Spumpy Privacy Policy

Last updated: August 26, 2026

Spumpy is a fitness companion that turns workouts into in-app progress, tokens, companion appearance changes, and optional friend activity. Spumpy is designed to keep workout processing local where possible and to sync only the compact profile data needed for friend features.

Information Spumpy Accesses

With your permission, Spumpy reads recent workout or exercise session data and step counts from Apple Health on iOS or Health Connect on Android. This may include workout type, start time, duration, step totals, and related activity metadata provided by the platform.

Spumpy uses this data to calculate tokens, streaks, companion progression, recent activity summaries, Friend Relay progress, and optional 24-hour Step Stakes totals. Spumpy does not write health records to Apple Health or Health Connect.

You can revoke access at any time in Apple Health or Android Health Connect settings. If you do not grant health access, you can still use Manual Upload workouts.

Camera and Manual Uploads

Spumpy may ask to use your camera when you create a Manual Upload workout. The original Manual Upload photo is stored on your device with local workout history. The photo stays local by default. If you explicitly enable accountability sharing and choose one or more accepted friends, Spumpy creates a smaller JPEG copy, removes camera metadata by re-encoding it, and uploads that copy for only those selected friends to view. The shared copy expires after seven days, and you can stop sharing it sooner. A recipient may still take a screenshot or otherwise save what they can view.

Profile and Friend Data

If you use friend features, Spumpy syncs a compact profile snapshot to the Spumpy backend. This may include your display name, friend code, Spumpy appearance, progress summary, level, streak, token-related activity, latest activity summary, friend invite state, friend-game state, a device-generated user ID, and an authentication secret hash used to protect friend actions.

Accepted friends can see your synced display name, Spumpy appearance, progress summary, and recent activity summary. Game details are limited to the matching opponent. Exact daily step totals and raw Apple Health or Health Connect records are not included in ordinary friend profiles. A Manual Upload photo is included only when you explicitly select that accepted friend for accountability sharing.

How Information Is Used

Turn workouts into tokens, streaks, levels, and companion progression.
Show recent activity and local workout history.
Send, accept, decline, cancel, and remove friend connections.
Process profile reports and enforce user blocks.
Keep accepted friends' Spumpy snapshots current.
Show a time-limited Manual Upload accountability proof to friends you select.
Preserve local app state so the app works when the backend is unavailable.

Spumpy does not sell health data or personal information. Spumpy does not share raw Health Connect or Apple Health records with advertisers.

iOS Beta Testing

The Spumpy website links directly to Apple TestFlight and no longer collects tester email addresses. TestFlight participation is handled by Apple under its own terms and privacy policy.

Storage and Retention

Workout history, original Manual Upload snaps, preferences, local secrets, and cached friend data are stored on your device. The app keeps a limited local workout history for recent app experience and progression.

Friend profile, connection, block, and report data is stored on the Spumpy backend while your Spumpy profile remains active. An opt-in Manual Upload accountability copy is stored with its capture time and selected audience. Access expires automatically after seven days, and expired copies are removed during backend cleanup. Stopping sharing, removing or blocking the recipient, or deleting your profile revokes access sooner.

Deletion and Controls

Revoke Apple Health or Health Connect permission in system settings.
Stop sharing an accountability photo from its local workout details.
Remove or block people and report inappropriate profiles in the Spumpy app.
Delete local app data by uninstalling Spumpy or clearing app data from device settings.
Use the in-app account deletion control to permanently delete your backend profile, friend relationships, pending requests, blocks, reports involving your profile, shared accountability copy, authentication secret, and local Spumpy data.

Account deletion is processed when you confirm it in the app. Copies in routine service-provider backups may remain until those backups rotate and are not used to restore an active Spumpy profile.

Security

Spumpy uses platform permission systems for health and camera access. Friend API requests use a locally generated secret, and the backend stores only a hash of that secret. Production Android and iOS builds use HTTPS for backend communication.

Children

Spumpy is not intended for children under 13. Do not use Spumpy if you are not old enough to consent to health and fitness data processing in your region.

Contact

For privacy or support questions, visit the Spumpy Support page.