controlled in Apple Health and must be reviewed or deleted there. Disabling export stops future exports. Android Disconnect also requests permission revocation; Apple Health permission can be managed in the Health app.

After a deletion request begins, we retain a minimal pseudonymous deletion-control marker at the former Firebase user identifier. It contains no request timestamp, profile, photo, workout, hydration, planning, or Mental feature content. We retain this marker for as long as necessary to keep the deletion irreversible and prevent deleted consent receipts or Firestore account records from being recreated by a stale client. This security-control record is not used for advertising or analytics.

Limited security and crash-diagnostic logs, support communications, records required by law, and residual copies in service-provider backup systems may remain for the period reasonably necessary for security, debugging, dispute resolution, legal compliance, or the provider's configured retention and documented deletion cycle. Such information is not retained for advertising.

Website hosting and aggregate analytics information remains subject to Vercel's configured retention and documented service practices. Vercel Web Analytics resets the pseudonymous visitor hash used for aggregate counting every 24 hours.

For deletion you initiate in Settings, if a network or provider failure prevents completion, the app reports the incomplete attempt. Some data may already have been deleted and account access may be limited. Retry in the app when available or contact support; retrying does not restore data already deleted. If Apple reports that a Sign in with Apple credential was revoked and automatic deletion cannot safely complete, Pumped Fitness records the failure for diagnosis and attempts to sign the revoked session out. Automatic deletion may then be incomplete, and account or cloud information may remain or may already have been removed depending on the stage that failed. You can use https://www.punklabs.dev/delete-account or contact support@pumpedapp.net for help completing or confirming deletion.

8. YOUR CHOICES AND RIGHTS

Depending on where you live, you may have additional privacy rights and the right to appeal a decision or complain to a data-protection authority. We may need to verify your identity before completing a request. Exercising a privacy right will not result in unlawful discrimination.

9. LEGAL BASES FOR EEA AND UK USERS

Where European or United Kingdom data-protection law applies, we process information as necessary to perform our contract with you, with your consent or explicit consent where required for optional health and permission-based features, for our legitimate interests in securing and improving the Service, and to meet legal obligations. Optional health personalization is not required to use unrelated features. You may withdraw consent at any time, but that does not affect processing already completed lawfully.

10. INTERNATIONAL PROCESSING

Punk Labs LLC is based in the United States. Firebase Authentication operates from United States data centers, while other providers may process information in the United States and other countries. Those countries may have different privacy laws. Where required, we use protections recognized by applicable law and require service providers to protect information under their applicable contractual obligations.

11. SECURITY AND INCIDENT RESPONSE

We use access controls, per-user Firebase Security Rules, App Check, encrypted network transport, device protections, and app-level local encryption where supported. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

We will investigate suspected incidents and notify affected users, regulators, or other parties when notification is required by applicable law.

12. CHILDREN AND ELIGIBILITY

Pumped Fitness is intended only for people who are at least 18 years old. We do not knowingly allow children under 18 to create accounts. If you believe a minor has created an account contrary to this Policy, contact us so we can investigate and delete the information where appropriate.

13. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in the Service, our practices, or law. We will update the effective date and provide additional notice in the app or by email when a change is material and notice is reasonably practicable. Where law requires consent to a change, we will request it.

14. CONTACT US

For privacy questions or requests:

Punk Labs LLC Email: support@pumpedapp.net Website: https://www.punklabs.dev/