Last updated: 18 July 2026
This policy explains what personal data Pumpt ("we," "us," "the App") collects, why, and what rights you have over it. Pumpt is operated by Akanksha Maurya, based in Paris, France. If you have any question about this policy or your data, contact privacy@pumpt.fit.
Account information: your email address and password (password is never visible to us — handled by our authentication provider, Supabase).
Profile information you give us during onboarding: name, age, height, weight, gender, workout routine, experience level, training goals, dietary preferences, location area (city/region level, not precise GPS).
Health-related information you choose to share (optional, never required to use the app): health conditions you select (e.g., diabetes, PCOS, recovering from injury), and menstrual cycle dates if you turn on cycle-aware training. This information is processed only when you voluntarily provide it and explicitly consent to its use for personalization — never for advertising, never sold, never shared outside the processors listed in Section 4. You can withdraw this consent and erase this data at any time in Settings.
Activity data you log: training sessions, personal records, fuel/nutrition entries (including barcode scans — see Section 4), body weight logged over time, journal entries (mood, energy, sleep, notes), streaks, and milestones.
Voice recordings, only when you use voice-logging — sent for transcription and not retained as audio after the text is returned to you (see Section 4).
Food photos, only when you use photo-logging — analyzed to estimate nutrition and not stored after that analysis completes (see Section 4). We do not keep a copy of your food photos anywhere in our systems.
Crash and diagnostic data: if the app crashes or hits an unexpected error, technical details (device/OS type, stack trace, the screen and network requests involved) are sent to our crash-reporting provider (see Section 4) to help us fix it. This is scrubbed before sending to strip anything shaped like a note, mood, cycle, period, health, journal, or symptom entry — crash reports are not a channel for your logged content to leave our systems.
We do not collect advertising identifiers, and Pumpt does not use any third-party analytics or advertising SDKs.
Technical data: our infrastructure providers (Section 4) automatically log standard technical information for any network request — such as IP address, device/OS type, and timestamps — for security and debugging. We don't use this for tracking or profiling; it exists in ordinary server logs.
Pumpt uses automated systems and AI models to generate training plans, recovery suggestions, fuel/nutrition recommendations, and journal commentary, based on the activity and information you provide. These recommendations are informational only and are not medical advice.
Pumpt is not a medical device and does not provide medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional regarding medical conditions, injuries, menstrual or reproductive health, or any other health concern, before relying on anything generated by the app.
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide core app functionality (logging, sync across devices, account management) | Necessary to perform our contract with you |
| Personalize training/nutrition based on health conditions or cycle data | Your explicit consent, given separately during onboarding |
| Improve and maintain the app, fix bugs | Our legitimate interest, balanced against your rights |
| Detect fraud, secure accounts | Legitimate interest / legal obligation |
You can withdraw consent for health/cycle personalization at any time in Settings, without affecting the rest of your account.
We use a small number of infrastructure providers ("processors") strictly to operate the app. We do not sell your data to anyone, and we do not share it with advertisers.
Because Groq, Vercel, and Sentry process data in the US, this involves a transfer of data outside the European Economic Area. We rely on those providers' standard contractual safeguards for this transfer. Voice audio and food photos are used only transiently for transcription/analysis and are not stored by us after that response is returned.
We may change infrastructure providers over time. Any material change affecting how your data is processed will be reflected in this policy, and we'll notify you in-app before it takes effect.
We keep your data for as long as your account is active. If you delete your account (Settings → Delete Account, available at any time), your profile, logs, and journal entries are deleted from our active systems immediately. Copies may persist briefly in infrastructure backups; these are scheduled for removal from backups according to our infrastructure providers' own retention policies, and are not accessible through ordinary use of the app by anyone, including us.
Under GDPR (and equivalent French law), you have the right to:
To exercise any of these rights, email privacy@pumpt.fit. We'll respond within 30 days.
All data in transit is encrypted (HTTPS/TLS). Your data is protected by row-level security rules that strictly limit access to your own account — no other user, and no Pumpt employee through ordinary use of the app, can read another user's data. We do not store payment information (Pumpt does not currently process payments).
Pumpt is not directed at, and should not be used by, anyone under 16 years old. We do not knowingly collect data from children under 16.
If we make material changes to this policy, we'll notify you in the app before they take effect. The "Last updated" date at the top of this page always reflects the current version.
Akanksha Maurya, operating as Pumpt — Paris, France
privacy@pumpt.fit