Privacy Policy

Effective: October 28, 2026. Document version: 2026-10-28.coordinated-v1.

HipUp Fitness ("HipUp," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data when you use our platform on this website.

1. Information We Collect

Account Information: When you sign up, we collect your email address, display name, and age group selection. If you sign in with Google, we receive your name and email from your Google account.

Optional contact phone and workout reminders: Adult account owners can optionally save a contact phone number and remove it in Account. Providing a phone number does not subscribe you to texts or calls. Email workout reminders require a separate explicit choice, including your selected days, local time and timezone. We store that choice and send reminders through our email provider to your verified account email. Reminders may mention a fitness goal you explicitly selected, but do not use viewing history or activity history. Stop reminders in Account or with the unsubscribe link in any reminder; account and free-day emails are separate. We retain the saved on/off choice and schedule; stopping clears the reminder recipient address from that subscription. Minimal operational reminder receipts are eligible for deletion after seven days while the reminder service is running. They are separate from aggregate usage statistics. An email already handed to the provider may still arrive after you stop.

Payment Information: For paid plans, payment details such as card number and billing address are collected and processed directly by Stripe. We will not store your full card number on our servers.

Restricted billing diagnostics: To reconcile payment, invoice, refund, subscription and checkout observations, we retain fixed commercial customer and provider event/object identifiers and relationships, currency and amounts in minor units, fixed statuses, transition and attempt fields, diagnostic/version codes, and provider, receipt and explicit effective times when available. These records can be linked to a commercial account and are not anonymous. Access is restricted to authorized operators; the owner report returns grouped counts and currency totals without account or provider identifiers. These diagnostics contain no raw provider payload, card data, billing address, email, metadata, free-text error, demographic or health values, and are not linked to anonymous activity counters. They expire from reports after 90 days measured against both provider and receipt time and are removed by bounded scheduled cleanup; old event replays do not restart retention. Backup copies follow Cloudflare's separate retention. Device statistics opt-out and optional analytics withdrawal do not delete billing diagnostics or operational billing records. Account access/deletion requests cover linked diagnostics, including linked refund and allocation records without a direct customer identifier, subject to applicable record-retention obligations. These limited observations are not a complete payment history or settlement ledger.

Service Activity: We keep the activity records needed to provide your membership, such as saved workouts, workout progress and completions, activity logs, check-ins, Fitness Path choices, and coaching bookings. These records support the features you use and are separate from optional usage analytics.

Optional Usage Analytics: Where this option is available, it is off unless you choose to allow it in Account Security. Your membership works the same if you decline. See the optional analytics section below for what is shared and how to change your choice.

Automatic Basic Statistics: Legitimate member profiles, including child, teen, guardian, linked and managed family profiles, contribute daily counters under existing ownership and service consent checks, with a device opt-out in Account Security. No optional age preference is required. This is separate from optional account-linked analytics. See the basic statistics section below.

Device & Technical Data: We automatically collect basic technical information such as browser type, device type, and IP address for security and performance purposes.

Questionnaire and My Path

Your one-page questionnaire saves your selected experience, recent activity, preferred workout days and duration, interests and supported fitness goals for the active participant. My Path uses your saved choices and the workouts available to that participant to prepare a weekly plan. Interests are separate from supported plan focuses; unavailable matches are not invented. Saved plans, workout attempts and confirmed activity support your Home and Tracker views. Completing a workout requires a confirmed activity record.

These records follow existing account and participant access rules. Guardians can manage eligible child and teen profiles; separate-login adults keep their own participant records. Authorized HipUp personnel with member-record permission may review saved non-measurement preferences. Switching a profile does not grant access to another person's records. Changes in consent or participant authority may clear incompatible questionnaire context.

Height and weight are optional and available only for eligible adults recording their own measurements. You can skip, replace or remove them. Only that member and authorized HipUp owners can view these values; general staff cannot. We keep only the latest values until you remove them or delete your account, without a history of replaced measurements. These values do not determine workout suggestions and are not copied into general analytics. Previously saved measurements with a finite expiry keep their original deadline. Disabling the measurement feature hides retained values without authorizing an overwrite of values you cannot see. Existing account deletion and backup provisions still apply.

2. How We Use Your Information

• Provide the service: Authenticate your account, manage your account or plan status, deliver video content when available, and track your workout progress.
• Improve the platform: Understand usage patterns to improve our content library, user experience, and features.
• Communicate with you: Send account-related emails such as welcome messages, password resets, plan updates, and billing notices where applicable. We may also send occasional product updates, which you can opt out of at any time.
• Ensure security: Detect and prevent fraud, abuse, and unauthorized access.

3. Third-Party Services

We work with trusted third-party services to operate HipUp. These providers only access your data as needed to perform their services:

• Supabase — Authentication and user account management.
• Stripe — Payment processing and subscription billing for paid plans.
• Bunny.net — Video content delivery (CDN). Bunny.net delivers video streams but does not have access to your personal account information.
• Cloudflare — Website hosting, performance, security, daily basic statistics storage, and first-party optional analytics storage on our existing infrastructure. Optional analytics requires your saved permission as described below.

We do not sell, rent, or trade your personal information to any third party. We do not share your data with advertisers or data brokers.

4. Cookies & Local Storage

We use minimal cookies and browser local storage, limited to:

• Authentication session: Keeps you logged in between visits.
• Preferences: Remembers your settings (e.g., video playback preferences).

We do not use advertising cookies. Optional usage analytics is sent through HipUp's authenticated server to first-party storage on our existing Cloudflare infrastructure. No analytics events are transferred to PostHog. HipUp keeps your analytics choice with your account and uses temporary session identifiers in browser memory to group activity during a visit.

Automatic Basic Statistics

We use daily counters to understand use of content and features and identify service problems. Legitimate member profiles include Kids, Teens, Adults, Seniors, guardian relationships, linked household members and managed family profiles. An optional age preference is not required. Personal profiles require matching valid service consent and adult account-owner confirmation, including the parent or legal guardian relationship for a child or teen. Managed profiles require an active household relationship authorized for the signed-in owner and that owner's valid service setup; creating a managed profile does not create a separate service-consent acceptance. Operators, staff, test and other non-member records and inactive profiles are excluded. We honor Do Not Track (DNT) and Global Privacy Control (GPC). These counters contain no age or demographic breakdowns.

• What is counted: Workout starts, estimated reported playback seconds, ended playbacks, playback errors, player readiness, observed advancing playback and fixed error categories (player error or unavailable player connection); coarse page categories; catalog observations, including zero results and fixed search/filter-use categories; coaching-provider selections and availability observations, including zero results. Approved public workout and provider identifiers may be dimensions. Playback time and readiness do not prove attention, completion or health or fitness outcomes.
• Workout discovery: Visible workout cards or links can count an exposure after at least half is onscreen for one continuous second while the page is visible and focused. Explicit workout-link activations count selections. Repeated mounts or different cards for the same workout can count again; locked workouts can also appear and count. These observations cover instrumented surfaces, not every opportunity to see a workout.
• Voluntary feedback observations: For the existing eligible adult-owner trial-feedback prompt, fixed anonymous categories count eligible prompt lifetimes, visible display, answer or skip attempts, acknowledged saves, API failure, transport unknown, invalid response, local dismissal and unresolved closes. Visible display requires at least half the prompt onscreen for one continuous second in a focused visible tab. Each closed prompt contributes one fixed answered, skipped, dismissed or unresolved outcome, separated by whether it met that visibility threshold. The share shown uses only closed visible lifetimes from the same version and UTC receive-date window. Repeated visits can count again; open prompts, unseen closes and lost deliveries are outside that denominator. An acknowledgement may return an existing saved answer, and unresolved does not mean declined. Counts contain no feedback reason, text, account, profile, household, session or prompt identifier, precise event time, demographic or health values. Saved voluntary answers remain account-linked and are reported separately, never matched to these counters or used as their numerator. These observations do not establish unique-person response rates, complete historical coverage or representativeness. Device opt-out, DNT and GPC stop the counts without preventing voluntary feedback; no new prompt or analytics consent flow is added.
• Member tasks: Fixed task codes count supported form openings or action starts, request attempts, validation occurrences and observed outcomes for creating or changing a path, weekly or post-workout check-ins, creating, updating or deleting tracker entries, saving or removing favorites, and manual workout completion. Program start/continue counts activation of the next-workout link, not enrollment or program completion. Outcomes use fixed categories: expected successful response, API failure, transport unknown or invalid success response. Transport unknown can still mean the server saved the action. Validation counts contain no field names or entered values; retries can count again.
• How to read counts: These anonymous counters describe occurrences, not unique people, saved-record totals or matched funnels. Exposures, selections, starts, attempts and outcomes are independently delivered; they cannot establish conversion rates, abandonment, individual journeys or content-to-payment attribution.
• What is absent: Aggregate payloads and counter records contain no account, member, profile, household, person, participant, session, task-record or playback-attempt identifiers, exact event timestamps, task values, health values, check-in answers, note text, search text, error text, URLs, referrers, health details, preferences, demographics, full user agents or IP addresses. The server assigns a broad UTC date. We store counters, not individual event rows or member histories, and do not combine these counters with optional events to construct individual sequences or funnels.
• Request processing: Authentication and hosting/security infrastructure transiently process identity, network information and request times to authorize and protect requests. Requests use authenticated headers, including the selected participant context where needed, to verify legitimate access. Those identities are not written to statistics counters. Existing security rate limiting is separate from statistics. The absence of identifiers in counter records does not mean that no personal information is processed anywhere in delivering the service.
• Your device choice: Turn off basic statistics in Account Security without a popup or consent prompt. This browser preference applies on this device, including other profiles and accounts using this browser; clearing browser storage resets it. Other devices need their own choice. DNT/GPC also stop collection. Switching profiles drops queued observations and requires a fresh eligibility check. Your saved optional analytics permission or refusal is preserved independently; it is never converted into automatic consent or used to backfill basic statistics.
• Retention and limits: Daily counters expire after 90 UTC dates, including today; expired dates are excluded from reports and removed by scheduled cleanup. Global quota counters contain no member identifiers and expire within two days. Very small per-content/provider cells are omitted from reports using occurrence thresholds, not unique-person thresholds. Collection is best effort: delivery can be lost or duplicated, so sums are approximate. Missing observations are unknown, not proof that nothing happened. Past contributions cannot be isolated for individual deletion because aggregate records have no member link. Cloudflare backup copies follow its backup retention.

This purpose applies to new counter observations only. Newly covered actions have no past history in these counters; we do not backfill earlier activity or retroactively reuse optional analytics history. The document date is not proof of a verified collection start. Service records and optional analytics retain their separate purposes and choices below.

Basic signup statistics - October 19, 2026 supplement

Signup pages automatically send anonymous fixed counts of registration eligibility and invitation-check results, validation blocks, authentication request dispatches, accepted or rejected responses, uncertain transport outcomes, and confirmation-pending or session-established results. There is no interrupting consent prompt. These are occurrences, not unique visitors, created accounts or a matched conversion funnel. An accepted response does not prove account creation or email delivery; a session does not prove profile or trial readiness. A transport failure may follow a successful server action, and a ten-second wait may overlap a later result. Counts cannot establish abandonment, server failures or their causes.

The statistics payload contains only a fixed event category. Counters store that category, a fixed source, environment, server UTC day and total. They contain no entered values, field names, names, emails, invitations, tokens, URLs, referrers, raw errors, identity or persistent identifiers, and have no links to accounts, sessions, cohorts or payments. These public statistics requests omit cookies and authentication credentials. Hosting infrastructure still processes network information to deliver the request.

Your choice: Use "Allow basic statistics on this device" near the top of signup, including when registration is unavailable, or the existing basic-statistics setting in Account Security. Both use the same browser preference. Turning it off stops new collection on this page immediately; turning it back on takes effect on the next page load. DNT and Global Privacy Control (GPC), or inability to read browser storage, keep collection off. If saving fails, collection stays off on this page and the page explains that the preference was not saved. The choice applies to this browser, including other accounts using it; clearing storage resets it. Optional account-linked analytics choices remain separate and unchanged.

Retention and limits: Counters are retained for 90 UTC dates including today, excluded from reports after expiry and removed by scheduled cleanup. Anonymous quota counters expire within two days. Delivery is best effort: counts may be blocked, lost, repeated or falsified. Public request limits bound accepted storage, not bot traffic or hosting costs. Missing observations and historical coverage are unknown; there is no historical backfill. Contributions cannot be isolated for individual deletion because counters have no identity link. Cloudflare backups follow their separate retention.

Optional Usage Analytics

We use this information to understand which workouts and features are used, how members move between workouts and coaching, and where navigation or actions may be difficult. These observations can show patterns, but do not establish why someone made a choice, their fitness results, or whether they paid for a service.

• What is included: Page categories; whether search or filters were used and how many results appeared; workout identifiers, player starts, pauses, seeks, endings, errors and reported playback time; coaching-provider selections and availability results; and whether actions such as saving an activity, submitting a check-in, changing a favorite or starting checkout succeeded or failed. We also send event times, temporary session identifiers and the version of your analytics permission.
• What is not included: Your name, email address, search text, private notes, check-in answers, payment details, full page URLs, screen recordings or keystrokes. Your IP address is not stored in optional analytics events. Our hosting and security infrastructure still processes requests to operate and protect the service.
• Identifiers: Events use a pseudonymous identifier generated by HipUp instead of your account ID. This is not anonymous data: HipUp can reproduce the identifier for your account, including to handle a privacy request.
• Who is included: Optional analytics is available only for eligible adult and senior personal member profiles. It is not collected for Kids or Teens profiles, managed household participant profiles, or operator accounts. A parent's permission does not enable it for a child's managed profile.
• Your choice: Collection starts only after you opt in. You can turn optional analytics off in Account Security. Once saved, withdrawal stops optional collection and removes your stored optional events. Older in-flight events cannot restore deleted activity. Your workout progress, bookings, operational and billing records are unaffected.

Retention and deletion: Active optional analytics events are retained for up to 90 days. Expired events are excluded from reports immediately and removed by scheduled cleanup. Withdrawal removes your stored optional events from active analytics storage; if saving or deletion fails, we show an error and retry synchronization on subsequent preference reads or changes. Backup copies may remain until Cloudflare's backup retention expires. This is not a promise of immediate physical erasure from backups. We retain a minimal pseudonymous consent tombstone to prevent stale requests from restoring deleted events; it contains no activity history and is retained while old requests or backups could be replayed. Short-lived abuse-prevention counters survive consent changes and are eligible for scheduled removal after two inactive days. For help or account deletion, contact hipupfitness@gmail.com. We verify account ownership and confirm the status of deletion. This optional analytics process is separate from operational and billing record retention below.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal information from our systems within 30 days, except where we are required to retain certain records for legal or financial compliance purposes (such as billing records, which may be kept for up to 7 years).

Optional feedback after a free trial — October 18, 2026 supplement

Eligible adult account owners may optionally choose a reason for not continuing after a free trial: price, time, workout selection, technical trouble, or other. We store that category (or your choice to skip), the trial and account reference, and the response time to avoid asking again and to understand service improvements. There is no free-text field and no health information is requested. This voluntary feedback is account-linked, not anonymous. Operations reports show grouped response counts; we do not join answers to anonymous workout counters. Respondents do not represent everyone who has not purchased. Answering, skipping or dismissing does not change membership access, signup choices, email preferences or analytics opt-outs. Account data rights and retention above apply.

6. Your Rights

You have the right to:

• Access your data: Request a copy of the personal information we hold about you.
• Delete your account: Contact us to permanently delete your account and associated data.
• Export your data: Request a portable copy of your data.
• Opt out of marketing: Unsubscribe from promotional emails at any time using the link in the email or by contacting us.
• Correct your information: Update your account details from your account settings.
• Control optional analytics: Change your choice in Account Security or request deletion of previously sent analytics at hipupfitness@gmail.com.

To exercise any of these rights, email us at HipUp support.

7. Children's Privacy

HipUp offers a Kids program designed for children ages 6-12. We take children's privacy seriously.

• Account owners must be at least 18. Child and teen participants require an adult parent or legal guardian to own and manage their account or managed profile.
• We collect only the minimum information necessary to provide the service for child users (name and age group).
• The account setup requires the adult account owner to confirm their responsibility and guardian relationship for a minor participant. Basic statistics include legitimate child, teen and managed profiles under the checks described above, without linking counter records to anyone. Optional account-linked analytics remains excluded for minor and managed profiles.
• Parents may review, update, or request deletion of their child's information at any time by contacting us.

8. Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS/TLS) and secure authentication through Supabase. Payment processing is handled through Stripe. While no system is 100% secure, we take reasonable precautions to safeguard your information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email. The "Effective" date at the top of this page will always reflect the most recent version.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at:
HipUp support

Public arrivals and adult task diagnostics: On the public home, pricing and signup pages, fixed daily counters record a visible page lifetime. Reloads may count again. These unlinked occurrences are not unique visitors: no referral URL, query string, invitation code, referrer, account, session or persistent visitor identifier is collected. Explicit adult/senior own-profile requests also contribute fixed anonymous coaching availability, booking, change-request and program-detail load attempt/outcome counts. Program loads do not establish enrollment or completion. Unknown age preferences and child/managed profiles are excluded from these new counters. These observations use the shared device statistics choice, DNT and Global Privacy Control and expire after 90 days. Existing service acceptances remain valid.

Restricted email delivery diagnostics: For eligible adult signup confirmations, trial expiry emails and opted-in workout reminders, we retain minimal provider message references, the existing account reference, email kind and acceptance time. Signup confirmation reporting can begin before an account profile exists only when the authenticated signup request explicitly declares an adult acting for themselves; unknown ages and child or managed profiles are excluded. Signed provider callbacks can add sent, delivered, bounced, delayed, failed, suppressed or complained observations and event and receipt times. Delivery means acceptance by the recipient mail server, not inbox placement or reading. Account confirmation is reported separately. These records are restricted to authorized operations reporting and contain no recipient address, subject, body, token, activation link, raw payload, opens or clicks. Minimal keyed request digests and fixed send states prevent duplicate authentication sends; they cannot recover email content or verification codes. Reporting mappings, authentication send receipts and callbacks expire after 90 days and are removed by bounded scheduled cleanup; mapping deletion also removes its callbacks. The reminder queue retains its separate seven-day cleanup. Operational delivery and send-safety records are separate from optional analytics consent and device statistics choices; stopping reminders prevents future eligible sends without erasing prior delivery evidence. Account deletion requests include these mappings and observations; backups follow their separate retention. Missing callbacks, historical SMTP messages and old reminders without provider references remain unknown.

Authentication request digests are keyed commitments, not stored payloads or verification-code hashes. Non-reportable authentication requests retain only request digests, action, slot, fixed state, attempts and times for duplicate-send prevention; they carry no account key. Account erasure removes mappings and their callbacks and de-links authentication request tombstones, which remain until the original 90-day horizon to prevent a still-valid signed retry from sending again. Signup declaration eligibility is limited to signed explicit adult/self declarations and current exclusions; it is not independently verified age and does not change account access.

Existing evidence reports: Retained coaching audit changes and commercial invoice observations are summarized separately from anonymous counters. Existing optional adult analytics can show profiles observed on multiple UTC days under the same current consent; no new behavior-to-payment linkage is made. These reports do not reconstruct missing history or establish why someone stopped using the service.