Privacy Policy

What we collect and why

• Account infoYour email address and, if you use email/password sign-in, your hashed password (never stored in plain text). If you use Google Sign-In, basic Google account info is stored. Your email is stored to verify you have already accepted the Terms of Service so you are not prompted again on future logins.
• ProfileYour chosen username and profile picture, so you have an identity on the leaderboard and in the app. Your username, level, XP, profile picture, and Pro status are visible to all app users on the leaderboard and in public profile cards. The leaderboard is accessible to every authenticated user.
• Social and friendsFriend relationships, pending friend requests, and blocked users are stored so you can manage your friends list and control who can interact with you. Your username, level, XP, and profile picture are visible to any user who views your public profile card. Social features and their associated interactions may expand over time.
• Activity feedActions you take in the app are recorded and shown in the activity feed. This includes, but is not limited to, workouts, food logs, water logs, weight entries, habit completions, badge unlocks, check-ins, challenge completions, daily reward claims, and level-ups. Who sees your real identity depends on your feed visibility setting (see below). Users who see your real identity see action-specific details such as food names or workout titles alongside your username and profile picture. Users who do not see your real identity see the same entries with an anonymized identity: a fake name and avatar color derived from a one-way hash of your account ID, and only the action type is shown (for example, "logged a meal" rather than the specific food name). The anonymized name cannot be used to recover your account ID or real identity through the app, and no extra data is stored to maintain it.
• Feed visibilityYou can set your feed visibility to Public (all users see your real identity), Friends only (only friends see your real identity; others see you anonymized), or None (all users see you anonymized). This setting is enforced server-side and can be changed at any time in Settings.
• Food logsFood names, macros, calories, serving sizes, and the dates and times you logged them, so the app can track your nutrition and fuel the gamification system.
• Water logsWater intake amounts and the dates you logged them, so the app can track your daily hydration progress against your goal.
• Weight logsBody weight entries and the dates you logged them, so the app can display trends and track progress toward your weight goal.
• Workout logsWorkout sessions including exercises, sets, reps, weights, duration, and the date logged, so the app can track your training history, calculate personal records, award XP, and display your workout streak.
• Workout routinesRoutines you create, including their name, exercises, and default sets. Routines may be selected by the developer to appear in the community library, where they become visible to all users and cannot be removed. See the Terms of Service for details.
• GoalsYour calorie, macro, water, weight, workout, and other goal preferences, so the app can show progress toward your personal targets.
• Calorie Calculator inputsAge, height, weight, sex, and activity level, used only for the in-app calculation and never stored on our servers.
• Game progressYour XP, level, streaks (including but not limited to daily login, food logging, workout, and habit streaks), achievement progress, habit completion history, and referral history, to power the levelling system, leaderboard, and badges. Additional progress metrics may be tracked as new features are added.
• Subscription statusWhether you are a Pro subscriber, your subscription expiry date, and your purchase token, so premium features can be unlocked and your subscription status can be kept up to date in real time via Google Play.
• LocationGPS coordinates while the Explore tab is open, to find nearby points of interest and confirm you are physically close enough to check in. Never accessed in the background. The coordinates of places you check in to (for example, a gym or park) are stored as part of your check-in history so the app can track visits and award XP, but your personal GPS position is not stored.
• Explore historyWhich points of interest you have visited, their categories, how many times you have visited each one, and when, to track achievements and award XP for check-ins.
• RemindersThe messages and scheduled times you set, so the app can deliver your notifications at the right time.
• Push notification tokensA device token (FCM) and a randomly generated device identifier per device, so reminders and reward notifications can reach your devices and stale tokens can be cleaned up automatically over time. The device identifier is not tied to any hardware or personally identifiable information and resets if you reinstall the app.
• App preferencesYour in-app settings and preferences (such as theme color, unit system, and display options) so your configuration is restored when you reopen the app. Your device's timezone offset is also stored to ensure reminders and streaks are calculated correctly for your local time. Additional preference fields may be stored as new settings are introduced.
• Usage dataPage views and in-app events via Firebase Analytics and Google Analytics (GA4), to understand how the app is used so it can be improved. On Android, the app also sends anonymized app launch and sign-up events to Meta (Facebook) via the Facebook App Events SDK for advertising attribution purposes.
• Advertising dataOn Android, the app shows ads served by Google AdMob and Unity Ads. These services may collect your device's advertising ID, IP address, and ad interaction data to serve and measure ads. You can opt out of personalized ads at any time in your device settings under Google > Ads.

Third parties

• Firebase / GoogleAuthentication, push notifications, and analytics.
• SupabaseDatabase storage for your account and app data.
• RenderHosts the backend server that processes your requests.
• UpstashRedis cache used to speed up food search results.
• FatSecret APIFood search queries are sent to FatSecret to return nutritional data. Attribution is displayed in the app as required by FatSecret's terms.
• OpenFoodFacts APIBarcode scans are sent to OpenFoodFacts to look up product information.
• Google AdMobServes ads on Android. AdMob may collect device identifiers and ad interaction data to serve and measure ads. See Google's Privacy Policy for details.
• Unity AdsServes ads on Android as a fallback when AdMob is unavailable. Unity may collect device identifiers and ad interaction data. See Unity's Privacy Policy for details.
• Google Play BillingHandles subscription purchases for Level Up! Pro. Payment details are processed entirely by Google and are never seen or stored by this app.
• Meta (Facebook)The Facebook App Events SDK is used on Android to send anonymized app launch and sign-up events to Meta for advertising attribution. Meta may collect your device's advertising ID and IP address. See Meta's Privacy Policy for details.

Your personal data is never sold to third parties, including for California residents under CCPA. This list will be updated as new services are added.

International data transfers

Our third-party services (including Supabase, Render, Upstash, Firebase, and FatSecret) may process your data on servers located in the United States or other countries outside the EEA. Each of these providers acts as a data processor on our behalf, and where required we have entered into or rely on their standard Data Processing Agreements (DPAs). Supabase and Firebase both offer DPAs that include Standard Contractual Clauses (SCCs) for EEA data transfers.

Cookies and local storage

The web version of Level Up! may use cookies or browser local storage to maintain your login session, remember your theme preference, and store app state between sessions. These are strictly functional. No advertising or tracking cookies are set directly by this app. Google Analytics may set its own cookies. See Google's Privacy Policy for details.

Data retention

Your data is kept for as long as your account is active. To request deletion, email n1ch0lasd4k1s@gmail.com your data will be deleted. Leaderboard data is removed from other users' views on deletion. If a workout routine you submitted was featured in the community library, it will remain available but will no longer be linked to your username. Google Analytics event data is retained for 2 months and user data for 14 months by default.

Data breaches

In the event of a data breach that affects your personal data, affected users will be notified and, where required by law, the breach will be reported to the relevant supervisory authority.

Legal basis for processing (GDPR)

If you are in the European Economic Area (EEA), we process your data under the following legal bases:

• Contract performanceAccount info, food logs, water logs, weight logs, workout logs, game progress, activity feed entries, subscription status, reminders, and push notification tokens, necessary to provide the app's core features.
• Legitimate interestUsage analytics via Firebase and Google Analytics, to understand how the app is used and improve it. This does not outweigh your privacy rights.
• ConsentLocation data, only accessed while the Explore tab is open and only after you grant permission. You can revoke this at any time in your device settings. Personalized advertising via AdMob and Unity Ads, you can opt out at any time in your device settings under Google > Ads.

Age requirement

Level Up! is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided us with their data, please contact us at n1ch0lasd4k1s@gmail.com and we will delete it promptly.

Your rights

• Edit your profileUpdate your username, profile picture, and goals at any time from the app.
• Delete entriesRemove individual food logs, water logs, weight logs, and reminders from within the app.
• Delete your accountEmail n1ch0lasd4k1s@gmail.com to request deletion. See the account deletion page for details.
• Access your dataYou can request a copy of the personal data we hold about you by emailing n1ch0lasd4k1s@gmail.com.
• Data portabilityYou can request your data in a structured, machine-readable format by emailing us.
• Object to processingYou can object to processing based on legitimate interest at any time. We will review and respond to your request.
• Withdraw consentWhere processing is based on consent (e.g. location), you can withdraw it at any time in your device settings without affecting the lawfulness of prior processing.

If you are in the EEA and believe we are handling your data unlawfully, you have the right to lodge a complaint with your local data protection authority.

Contact

Questions or deletion requests can be sent to n1ch0lasd4k1s@gmail.com.