Privacy Policy

1. Introduction

Welcome to LeagueUp! This Privacy Policy explains how LeagueUp, Inc. ("LeagueUp," "we," "us," or "our") collects, uses, shares, and protects information when you use our mobile application, website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

Account Information

• Email address
• Username and display name
• Password, if you sign up with email (handled by Firebase Authentication; we never see it in plain text)
• Date of birth (for age verification)
• Full name (optional)
• Profile picture
• Bio and profile description
• Timezone (your device's time zone setting)
• If you sign in with Apple or Google, the name and email address that provider shares with us

Goal and Activity Data

• Goals you create (activity, schedule, targets) and goal templates you save or share
• Logs (check-ins): amounts, dates, and the notes, captions and photos you attach
• Goal progress, weekly results and streaks

League Participation Data

• Leagues joined or created
• League settings and preferences
• Stake amounts you attach to league goals (personal weekly commitments your league can see; never pooled, never charged, and no money moves)
• Standings, weekly results and matchups

Communication Data

• Messages in league chats
• Direct messages to other users
• Comments on activities
• Reactions to posts
• Public and private notes on check-ins

Survey and Preference Data

• Onboarding survey responses
• Accountability preferences
• Notification settings
• Privacy preferences
• Personalization choices

Payment Information (When applicable)

• Subscription status and purchase history for LeagueUp Premium, received from Apple via our subscription provider, RevenueCat, which we identify you to by your LeagueUp user ID
• Payments are processed by Apple; we never receive or store your card details

Reports and Safety Data

• Reports you file about other users or content, and the content you report
• Users you block

2.2 Information Collected Automatically

Device Information

• Device type and model
• Operating system and version
• Unique device and app-instance identifiers
• Push notification tokens, if you allow notifications
• Mobile network information
• IP address

Usage Information

• Features used and actions taken
• Time spent in the app
• Navigation patterns
• Crash reports, error logs and performance data
• Check-in patterns and timing

Location Information

• Your device's time zone setting, so each log counts toward the right day and week
• On our website, an approximate country or region from your IP address when you sign up
• The app does not ask for access to your device's location and does not track where you are
• The only precise location data we store is the GPS route of a workout you import from Apple Health (see Apple Health below)

Device Permissions

• Camera and photo library: only when you choose to take or attach a photo
• Notifications: only if you allow them
• Apple Health: only if you connect it (see below)
• The app does not access your contacts or your calendar

2.3 Information from Third Parties

Authentication Providers

• Basic profile information if you sign up using third-party authentication
• Email address from authentication provider

Apple Health (optional)

Apple Health is off unless you connect it. If you do, LeagueUp reads the data types you allow so it can log your workouts and credit your goals automatically: workouts (type, time, duration, distance, energy and heart rate), steps, walking, running, cycling and swimming distance, active energy, flights climbed, stand time, sleep, mindful minutes, heart rate, resting heart rate and VO2 max. LeagueUp does not write data to Apple Health.

• Health data you import is saved to your LeagueUp account as logs, so it reaches our servers the same way a log you enter by hand does
• It is used only to log workouts and record progress on your goals, and is shown to others only as goal progress you would otherwise log yourself
• If an imported workout has a GPS route, we store a simplified copy with that workout. Where league members can see the route, the stretch within about 200 meters of the start and the end is hidden
• We never use health data for advertising or marketing, and we never sell it or share it with data brokers or advertisers
• We do not store health data in iCloud
• You can revoke access at any time in the iOS Settings app (Health → Data Access & Devices → LeagueUp)

Analytics Services

• Google Analytics for Firebase (in the app): events such as a log being created or the subscription screen being opened, with device and app-instance identifiers and, on some events, your LeagueUp user ID. We use it to understand how the app is used, not for advertising
• Sentry: crash and error reports, including device details, IP address, what failed, and your LeagueUp user ID and username

3. How We Use Your Information

3.1 To Provide and Improve the Service

• Create and manage your account
• Enable goal tracking and progress monitoring
• Facilitate league participation
• Process check-ins and verify progress
• Calculate standings, weekly results and rankings
• Send notifications and reminders
• Provide customer support

3.2 For Personalization (With Your Consent)

• Suggest leagues, goals and matchups
• Suggest relevant goals and leagues
• Customize reminders and nudges
• Tailor content to your preferences
• Provide personalized insights

3.3 For Safety and Security

• Verify user age and enforce age restrictions
• Screen public content before it appears: profile photos, display names, bios, shared goal titles, and league names, descriptions and cover images
• Review content that someone reports, including messages from private chats and direct messages
• Detect and prevent fraud or abuse
• Protect minors through enhanced safety features
• Investigate violations of our Terms of Service

3.4 For Communication

• Send service-related announcements
• Provide goal reminders and progress updates
• Send marketing communications (with consent)
• Respond to your inquiries

3.5 For Analytics and Research

• Understand how users interact with the Service
• Identify trends and usage patterns
• Improve features and user experience
• Conduct anonymized research on goal achievement
• Generate aggregated insights

3.6 For Legal Compliance

• Comply with legal obligations
• Enforce our Terms of Service
• Protect our rights and property
• Respond to legal requests

4. How We Share Your Information

4.1 With Other Users

Public Information

• Username and profile information
• Public league participation
• Check-ins in public leagues
• Comments and reactions
• Public goal progress

League Members

• Your progress and check-ins within shared leagues
• Proof submissions (if applicable)
• League-specific communications
• Standings, weekly results and the stakes you set on league goals

Private by Default

• Direct messages (visible only to the people in the conversation, unless someone reports a message for review)
• Private notes on check-ins
• Personal goal details (unless shared in a league)
• Email address and birth date

4.2 With Service Providers

We share information with trusted third-party service providers who assist us in operating the Service:

• Google Firebase and Google Cloud: sign-in, database, file storage, server functions, app integrity checks (App Check) and push notification delivery (Firebase Cloud Messaging)
• Google Analytics for Firebase: in-app usage analytics
• Google Cloud Vision: screens profile photos and league images before they appear
• OpenAI: its moderation service screens display names, bios and shared goal titles, and scores content that someone reports (text and any attached images, which can include a reported chat or direct message). We send only that content, not your account details
• Apple: Sign in with Apple, App Store purchases and push notifications
• Google: Sign in with Google
• RevenueCat: subscription status for LeagueUp Premium
• Sentry: crash and error diagnostics
• Resend: transactional email, such as invitations and account deactivation and deletion notices
• ipinfo.io: approximate country from your IP address when you sign up on our website

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 For Legal Reasons

We may disclose information when required to:

• Comply with legal obligations
• Respond to valid legal requests
• Protect safety and prevent harm
• Enforce our Terms of Service
• Protect our rights and property

4.4 With Your Consent

We may share information with your explicit consent or at your direction.

4.5 Business Transfers

If LeagueUp is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4.6 Aggregated Information

We may share aggregated, anonymized information that cannot identify you personally for research, marketing, or other purposes.

5. Data Retention

We retain your information for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

Specific Retention Periods:

• Account information: until your account is deleted
• Goals, logs and photos: until you delete them or your account is deleted
• League history: kept for the league's record; after your account is deleted it shows as "Deleted User"
• Analytics and crash data: kept under the retention settings of Google Analytics and Sentry
• Deleted content: may remain in backups for up to 30 days

6. Your Rights and Choices

6.1 Access and Portability

You can access most of your information through the app. You may also request a copy of your personal data by contacting us. We'll provide your account information, active goals, and recent activity in JSON format.

6.2 Correction

You can update your profile information at any time through account settings.

6.3 Deletion

You can delete your account in the app under Settings → Delete Account, or by emailing delete@joinleagueup.com. Note that:

• Your account is deactivated right away and permanently deleted after a 30-day grace period; sign back in within those 30 days to restore it
• At deletion we remove your name, username, email address, photo, bio, birth date and phone number, remove you from your leagues and follower lists, delete your notification tokens and disable your sign-in
• Logs, photos and messages you shared in leagues may remain visible to those leagues, shown as "Deleted User"
• Some information may be retained for legal compliance
• Deletion is permanent and cannot be undone

6.4 Communication Preferences

You can control:

• Push notification settings
• Email communications
• Marketing messages
• League-specific notifications

6.5 Privacy Settings

You can manage:

• Profile visibility
• Who can message you
• League discovery preferences
• Data sharing for personalization

7. Children's Privacy

7.1 Age Requirements

LeagueUp is exclusively for users 18 years of age and older. We do not knowingly collect information from anyone under 18. If we learn we have collected information from someone under 18, we will delete that information promptly.

All users must verify their age during account creation, and access to the platform is restricted to adults only.

8. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit and at rest
• Secure password storage using industry-standard hashing
• Regular security assessments
• Access controls and authentication
• Secure data storage on trusted cloud providers

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country. By using the Service, you consent to such transfers.

We take appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy.

10. Third-Party Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

Current Third-Party Services:

• Google Firebase and Google Cloud (including Cloud Vision) - Backend infrastructure and image screening
• Google Analytics for Firebase - In-app usage analytics
• OpenAI - Content moderation
• Apple and Google - Sign-in, and Apple for App Store purchases and push notifications
• RevenueCat - Subscription status
• Sentry - Crash and error diagnostics
• Resend - Transactional email
• ipinfo.io - Approximate country at website sign-up

11. Do Not Track

The Service does not currently respond to Do Not Track signals. We do not track users across third-party websites or apps, we do not show ads, and we do not share your information with data brokers.

12. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information to third parties.

13. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending email notification for significant changes
• In-app notifications

Your continued use of the Service after changes indicates acceptance of the updated Privacy Policy.

14. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

15. Additional Disclosures

15.1 Cookies and Similar Technologies

We use cookies and similar technologies to:

• Remember your preferences
• Understand how you use the Service
• Improve your experience

You can control cookies through your browser settings.

15.2 Data Processing Basis

We process your information based on:

• Your consent
• Performance of our contract with you
• Compliance with legal obligations
• Our legitimate interests in operating the Service

15.3 Automated Decision Making

We may use automated systems to:

• Screen public profile text and images before they appear
• Detect potential fraud
• Personalize content (with consent)
• Enforce age-appropriate restrictions

You can request human review of automated decisions that significantly affect you.

15.4 Data Minimization

We collect only the information necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy.

15.5 Privacy by Design

We consider privacy at every stage of product development and implement privacy-protective features by default.