Privacy Policy

BULKD ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use the BULKD mobile application ("App").

1. Information We Collect

1.1 Account Information

When you create an account (via Apple Sign-In, Google Sign-In, or email), we collect your name and email address solely to identify your account. We do not use this information for marketing without your explicit consent.

1.2 Workout & Training Data

All workout logs, routines, sets, reps, weights, and personal records you enter are stored locally on your device. If you are a Pro subscriber and have cloud backup enabled, this data is also stored securely in our cloud infrastructure (Google Firebase Firestore) linked to your account.

1.3 Usage Data

We use Firebase Analytics and Google Analytics to understand feature use and App performance. This may use pseudonymous app or device identifiers and limited technical and usage events.

1.4 Advertising Measurement

On Android, we may link Firebase Analytics to Google Ads to measure whether our marketing leads to app installs and key in-app actions, and to improve our user-acquisition campaigns. On iOS, we use Firebase Analytics for product analytics only; it is configured without the Apple advertising identifier and is not used for Google Ads conversion measurement or personalised advertising. We do not use workout, health-platform, AI coaching, or account-profile data for advertising.

You can disable future usage analytics, and Android's Firebase-based Google Ads conversion measurement, at any time in the App through Settings → Privacy → Usage analytics. Turning this setting off stops future Firebase Analytics collection on that device.

1.5 Payment Information

Pro subscriptions are processed through Apple App Store and Google Play Store in-app purchase systems. We do not receive or store your payment card details. Subscription status is managed via RevenueCat.

1.6 AI Coaching Data

When you use the AI Coaching feature (Pro only), we send anonymised workout statistics to our secure cloud functions, which forward them to OpenAI's API to generate training insights. We never send personally identifiable information (PII) such as your name or email to OpenAI. Your AI coaching summaries are stored securely linked to your account.

1.7 Health Platform Data (Apple Health & Health Connect)

On iOS, the App can connect to Apple HealthKit (via Apple Health). On Android, the App can connect to Google Health Connect. Both integrations are entirely optional and require your explicit permission before any data is accessed.

The App may read the following data from your health platform:

• Body measurements — body weight and body fat percentage, to pre-fill your AI coaching profile and personalise coaching insights
• Activity & energy — daily step count, active calories burned, and basal energy burned, used to provide context for AI coaching summaries

The App may write the following data to your health platform:

• Workout sessions — when you finish a workout, a record is written back to Apple Health / Health Connect so your training activity appears alongside your other health data

Health platform data is used solely to operate App features. It is never sold and never used for advertising. It is not shared with third parties except where a small subset of anonymised body and activity statistics (for example, current body weight or average daily steps) is included in the AI coaching prompt sent to OpenAI (see Section 1.6). No raw health records are ever sent to OpenAI.

You can revoke the App's access to your health data at any time through your device settings (iOS: Settings → Health → Data Access & Devices; Android: Health Connect → App permissions).

1.8 Legal Bases for Processing

Where UK GDPR or EU GDPR applies, we process the account, subscription, and cloud-backup data needed to provide the App under Article 6(1)(b) (performance of a contract). We rely on Article 6(1)(a) (consent) for optional AI coaching and optional health-platform data.

Where information used for AI coaching or received from a health platform is health data or otherwise special-category data, we rely on your explicit consent under Article 9(2)(a). This consent is separate from your use of the rest of the App and is not required to log workouts or use non-AI features.

We rely on our legitimate interests under Article 6(1)(f) to retain limited, pseudonymised account-deletion information for a short period to prevent repeated use of one-time promotional trials and protect the App from account-cycling abuse. Section 5 explains what we retain and for how long.

For product analytics, advertising measurement, and any use of advertising identifiers, we rely on consent where applicable law requires it. Otherwise, we rely on our legitimate interests to understand App performance, prevent fraud, and measure the effectiveness of our marketing, balanced against your rights and freedoms. We do not use special-category health data for advertising.

2. How We Use Your Information

We use collected information to:

• Provide and operate the App and its features
• Sync and back up your training data across devices (Pro only)
• Process subscription status and entitlements
• Generate AI coaching insights from your workout data
• Read health and body data (with your permission) to personalise AI coaching and pre-fill your profile
• Write completed workout sessions back to Apple Health or Health Connect
• Detect and fix bugs and improve performance
• Measure the effectiveness of advertising and improve user-acquisition campaigns
• Comply with legal obligations

We do not sell your personal data. We do not use your workout, health-platform, AI coaching, or account-profile data for advertising purposes. We use the limited pseudonymous analytics data described in Sections 1.3 and 1.4 for advertising measurement and campaign optimisation.

2.1 AI Consent and Withdrawal

Before generating an AI coaching summary, we ask you to opt in to the use of the de-identified workout, profile, and, where selected by you, health-platform data described in this policy. You may withdraw this consent at any time by unticking the AI data-sharing option in the AI section of the App. Withdrawing consent stops future AI summary requests and does not affect your ability to use the App's non-AI features.

3. Data Storage & Security

Local data is stored in an encrypted SQLite database on your device. Cloud data (Pro subscribers) is stored in Google Firebase Firestore, protected with Firebase Security Rules that restrict access to your authenticated account only. Data in transit is encrypted using TLS.

We apply industry-standard security practices but cannot guarantee absolute security. In the event of a data breach affecting your information, we will notify you as required by applicable law.

4. Third-Party Services

The App uses the following third-party services:

• Google Firebase and Google Analytics — Authentication, cloud database, cloud functions, and App analytics. See Google's Privacy Policy.
• Google Ads — Conversion measurement and user-acquisition campaign optimisation using the limited analytics events described in Sections 1.3 and 1.4. You can manage Google's ad-personalisation controls through Google My Ad Center.
• RevenueCat — Subscription management
• OpenAI — AI coaching summaries (anonymised data only)
• Apple App Store / Google Play — Payment processing
• Apple HealthKit (iOS) — Optional health and fitness data integration. Accessed only with your permission. See Apple's Privacy Policy.
• Google Health Connect (Android) — Optional health and fitness data integration. Accessed only with your permission. See Google's Privacy Policy.

Each service operates under its own privacy policy. We encourage you to review them.

These services may also collect technical data such as IP addresses and system logs for their own operational and maintenance purposes. This is governed by their respective privacy policies, not ours.

4a. International Data Transfers

BULKD uses Google Firebase for cloud storage and authentication. Google may process and store your data on servers located outside your country of residence, including in the United States. Where data is transferred outside the UK or European Economic Area, Google ensures adequate protections are in place under Standard Contractual Clauses approved by the relevant authorities. For more information, see Google Firebase's Privacy and Security documentation.

Local data remains on your device until you delete the App or manually remove it. Cloud data (Pro) is retained for the duration of your active subscription. If your subscription lapses, cloud data is retained for a grace period (currently 14 days) before being automatically deleted. You can request immediate deletion at any time (see Section 7).

5. Data Retention and Account Deletion

When you delete your BULKD account, we delete your account profile, cloud training data, social data, and Firebase Authentication account. To prevent a person repeatedly deleting and recreating an account to receive the same one-time complimentary Pro trial, we retain a limited fraud-prevention and promotion-eligibility record for up to 12 months after the most recent account deletion.

This limited record contains:

• A cryptographic hash of your Apple or Google provider identifier
• A cryptographic hash of your normalised sign-in email address
• Your former Firebase user identifier
• Whether your account previously received complimentary Pro access
• The account-deletion date and number of account deletions

We do not retain your plaintext email address in this record, and it does not contain your workout, health, AI coaching, or payment data. It is stored in a backend-only collection that is not accessible through the App. The record and its linked promotional-trial history are automatically deleted after 12 months. After deletion, they are no longer used to assess eligibility for a complimentary Pro trial.

6. Children's Privacy

The App is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

7. Your Rights & Data Deletion

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (right to erasure)
• Object to or restrict processing of your data
• Data portability
• Lodge a complaint with your local data protection authority

If you are located in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). If you are in the EU, you may contact your national data protection authority.

To delete your account and associated App data, subject to the limited 12-month fraud-prevention retention described in Section 5, go to Settings → Manage Account → Delete Account inside the App. You can also request deletion via our Data Deletion page.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page and, where appropriate, by in-app notification.

9. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at bulkd@objectcreate.uk.