Last updated: 23 September 2026
UPLFT is a strength training app. It builds you a session, watches how the session went, and uses that to build the next one. To do that it has to hold information about your body and your training. This policy explains exactly what it holds, why, who else sees it, and how to get rid of it.
UPLFT is operated by Jaden Joseph, operating as UPLFT, a sole proprietorship based in Victoria, British Columbia, Canada.
For any question about this policy or your data, email hello@uplftapp.com. We answer within 5 business days, and within 30 days for a formal request to see, correct or delete your data.
(If UPLFT is later incorporated, this name and the one in the Terms of Service are the two places that change.)
This policy covers the UPLFT iOS app and the backend services it talks to. It does not cover any other product or service, and it does not cover what another company does with something you choose to send them from inside the app.
UPLFT delivers unsupervised loaded strength training. You must be at least 18 and no older than 80 to create an account. The app enforces both ends of that range at sign-up from your date of birth. It is a hard block, not a warning, and there is no way past it. Above 80 we ask you to train with in-person guidance instead.
We do not knowingly collect information from anyone under 18. If we learn that we have, we delete the account and its data. If you believe a minor has an account, email us at hello@uplftapp.com.
This is information about you that you did not type in. The app generates it, and we are naming it because you would otherwise have no way to know it exists:
This is used to pick your next session. It is not used for anything else.
We do not run any product analytics. We do not track which screens you visit or how long you spend on them.
This is the section that matters most, so it is separate.
Exercises performed, sets, reps, load and difficulty ratings; session dates, duration and completion; body weight, height and weigh-ins; readiness inputs (sleep, energy, soreness, illness); injuries, pain flags and movement limitations; food logged with its calories and macronutrients; progress photos; and the engine-derived conclusions listed in §4.2.
This data drives the engine. It reads what you lifted, how it went, how long ago you did it, and how you are feeling today, then chooses your movements and your loads from that. Without this data the app cannot build you a programme. That is the entire product.
UPLFT does not read from or write to Apple Health. It holds no HealthKit data.
We name every company. "Trusted partners" is not a disclosure.
| Who | What they receive | What they do with it |
|---|---|---|
| Supabase | Your account and everything you log, plus your photos | Hosts our database, sign-in, and file storage. Data is stored in the United States. |
| Sentry | Crash and performance data, tagged with your account ID | Tells us when the app breaks. Configured not to attach personal details beyond that ID, but the ID makes the report identifiable, which is why we list it as linked to you. |
| RevenueCat | Your account ID, your purchase history, and your email address | Works out whether your subscription is active. |
| Apple | Your purchase transactions. Separately, audio you dictate | Billing; and converting your speech to text when you talk to the app. |
| Anthropic | A photo of your meal, or your description of it | Reads the food and estimates its calories and macros, then returns the result. |
| Open Food Facts | The barcode number, and your IP address because the request goes straight from your phone. Nothing about your account | Looks up a packaged food's nutrition. |
| Google (only if you connect it) | Your Google email address, the list of your calendars, and the sessions you book | Lets you choose which calendar to write to, and puts your booked sessions in it. We read the list of calendars; we do not read your events. |
| Resend | Your email address | Delivers your sign-in code. |
| Expo | Your IP address, device model, OS version and which version of the app you are running | Checks on launch whether an app update is available and delivers it. |
Most of these companies are in the United States, which means your information is stored and processed outside Canada. We rely on contractual protections with each provider. If you would rather your data did not leave Canada, UPLFT is not currently able to offer that.
We will also disclose information if we are legally required to, and if UPLFT is ever sold or merged your information would transfer with it, in which case we would tell you before it happened.
In Canada, PIPEDA requires your meaningful, informed consent. Because UPLFT collects health information, that consent has to be express: asked for specifically, not inferred from your carrying on using the app. So before UPLFT asks you a single question about your body, before the account exists and before anything is collected, it shows you a consent step that names in plain words what health information it will hold and why, links this policy, and asks you to agree to it separately from the terms, on its own checkbox. We record which version of this policy you agreed to, and when. You can withdraw that consent at any time by deleting your account, which removes the data it covered.
Quebec's Law 25 applies if you live in Quebec. It gives you the same rights described in §10, plus the right to be told before your information is used to make a decision about you based only on automated processing. UPLFT's engine chooses your exercises and loads automatically, which is the whole product, and §4.2 names every conclusion it draws. Nothing it decides affects your credit, employment, insurance, or access to any service. If you ask, we will tell you which of your information was used, the main reasons behind what the app decided, and how to correct anything that was wrong, and you can put your own observations to a person who will review it.
In the United States, most state privacy laws only bite above a size threshold UPLFT is nowhere near. Washington's My Health My Data Act is the exception: it has no threshold at all, and it covers exactly the kind of information UPLFT holds. It requires its own separate policy, so there is one: Consumer Health Data Privacy Policy. It must be linked separately from ours, not buried in this document. Nevada and Connecticut have similar health-data rules, and that policy is written to satisfy them too.
| What | How long | Why |
|---|---|---|
| Your account and profile | While your account is open | Needed to run the service |
| Training history | While your account is open | The engine reads your history to pick sessions |
| Progress photos | Until you delete them, or you delete your account | Yours to control |
| Everything, after you delete your account | Removed from live systems within 30 days | |
| Previous versions of your synced data | The 50 most recent versions | Every time your phone syncs, the previous version of your profile, plan, history and nutrition is archived so a bad sync cannot destroy your training history. Older versions are deleted nightly |
| Backups | Until our hosting provider's rotation overwrites them | We keep no backups of our own. Supabase takes automated ones and purges them on its own schedule, so deleted data can persist in a backup for a short period before it is overwritten |
| Crash and diagnostic data | 90 days | Debugging window |
| Payment records | As long as Canadian tax law requires | Legal obligation. Survives deletion |
You can delete your account from inside the app: Settings → Delete account. You do not need to email us.
What is deleted: your profile, your email address, your name, your training history, your readiness inputs, your injury flags, your food log, your weigh-ins, your progress photos, your avatar, the screenshots attached to any feedback you sent, and the engine's conclusions about you. Your account itself is removed, so you cannot sign back in, and the copy held on your phone is wiped.
What survives, and why:
We are saying this plainly rather than claiming a clean sweep we do not perform. If you want either of those removed as well, email hello@uplftapp.com and we will do it by hand.
Deleting your account does not cancel your subscription. Apple handles billing, and you have to cancel it in Settings → Apple Account → Subscriptions on your device. We cannot cancel it for you.
You can ask us for a copy of everything we hold about you, ask us to correct anything that is wrong, and ask us to stop using your data. Email hello@uplftapp.com and we will respond within 30 days, the standard under PIPEDA.
There is no export button in the app. Ask us and we will send you a copy.
If you live in Quebec, you also have the right to receive the information you gave us in a structured, commonly used technological format, and to have it sent to another organisation. Ask us and we will produce it.
If you live in Washington, Nevada or Connecticut, you have specific rights over health data on top of these. They are set out in the separate Consumer Health Data Privacy Policy.
Canadian privacy law requires a named individual to be accountable for the information an organisation holds, and for the policies that govern it. For UPLFT that person is Jaden Joseph, reachable at hello@uplftapp.com.
UPLFT has no employees and no contractors. Nobody else is accountable, and nobody else has access.
If your information is lost, stolen, or accessed by someone who should not have it, and there is a real risk of significant harm to you, we will:
If you are in the United States, the Federal Trade Commission's Health Breach Notification Rule also applies to us. We will tell you without unreasonable delay and within 60 days, notify the FTC, and notify media where that rule requires it.
We will not wait for certainty before telling you. If we know enough to be worried, that is enough to tell you.
No system is perfectly secure, and we cannot guarantee absolute security. What we can say is what we actually do, which is the list above.
Each is asked for when you first use the feature that needs it, not on launch, and the app works without any of them:
When you share a session image, it is created on your device and handed to iOS's own share sheet. It goes wherever you send it, and from that point it is handled by that app under that company's policy. We never receive a copy and we do not track what you share.
The date at the top is always accurate. If we make a change that materially affects how we handle your data, we will tell you inside the app before it takes effect, not by quietly editing this page.
If you are not satisfied with how we have handled your information, you can complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376.
If you live in Quebec, you may complain to the Commission d'accès à l'information du Québec. If you live in Washington State, the My Health My Data Act lets you bring a claim directly under the Consumer Protection Act, and you may complain to the Washington State Attorney General.
We would rather hear from you first, and we will not make you go through a complaint to get your data deleted. That button is in the app.