Privacy Policy
Last updated: October 17, 2026
PullUpMaster ("PullUpMaster", "we", "us") is a pull-up training app. If you create an account, your training programs, streaks, and workout history are backed up to it and synced across devices, so PullUpMaster stores personal data on our backend, provided by Supabase. We also use RevenueCat to manage subscriptions and PostHog (EU-hosted) for product analytics. This policy explains what we collect, why, and how you can access or delete it.
Data controller
PullUpMaster is published by Mendi Tekstilwaren / Dilara Demir Caglar, Fauststrasse 44a, 81827 München, Germany. Contact: support@qrodesk.com.
Account (optional)
You can use PullUpMaster — including buying a subscription — without an account; your training data then stays on your device. If you create an account, your programs and workout log are saved to our backend and restored on any device you sign in on. You can create an account with:
- Email & password — handled by Supabase Auth.
- Google Sign-In — authenticated via your Google account.
- Sign in with Apple — including Apple's "Hide My Email" option.
When you use Google or Apple sign-in, we receive a unique identifier for your account and the email address associated with it (a private relay address if you choose to hide your email with Apple). We do not receive your Google or Apple account password.
What data we store
| Category | Examples |
|---|---|
| Account data | Email address, authentication provider ID, display name (if you set one), account creation date. |
| Training data | Current pull-up ability, goal, training place, equipment, training days per week, pain indicator, selected program, workout sessions, sets, reps, streaks, personal records, reminder settings. Stored on your device, and on our backend only if you have an account. The pain indicator and your rep numbers are never sent to analytics. |
| Optional profile data | Body weight or other stats you choose to enter to personalize a program. |
| Subscription status | Entitlement flag, product ID, and expiration date used to unlock Pro features. Payment card details are never seen by us — billing is handled entirely by Apple or Google. |
| Product usage (analytics) | Onboarding, workout, paywall, checkout, and share events, linked to your account ID once you sign in. You can turn this off in the app under Settings → Privacy. See Product analytics (PostHog). |
| Technical data | App version, device type, and OS version, used only for support and reliability — not for advertising. |
What PullUpMaster does not collect
- No camera or microphone access — reps are logged manually, not detected automatically.
- No precise location data.
- No access to your contacts or photos.
- Apple Health: if you train with the Apple Watch app and grant permission, the watch records the workout (including heart rate and active energy) in Apple Health. These health readings stay on your iPhone and Apple Watch — they are not sent to our backend or to any analytics provider.
- No advertising trackers or third-party ad SDKs.
- No public profile, social feed, or leaderboard — your training data is private to your account.
Where your data is stored
Your account and training data are stored in our Supabase project (PostgreSQL database and authentication service). Data is encrypted in transit (TLS) between the app and our backend. Supabase acts as our data processor and applies its own security and access controls; see Supabase's privacy policy for details on their infrastructure.
Other service providers
- Supabase — database, authentication, and data storage.
- RevenueCat — subscription validation, entitlement management, restore purchases, and subscription reporting. RevenueCat receives a random app user ID (or your account ID once you sign in) and your purchase and subscription status.
- PostHog (PostHog Cloud EU) — product analytics, described below.
- Apple — Sign in with Apple, and App Store subscription billing on iOS.
- Google — Google Sign-In, and Google Play subscription billing on Android.
We share only the data each provider needs to perform its function (for example, verifying your subscription status with the App Store or Google Play). We do not sell your personal data to anyone.
Product analytics (PostHog)
We use PostHog, hosted in the European Union
(eu.i.posthog.com), to understand how people move
through the app — for example how many people finish onboarding,
start and finish a workout, or open the subscription screen — so we
can fix drop-off points and improve the app. We do not use it for
advertising, and session recording (screen replay) is turned off.
What the app sends to PostHog:
- App lifecycle events — app installed, opened, and updated.
- Onboarding — which onboarding step was shown, and on completion your goal type and training days per week. Your starting reps and your answer to the pain question are not sent.
- Workouts — workout started/ended, session number, program week, whether it was a test day, how far you got, and whether the free session was completed.
- Subscription screen and checkout — which screen was shown and why, the estimated weeks to your goal and your level shown on it, the offer, price, and currency displayed, how checkout ended (purchased, restored, cancelled), and restore results. RevenueCat may also forward subscription events (such as trial start, renewal, or cancellation) to PostHog.
- Sharing — that an achievement card was opened in the share sheet (not the image itself).
- Identifiers and device information — a random identifier created on your device and, after you sign in, your PullUpMaster account ID (the same ID used with Supabase and RevenueCat), plus standard technical data the PostHog SDK attaches, such as app version, device model, operating system, and locale. PostHog also receives the IP address of each request.
Events recorded before you sign in are linked to your account once you sign in. When you sign out, the app resets the analytics identity on that device so later activity is not added to your account. We do not send your email address, name, pain answers, or Apple Health readings to PostHog, and PostHog data is not used to track you across other companies' apps or websites.
Your choice: analytics can be turned off at any time in the app under Settings → Privacy → Share anonymous usage analytics. While it is off, the app sends no events to PostHog; you can turn it back on the same way. To have analytics data already linked to your account ID deleted, email support@qrodesk.com.
Why we process your data
- To create and secure your account, and let you sign in across devices.
- To save and sync your programs, workout history, and progress.
- To unlock and manage your Pro subscription.
- To measure and improve onboarding, workouts, and the subscription flow (product analytics).
- To provide customer support when you contact us.
Data retention
We keep your account and training data for as long as your account is active. If you delete your account, we delete your personal data and workout history from our systems within 30 days, except where we must retain limited records to comply with legal or tax obligations. Analytics events in PostHog are kept for as long as they are useful for improving the app and are deleted on request.
Deleting your account and data
You can permanently delete your account at any time inside the app: open Settings → Account → Delete account and confirm. This deletes your PullUpMaster account and the training data synced to our backend, and clears the data stored on the device. You must be signed in to see this option. If you signed in with Apple, the app also asks Apple to revoke PullUpMaster's Sign in with Apple access as part of the deletion; if that step fails, the app tells you how to remove PullUpMaster under Sign in with Apple in your Apple Account settings. The account is deleted either way.
If you cannot use the app (for example, you no longer have it installed), email support@qrodesk.com from your registered email address and we will delete the account for you. The in-app deletion does not automatically erase the analytics events held by PostHog or the purchase records held by RevenueCat and Apple; email us if you want the PostHog and RevenueCat data linked to your account ID erased as well (purchase records may be retained where the law requires).
Deleting your account does not cancel an App Store subscription. Manage or cancel it in your Apple Account subscription settings. Deleting the app alone does not delete your account or cloud data.
Your rights
Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us at support@qrodesk.com to exercise any of these rights. You may also lodge a complaint with your local data-protection authority.
Withdrawing consent and objecting: where we rely on your permission, you can withdraw it at any time without affecting processing that already took place — turn off notifications or Apple Health access in iOS Settings, or sign out and delete your account in the app. To stop product analytics, turn off Settings → Privacy → Share anonymous usage analytics in the app (see Product analytics).
Children's privacy
PullUpMaster is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
Security
We rely on Supabase's authentication and database security, use encrypted connections between the app and our backend, and limit access to production data to what is necessary to operate the service. No method of transmission or storage is 100% secure, but we work to protect your information.
Changes to this policy
We may update this policy as PullUpMaster evolves. Material changes will be reflected by updating the "Last updated" date above.
Contact
For privacy questions or data requests, contact support@qrodesk.com.