Your data, clearly explained.
This page explains which data LevelUpLife processes for the respective functions and what control you have over that processing.
Last updated: 4 September 2026
Controller
Data we process
- Health Connect data such as steps, distance, active calories, heart rate, sleep, weight and body-fat percentage, if you explicitly enable this connection.
- Account data such as your email address, authentication data and technical account identifiers.
- Voluntary profile, body, training and nutrition data, such as weight, body measurements, meals, nutrient values, training sets, runs, goals, quests and progress.
- Location data when you use weather functions or start a run. During a live run, location points, time, distance, pace and route may be processed.
- Private progress photos if you deliberately add them after a workout, run or weigh-in check-in.
- Community and social data: selected display name or anonymisation, avatar, level and activity information, friend requests, direct messages, blocks and reports.
- Technical data such as IP address, browser or device information, timestamps, error and diagnostic data, and push-subscription data if you enable notifications.
- Payment and subscription data only if LevelUpLife+ and payment processing are actually used.
Community, friends & messages
The community may display activities such as levels reached, completed workouts or achievements. In your profile settings, you can choose whether your name is shown or whether you appear as “Anonymous”.
Other members see only information intended for community functions, such as your display name or anonymised identity, avatar, level and the relevant activity. Friend requests and direct messages are intended only for the persons involved.
If you report a message, the message and the reason for the report are processed so that abuse can be reviewed. You can block people to prevent further interactions.
Photos & community sharing
Progress photos are stored only if you select or take them yourself. The original file is stored privately and with access protection in your account.
Publication is separate and voluntary: only if you explicitly enable “Post to community” when saving is a reduced preview created for the community feed. The private original is not published as a result.
Location, camera & other permissions
The camera is used for live barcode scans and, if you choose to do so, for photos. The microphone is used only for voice functions that you actively start.
Location access is requested for weather and for runs started by you. During an active run, the app may continue processing location on Android through a visible foreground service so that distance and route can also be recorded while the screen is locked.
Health Connect is read only after separate, explicit consent. You can withdraw that consent in your profile and additionally remove the Android permission in Health Connect.
You can revoke all device permissions at any time in your device's system settings.
Purposes & legal bases
We process data to provide your account and the app functions you choose, store content, operate community functions, prevent abuse and correct errors.
Where processing is necessary for your account and requested or booked functions, it is based on Art. 6(1)(b) GDPR. Functions based on consent, such as permissions, publication of community photos or push notifications, are based on Art. 6(1)(a) GDPR. Security, error analysis and abuse prevention may be based on Art. 6(1)(f) GDPR.
Reading health data from Health Connect additionally requires your separate, explicit consent under Art. 9(2)(a) GDPR. Consent is voluntary, purpose-specific and informed. Refusing consent does not affect other app functions.
Your decision is documented together with the time of the decision, the consent version and the specific purpose. You can withdraw it at any time with effect for the future in your profile.
Body, training and nutrition information may relate to health. The separate consent described here concerns Health Connect access. For other health data entered manually, the specific processing must likewise be explained transparently and assessed legally.
Services, recipients & retention
- Supabase for authentication, database services, realtime functions and protected storage of app content and photos.
- Vercel for hosting the web application and Vercel Web Analytics for cookieless, aggregated usage and stability analysis.
- Stripe only if payment or subscription processing is actually used.
- Open Food Facts, USDA, BLS and Swiss nutrition datasets for food information; when a barcode is scanned, the barcode is processed to look up the product.
- Weather and geocoding services when you use weather or location-based functions. Location coordinates or place information may be transmitted for this purpose.
- Native device functions for camera, microphone, location, photos and notifications, provided you grant the relevant permission.
- Android Health Connect as an operating-system service. Health Connect values are read only after your explicit consent; the app currently uses them only for display and does not store them in Supabase as raw Health Connect data.
Account data and private app content are generally stored for the duration of your account. Private photos, community content, messages and social connections remain stored until they are deleted or the account is deleted, unless security, abuse-prevention or statutory retention reasons require otherwise. Technical logs are retained only for as long as necessary for operation, security and error analysis.
Sanitised runtime error reports are processed only for short-term error analysis in Vercel logs. Query parameters, fragments, direct identifiers, email addresses, tokens and production stack traces are not transmitted. Retention of these sanitised error reports is limited to a maximum of 7 days.
Your rights & contact
- Access to stored personal data
- Correction of inaccurate personal data
- Deletion or restriction of processing
- Data portability
- Objection to processing based on legitimate interests
- Withdrawal of consent with effect for the future
- The right to lodge a complaint with a data-protection supervisory authority
For access, correction or deletion requests, contact us at leveluplifecontent@gmail.com.
This statement describes the current functions of LevelUpLife and will be updated if material changes are made. We recommend review by a qualified lawyer before a public release for a legally binding final assessment.