Privacy Policy

What you write

The app keeps what you put into it: the sentence you write at the start, your goals and the steps under them, the dates you set, what you marked as done and when, and your journal entries with anything you attached to them.

It is stored under your account in Google Firebase (Firestore). Nobody at uLuup reads it, except where you send it to us yourself in a support request or a bug report. It is never sold, and it is never shared for advertising.

Your account

• Your email address, and a name if you give one.
• If you sign in with Google or Apple, they pass us an account identifier and the email address you chose to share with the app.
• If you sign in with an email and a password, the password is handled by Firebase Authentication. We never see it.
• You can start without an account. That opens a guest session, which has no email address and holds nothing until you sign in.

Photos

A photo you add to a goal or a journal entry is uploaded to Firebase Storage, into a folder that only your account can read or write.

What the app keeps is a download link. The link is long and unguessable, and it stops working the moment the photo is deleted. Deleting your account deletes the folder itself, not only the links pointing into it.

The plan, and the AI

When you ask uLuup for a plan, or for suggested steps, our server sends a request to Anthropic's Claude API. What travels with it is the sentence or the goal title in your own words, the steps already in that goal, how many weeks are left, and your app language.

When a season ends, the server asks the same API for a few sentences about it. What travels with that request is the titles of the goals in that season, the steps you did and how many times, the percent each finished goal ended at, the number of days you came, the cracks and the gold, the weekdays you came back on, and your app language. The story that comes back is kept with that season in your account.

What never travels with either request: your journal, your photos, your name, your email address, and your account identifier. The requests carry no way of telling Anthropic who wrote them.

Anthropic states: "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API...) to train our models." Their policy is at privacy.claude.com.

Notifications

uLuup sends two kinds of notification, each with its own switch in Profile: a morning reminder at 9:00 your time, with a step planned for that day or a short line about one of your goals, and a crack alert when a crack has opened on your bowl.

Both are sent by our server. To choose the words of the morning reminder, the server reads your goals and steps in your account; nothing leaves our systems for that except the notification itself, which goes through Expo's push service and Apple or Google to your phone.

If either switch is on, the app registers a push token for that phone with Expo's push service and stores it under your account. With both off, the token is deleted, and that phone cannot be reached again until you turn one back on.

App insights

If app insights are on, the app sends product analytics to PostHog: which screens were opened, and events such as a plan being generated, a step being completed, a crack being filled with gold.

What goes with an event is a count or a choice, never what you wrote. The length of a sentence, not the sentence. Your Firebase user id is the only identifier attached. Autocapture and session replay are switched off.

The App insights switch under Data and Privacy turns it off. Off means nothing further is sent from that phone.

Crash reports

When the app crashes or hits an error it could not handle, it sends a report to Sentry: what went wrong in the code, the app version, the phone model and system version. Your Firebase user id is attached so a report can be matched to a message you send us. No IP address, screenshots or anything you wrote goes with it.

Crash reports follow the App insights switch: with it off, none are sent.

Email

Your address is added to our mailing list only if you asked for it. The list is held at MailerLite, in the European Union, and every message carries an unsubscribe link.

Email that is part of the service itself, such as a password reset or a verification message, is sent by Firebase and does not depend on that choice.

Premium and payments

Premium is bought through the App Store or Google Play. The payment itself, your card and your billing address stay with Apple or Google. We never see them.

To know whether an account has Premium, the app uses RevenueCat. It links the purchase to your Firebase user id, and receives from the store what was bought, when, at what price and in which currency, and when it renews or ends. RevenueCat tells our server when that changes, and your account then records whether Premium is active and until when. Nothing you wrote in the app goes to RevenueCat.

The website

uluup.com counts visits with Google Analytics, and only if you accept it in the banner at the bottom of the page. Until then nothing from Google is loaded and no cookie is set. Declining is remembered in your browser, and Cookie settings at the bottom of every page changes the choice.

If you accept, Google sets cookies and receives which pages you opened, where you came from, your device and browser, and an approximate location. IP addresses are anonymized. The website never receives anything from the app, and the app shares nothing with Google Analytics.

Where your data is

uLuup runs mainly on services in the United States, and some in the European Union. If you use uLuup from outside the United States, your data is transferred there.

How long it is kept

• What you write stays until you delete it, or until you delete your account.
• Deleting your account erases your goals, steps, journal entries, photos, devices and settings, and then the sign-in account itself. It happens while you wait, from your own phone.
• The database is backed up once a week, on Sunday, and each backup is kept for 98 days. So a deleted account can still exist inside a backup for up to 98 days. Backups are restored only after a failure, never to bring one account back.
• Events already sent to PostHog stay there under your user id. Write to us and we will delete them.
• Deleting your account does not cancel a Premium subscription, which belongs to your App Store or Google Play account: cancel it there. The purchase record stays with Apple or Google, and with RevenueCat under your user id. Write to us and we will delete it from RevenueCat.

What you can ask for

Download my data, under Data and Privacy in the app, gives you a copy of everything stored in your account as one file, straight away. You can also write to admin@uluup.com to ask for a copy, to ask for something to be corrected, or to ask for all of it to be deleted. Deleting your account in the app does the same thing immediately.

If you are in the European Economic Area or the United Kingdom, the GDPR applies. We rely on the contract between us to run the app itself, on your consent for app insights, marketing email and notifications, each of which you can withdraw in the app at any time, and on our legitimate interest in keeping the service working and secure. If you are in Türkiye, KVKK applies in the same way. You can also complain to your data protection authority.

Children

uLuup is not for children under 13, or under 16 where local law sets that age. We do not knowingly keep data from them. If you believe a child has an account, write to us and we will delete it.

Changes to this policy

The date at the top says when this text last changed. If something changes that matters to you, such as a new place your data goes, the app will say so rather than waiting for you to find it here.