Privacy policy

What stays on your phone, and what does not.

Effective 19 August 2026 · Versione italiana

PUMP is a training app. This policy states which data stays on your device and which does not, because that is the only question that matters.

Who processes your data

The data controller is Sandro Vilmi, an individual developer, based in Italy. There is no company behind PUMP and no office: there is one person, and you reach them at supporto@pumpapp.net. Given PUMP's size no data protection officer is required; write to that address and the controller answers directly.

Why we are allowed to process it

Every piece of data has a reason, and there are only three:

• To run the app you chose — account, profile, plans, sessions, meals, syncing between your devices, the showcase. That is performing the contract between you and us: without this data PUMP cannot do what you ask of it.
• Because you asked us to — the data PUMP reads from the Health app, and whatever you send to Karol. These are separate consents: you give them when you want and withdraw them when you want, and the rest keeps working.
• To keep the service standing — defending it from abuse, counting requests to stop whoever makes too many, keeping the technical logs we cannot do without. That is our legitimate interest in PUMP staying up, and it involves no profiling and no advertising.

Health data stays on your device

PUMP reads weight, height, steps, calories, heart rate, sleep, distance and workouts recorded by other apps from Apple Health and Health Connect. That data stays on your phone. It is not sent to our servers, not used for profiling and never used for advertising.

PUMP writes nothing back to the Health app.

You can revoke that access at any time: on iPhone in Settings → Privacy & Security → Health, on Android in the Health Connect settings. The app keeps working without it.

There is exactly one exception, and you choose it every time: Karol. It is explained right below.

Karol, the assistant — and what leaves your phone when you use it

Karol is the PUMP assistant: it answers your questions about training and food, and from a photo of your plate it estimates what is on it and how much it weighs. It is a Gold feature. To do that it sends what you give it to an external service — OpenRouter, which in turn queries the AI model. The feature cannot exist without that step: it does not run on the phone.

Before the first request the app asks what it may send, and the choice is yours:

• Only what you type or photograph — the text of your message, or the picture of the plate. Nothing else.
• Health context as well — the name you entered in your profile, weight, height, age in years, gender, and that day's data: steps, active energy, exercise minutes, distance, sleep and resting heart rate. This is what lets Karol actually answer “how is it going”, and call you by name. ⚠️ This is health data, and it goes to a third-party company.
• Not now — and Karol does not start.

What never leaves, under either choice: your email address and your date of birth — what goes out is your age in years, not the day. If you pick “only what you type or photograph”, nothing leaves the database: not even your name. Photos, messages and answers are not stored by us: they cross our servers and end up in no table and in no log. The conversation lives in the app only for as long as you keep it open.

If you don't use Karol, none of this happens: the rest of the app works exactly the same without sending anything to anyone.

What is stored on our servers

If you create an account — it exists so you can find your things on another device — the following is stored on our servers, which are located in Europe:

• your email address and your password, kept only as a cryptographic hash: we cannot read it;
• the name you entered in your profile;
• weight, height, date of birth and gender, if you entered them: they are used to compute your calorie needs and training loads;
• your plans, sessions, sets, logged meals and water.

These are the things that must travel between your devices. Nothing else is uploaded.

Where it lives, and who else touches it

PUMP's database is hosted on Cloudflare and the data sits in Europe. No read replica is active anywhere else. The code that answers requests runs on Cloudflare's network close to you, so your data passes through the nearest node while it travels: it stays written in Europe.

These are all the providers that touch anything, what they do and when they come into play. There are no others:

• Cloudflare (United States, data in Europe) — hosts the app, the database and this site, and receives mail addressed to @pumpapp.net. Always.
• Resend (United States, sending from Ireland) — delivers service email: address verification and password reset. It receives your email address and the text of the message.
• OpenRouter (United States) — only if you use Karol, and only what you decided to send it. If you don't use Karol, it never receives anything of yours.
• Apple and Google — if you sign in with their sheet, and for subscriptions bought in their stores. The purchase happens with them: payment does not pass through us and we never see your card.

Three of these are United States companies, and that is said rather than hidden: the data they receive may be processed outside the European Union. The transfer relies on the standard contractual clauses approved by the European Commission and, for providers that participate, on the EU–US Data Privacy Framework. If that is a problem for you, Karol can be left unused and the rest of the app stays whole.

If you sign in with Google or Apple

The sign-in sheet belongs to the system, not to us: the password of your Google or Apple account never passes through PUMP and we do not receive it in any form.

What the provider hands us is your email address and your name, plus the identifier that provider recognises you by, which is what links you back to your account next time. Nothing else: no address book, no contacts, no photos, no data from your profile on those services. They are the same two fields you would give us by registering with an email address and a password.

What we do not do

• No advertising and no tracking inside the app: the PUMP app contains no ad SDKs and no third-party analytics. We do not measure what you do inside it. The only statistics we see are the ones App Store and Google Play give to anyone who publishes an app — how many installs, in which countries, how many crashes — and they are aggregate numbers: they do not say who you are, and they do not come from us.
• We do not sell or share your data with anyone.
• We do not use your data to train models.

What this website stores in your browser

This is about the website, not the app: they are two different things and we keep them apart.

Three things stay in your browser's storage always, because they are technical: they are not cookies, they travel nowhere and they identify nobody.

• pump-tema — the light or dark theme you picked by hand, so we don't hand you a different one on your next visit;
• a note that you dismissed the language notice, so it is not offered again on every page;
• the answer you gave the banner below, so we don't ask again every time.

The measurement cookies, which we do ask about

If you consent, and only if you consent, we load Google Analytics to understand which pages actually get read and which don't. It writes two cookies (_ga and _ga_<code>) lasting up to two years, which distinguish a new visit from a returning one.

Until you answer, or if you answer no, that code is not even downloaded: it isn't sitting there switched off — it never arrives, and no cookie is written. You can change your mind any time from the Cookies link at the bottom of every page.

Google processes them as an independent controller for its own purposes; the notice is Google's privacy policy. It is a United States company: what is written above about transfers applies.

🔴 We do not advertise: no advertising signals are enabled, no audiences are built, and the data is not used to profile you or to sell you anything.

When you publish a plan

If you choose to publish a plan in the showcase, its title, description, structure and your name as the author become public. Nothing else from your profile. You can withdraw it at any time: it leaves the showcase, and whoever already downloaded it keeps it.

Deleting your account

From “You” → Account you can delete your account. Deletion removes all of your data from our servers, including published plans, which leave the showcase. This cannot be undone. The step by step is in Deleting your account Cookies.

Retention

Data is kept while your account exists. Deleting it removes the data, immediately: there is no bin and no grace period. Health data read from the Health app lives only on your phone and is gone when you delete the app.

The only exceptions, short-lived and not your content: the server's technical logs, which exist to understand a failure and are kept for a few days; and the purchase records for Gold, which stay in Apple's and Google's systems under their rules — not ours — because they are tax documents.

Young people

PUMP is not intended for anyone under 14 and does not knowingly collect data from them. Fourteen rather than thirteen because that is the age from which, in Italy, you can consent on your own to your data being processed for a service like this one; in other EU countries the threshold goes up to sixteen. If we find an account belonging to someone below that age, we delete it: write to us and we do it straight away.

Your rights, and how you actually use them

European law gives you six, and below is what you have to do for each. This is not a courtesy list: two of them you exercise yourself, in the app, without asking anyone.

• Know what we hold and correct it — your profile is yours to open and edit in the app, under “You”. For the full list of what sits on our servers, ask and we send it.
• Erase everything — under “You” → Account, on your own and without going through us. The step by step is in Deleting your account.
• Take your data with you — ask supporto@pumpapp.net and we send it in a file another app can read. ⚠️ There is no longer a button in the app that does this: we removed it when syncing became free for everyone, because it redid by hand something that now happens on its own. The right is intact; today it goes through a request.
• Restrict or object to processing based on our legitimate interest — write to us saying which one.
• Withdraw a consent — the Health one from your phone's settings, the Karol one from the app. It applies immediately and does not undo what already happened before.

We answer within one month, as the law requires.

If you think we are getting it wrong, you can turn to the Italian Data Protection Authority, or to the authority of the European country you live in.

Where the food data comes from

The nutritional values PUMP shows you come from the Ciqual 2025 table published by ANSES, the French health agency, used under Licence Ouverte / Open Licence 2.0 (Etalab). It is not your data and has nothing to do with privacy: we write it here because that licence asks that whoever produced the data be named, and it is only fair you know what the calories you read are computed from.

If this policy changes

The date at the top of this page changes, and if something that matters changes we say so inside the app. We do not quietly alter what we do with your data.

Contact

For any question about this data, or to exercise any of the rights above: supporto@pumpapp.net. A person answers.