Privacy Policy

1. Introduction

This Privacy Policy explains what data we collect, how we use it, and how we protect your information when using the Wolkup platform (website and mobile app).

The operator's formal document, published pursuant to Article 18.1(2) of Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" — purposes and legal bases for processing, the data processed, retention periods, security measures and your rights — is the Personal Data Processing Policy.

2. Authentication Methods

The primary way to sign in is a one-time code sent to your email. If you enable "remember this device", a trust token is stored on the device so you don't have to enter a code on every sign-in. We neither use nor store passwords.

For other uses of your email, see the "Notifications" section.

Sign in with Apple and Google. Sign in with Apple and Google sign-in are also available. These buttons are not shown in every country: they are hidden for Russian IP addresses, where sign-in is by email code only. When you use them, we receive your identifier in that service, your name, and your email address (if you allowed it to be shared). We never receive your Apple or Google account password.

If you use Apple's "Hide My Email" feature, Apple gives us a relay address ending in @privaterelay.appleid.com. We identify you by your Apple identifier rather than by that address, and we never overwrite your account's real email with a relay address.

Linking Apple and Google to an existing account. In the app settings you can link Apple or Google to an account you already have, so you can sign in either way, and unlink them again. Linking is available in all countries. You cannot unlink your last remaining sign-in method — that would lock you out of your account.

3. Deprecated Authentication Methods

Login via Telegram was previously supported. New sign-ins with this method are no longer possible. Data received through it (name, identifier, avatar) is preserved for existing accounts but no longer used. You may request its removal.

4. Strava Integration

If you connect Strava, we receive workout data through their official API:

• activity date and type
• duration
• distance
• calories
• heart rate (if available)

Imported data is used to display your activity, generate statistics, and track streaks. You may disconnect Strava at any time, and the data will be deleted.

5. Apple Health and Google Fit Integration

If you connect Apple Health (iOS) or Google Fit (Android), the app may read your workout data, including:

• activity date and type
• duration
• distance
• calories
• heart rate (if available)
• device and source information
• workout events (segments, laps, etc.)

Workout data from Apple Health or Google Fit is only sent to our servers if you choose to import it. Once imported, it remains stored until you delete it manually. You can delete imported workouts in the app or request deletion by contacting support. Other data already received from these integrations before deletion will remain stored unless you request its removal or delete your account entirely.

With sync enabled, the app may also write your finished workouts to Apple Health: activity type, duration, distance, calories, and the route (for walks and runs). Writing is controlled by a separate toggle in the settings and can be turned off at any time.

Body weight history. To keep your profile current, estimate calories more accurately, and show your body-weight trend over time in the app's analytics, we store a history of your body-weight measurements on our servers, associated with your account — at most one point per day. These measurements come from two sources: (1) Apple Health — the app reads your body weight (for example, from a smart scale); when you first enable the integration, and only if you have no weight history of your own yet, the app performs a one-time import of roughly the last two months of measurements, averaged per week to smooth out daily fluctuations, and records a daily point thereafter; and (2) manual entry — any weight value you type into your profile. Weight history is stored until you delete individual points, delete your account, or contact support to request its removal. Turning the Apple Health integration off stops new readings from Apple Health but does not, by itself, delete weight already stored or weight you entered manually.

Profile biometrics. Besides weight, we may store additional profile metrics: height, date of birth and sex. You enter these manually in your profile, or they sync from Apple Health. Resting heart rate is not stored on our servers: it stays on your device and is only used for in-app calculations.

Consent for health data. Height, weight and its history, and heart rate during workouts (average, maximum and the series of readings) are special categories of personal data. We process them only with your separate consent, confirmed in the app by a separate action — see Consent to processing of special categories of personal data. Without it the server does not accept this data. You can withdraw consent at any time in the app settings: processing stops immediately and the data is erased 7 days later — if you withdrew by mistake, that is enough time to confirm again. Your account and workouts stay either way. These are used for more accurate in-app calculations (e.g. stride length, heart-rate zones, calorie estimates) and — in the cases described in §9 — to generate an AI training plan.

6. Camera and Motion Recognition

For rep-counted workouts (push-ups, squats, plank) the app uses the device camera with on-device pose recognition. Image processing happens entirely on your device: camera frames are never stored, recorded, or sent to our servers. Only numeric workout results are uploaded — rep counts, hold duration, and anonymized movement metrics (such as range of motion and rep tempo) used to calculate your progress.

7. Location and Routes

For walks, runs, and map-based game modes the app uses your location with your permission, including in the background — so the track keeps recording while the screen is off. We store the workout route (a simplified set of points), distance, pace, related statistics, and visited exploration map cells on our servers. Location is used only during an active workout; there is no continuous location tracking. You can revoke location access in the system settings — workouts without a map will keep working.

8. Motion Sensors and Apple Watch

During workouts the app may use the device pedometer (steps, cadence) and, if you have an Apple Watch with the Wolkup app installed, start a heart-rate measuring session on the watch. Heart rate and cadence from the watch are streamed to the phone and shown on the workout screen in real time; summary values (such as average and maximum heart rate) may be saved with the workout. The phone remains the writer of the workout to Apple Health — no duplicates are created from the watch.

9. Stored Data

We only store data required for platform operation: profile information, workouts, activity data, body weight history, achievements, settings, and action logs. We do not share data with third parties for their own purposes — only with processors necessary to operate the platform (analytics, payments, email delivery, AI content generation), see the relevant sections.

AI features and OpenAI. For the weekly AI training report and AI-generated training plans (see Terms of Use, §6.1), we use OpenAI's models as a service provider. Only anonymized numeric training aggregates are sent in the request — no name, email, or other account identifier. Starting from app version 2.5, the request may also include coarse, non-numeric categories — for example, "body load: average", "conditioning: high", "age band: 30-50" — computed on our side from your profile metrics (height, weight, date of birth, if you've provided them). Your actual height, weight or date of birth values are never sent to OpenAI — only the resulting category, from which the original numbers cannot be reconstructed. OpenAI does not use the data we send to train its models.

10. Notifications

The platform may send you notifications related to achievements, updates, and activity — in-app, via push, and by email (for example, workout reports and streak reminders). These emails are on by default; you can turn off a specific type in the app settings or instantly via the "Unsubscribe" link in the email itself — no sign-in required.

Promotional notifications ("Promo" — news and offers) are the exception: unlike other types, they are off by default and only turn on when you explicitly enable them in the app settings.

11. Cookies and Analytics

The website uses strictly necessary cookies only: your chosen interface language, the colour theme, and an authentication flag. They are required for the site itself to work, do not track you between visits, and are not shared with third parties — so no consent is needed for them and we show no cookie banner.

There is no website analytics: no counters or advertising trackers are embedded in the pages. Anonymised request statistics exist only in our web server logs (see the website visit section of the Policy).

The mobile app uses PostHog for product analytics (data is processed in the EU region). It automatically collects technical usage events — screens viewed, interactions with UI elements, app and device version. This analytics data is anonymous: events are NOT linked to your name, email, or account ID, your IP address is not stored, and no location is derived from it. We can only see how the app is used in aggregate, and cannot tie these events to a specific person. This analytics data is not used for marketing and is not shared with third parties beyond PostHog as our processor.

12. Data Storage and Security

All data is stored on servers located in Moscow, Russia. Access to personal data is limited to the personal data operator and service owner — Artem Zaborskikh, a private individual and a citizen of the Republic of Kazakhstan; the processing is carried out by them personally. The operator has no employees. Standard hosting and authentication security measures are applied.

13. Your Rights

You have the right to:

• receive a copy of your data
• request data deletion
• restrict processing
• request corrections

To exercise your rights, contact us at [email protected] or [email protected]. We respond within 10 working days of receiving your request; that period may be extended by no more than 5 working days, in which case we will send you a notice explaining why. Deletion requested this way is carried out within 30 days. The full list of rights and deadlines is in the Personal Data Processing Policy.

14. Account Deletion

You can delete your account directly within the app through the profile settings. This will permanently remove all associated data. Once deleted, the data cannot be recovered.

15. Changes

We may update this policy. The latest version is always available on this page. In case of significant changes, you will be notified via the app or browser.

16. Public Profiles and Leaderboards

New profiles are private by default. A private profile can be viewed only by you and by your friends — users who follow you while you follow them back (a mutual follow). To everyone else a private profile shows no statistics: just your name and username, with the option to follow you.

You can make your profile public at any time from the profile settings. A public profile shows your name, username, current streak, total workout count, follower and following counts, and recent activity — to all signed-in users of the platform, not to the whole internet.

Profiles are not visible to visitors who are not signed in, even public ones. Sharing your profile produces a link (wolkup.com/profile/your-username) that opens inside the app for people who have it installed. Someone opening that link in a browser without signing in — as well as search engine crawlers and scrapers — sees only your name and username: no streak, no workouts, no follower counts. This is deliberate: making the content available to an indefinite range of persons would be dissemination of personal data under Article 10.1 of Russian Federal Law No. 152-FZ and would require separate consent.

Separately, the in-app leaderboard displays your username, weekly workout count, and streak for ranking purposes.

17. Activity Feed

The app includes an activity feed. The platform automatically generates events about your activity — unlocked achievements, round-number streak milestones, and completed workouts — and shows them to other users in line with your profile privacy settings (see §16): to your followers if your profile is public, and only to your friends (a mutual follow) if your profile is private. The feed has no free-form text posts — only these automatic events.

Achievements and streak milestones are always published. Publishing of completed workouts is controlled by a separate "Share workouts to feed" setting in your profile; you can turn it off at any time, after which workouts no longer appear in the feed. This setting also applies to workouts imported from Apple Health, Google Fit, or Strava: when sharing is on, imported workouts may likewise appear in your feed.

For workouts with a route (walks, runs, and the like), the feed may display a map of the route and headline figures — distance and time. This means your route is visible to everyone who can see your activity. You can hide any individual post from the feed manually.

Other users may react to your event with a "Like"; we store the fact of the reaction (who reacted to which event) and notify you of it. Showing your activity in the feed means displaying it to other users of the platform according to your privacy settings — it is not a disclosure of your data to third parties for their own purposes.