Privacy Policy

What the UPeak website and apps collect, why, who sees it, and how to ask us to stop.

Who we are

UPeak ("UPeak", "we", "us") operates the website at upeak.io and is building the UPeak suite of apps: PeakU, PeakVital, PeakBeat, PeakClothes, PeakLook, PeakWatch, PeakVoucher, PeakFinance. This policy covers the website, the waitlist and the apps themselves, including the versions on Google Play: what each one collects, why, who processes it, and what you can do about it. Contact: hello@upeak.io.

What we collect on this site

The website is a static page. It collects data in the places listed below and nowhere else:

1. The waitlist form

When you join the waitlist we receive what you type: your email address (required), your name (optional), the apps you tick and which one you want first, the goal options you tap and anything you write in the "what should it fix first" box, plus the page you submitted from, the time, the first page of your visit and how you reached the site (the referring website's domain, such as google.com, or a campaign tag in the link — never the full address you came from). The form is relayed to our inbox by FormSubmit (formsubmit.co), a form-to-email service that processes the submission in transit and does not keep a copy for us. We keep the email in our inbox and a private waitlist list.

2. Analytics, only if you allow it

Analytics are off until you choose Allow analytics in the cookie banner. Until then no analytics script loads and no analytics cookie is set; if you decline, or your browser sends a Global Privacy Control signal, that stays true. You can change your choice at any time with Cookie settings at the bottom of every page.

With your consent we use Google Analytics 4 to understand which pages and apps people are interested in. It is configured with advertising storage, ad user data and ad personalisation denied, Google Signals off and IP anonymisation on. It records page views and interaction events (for example that a waitlist form was submitted, which apps were ticked and which site the visit came from — never the email address). Google may set first-party cookies (_ga, _ga_*) to tell returning browsers apart.

With the same consent we use Microsoft Clarity to see how the pages actually behave: aggregate heatmaps of where people click and how far they scroll, and session replays of how a visit moved through the site. A replay is a reconstruction of page events — clicks, scrolls, mouse movement, page changes — not a video or recording of your screen, and it captures nothing outside this website. Text you type is masked before it leaves your browser, so what you enter in the waitlist form never reaches Clarity. Clarity receives the same interaction events as Google Analytics, plus your approximate location (country/region from IP), browser, device and referring page, and sets first-party cookies (_clck, _clsk) to tie a session together. Clarity's script also lets Microsoft set its own third-party cookies on clarity.ms (MUID, SM, CLID) and bing.com (MUID, MR, SRM_B), which Microsoft uses to recognise a browser across its services, including for advertising. Microsoft may use the data as described in the Microsoft Privacy Statement.

With the same consent we count page views and a few clicks with PostHog, hosted in the US. It sets no cookies and stores no device id: the only identifier is a random session id kept in your browser's session storage, which the browser deletes when you close the tab, so two visits are never linked to each other or to you. Each event carries only the page path (never the query string), the referring site (its address only, never the page you came from on another site), any campaign tags in the link, and which kind of button or download link you used — never your email, your name, what you type, or the text of what you clicked. Turning on Do Not Track or Global Privacy Control stops it entirely.

3. Hosting logs

The site is served by Vercel, which keeps short-lived request logs (IP address, user agent, URL, time) for security and reliability. Fonts are loaded from Google Fonts, which receives the request for the font files.

4. The chat assistant

The "Ask UPeak" button opens an assistant that answers questions from the copy on this site. When you send a message, your message, the earlier turns of that conversation, the page you are on and your chosen site language are sent to our server and from there to Anthropic, whose Claude model writes the reply. After each reply our server emails us a copy of the conversation so far (through Resend, our email provider), so we can see which questions the site answers badly and fix the page; that copy sits in our inbox like any other email. Before a message is answered, Cloudflare Turnstile checks that a person, not a script, is typing: it looks at your browser and connection, may show a short challenge, and sets no tracking cookie. Your browser keeps the conversation in session storage until you close the tab. Anthropic keeps API inputs and outputs for a limited period for abuse monitoring and does not use them to train its models, as set out in its commercial terms. Do not type personal or health details into the chat; it does not need them to answer, and the waitlist form is the place for your email. The assistant is not a person, a doctor or a financial adviser, and it can be wrong.

We do not run advertising, retargeting or social pixels, we do not sell or share what analytics tells us, and we do not buy data about you from anyone. The one thing we do run that reads like tracking is Clarity's masked session replay, described above, and only with your consent; it exists to fix confusing pages, not to identify you.

Why we use it

To run the beta. Your email and app choices decide which invitation you get and when. Legal basis: the steps you asked us to take before entering the beta (contract), and our legitimate interest in running a small, orderly launch.
To understand demand. Aggregated analytics tell us which apps people want first. Legal basis: your consent, given in the cookie banner and withdrawn the same way; nothing on the site depends on it.
To answer your questions. The chat assistant exists so you can ask about the apps before joining. Legal basis: the steps you ask us to take by using it (contract); nothing is sent unless you type a message and press send.
To find what is confusing. Clarity's heatmaps and masked replays show us which parts of a page people miss or give up on, so we can fix the page rather than guess. Legal basis: your consent, as above.
To keep the site up and safe. Hosting logs. Legal basis: legitimate interest.

We will email you when your beta slot opens and, at most, a handful of times about the beta itself. There is no newsletter. Every email has a way to say stop.

Data inside the apps

This section is the privacy notice for the apps. What follows applies to every app; the list after it says what each app adds. Where a feature is marked optional, nothing described for it happens until you turn it on or tap it.

In every app

An account is optional where the app offers one. You can sign in with an emailed code, with Google, or with Facebook. We receive your email address and, from Google or Facebook, the name the provider shares; we never see your Google or Facebook password.
Usage analytics are anonymous. The apps send PostHog (US-hosted) a short, fixed list of events about which screens and features are used, under a random id made on your device — never your account, your email or a name. They never send what is in a screen: no health readings, no amounts or merchants, no wardrobe items, no email content, no voucher codes, no free text. PostHog sees the IP address of the request and may derive an approximate country from it; PeakFinance asks PostHog not to.
Bug reports leave only when you send one. The report form sends what you write, the app version, the device model and OS, the screens you came through and, if you leave it ticked, recent lines of the app's own log with secrets, email addresses and numbers removed. It is filed in our private issue tracker on GitHub.
AI features are named before they run. Where an app uses Anthropic's Claude, it says so and asks first; it sends the question you ask and the data needed to answer it, and nothing when you do not use the feature.
Deleting your account. Each app that has an account lets you delete it from inside the app; the steps for every app are on the account deletion page, which also covers email requests.
No selling, no advertising use. We do not sell, rent or trade personal data, we show no ads, and we do not use app data for advertising.
Not medical or financial advice. Scores, ages, estimates and coach answers are information, not a diagnosis or regulated advice. See the Terms of Use.

App by app

PeakU (phone and Wear OS). Reads the health and fitness data you allow through Health Connect and the watch's sensors, and your precise location during a run you record, and sends it to the PeakU coach service we run, where it is stored under your account so the coach can plan and answer. PeakU and Health Connect, below, lists every type and what is done with it.
PeakVital (phone and Wear OS). Your profile (age, sex, weight) and test results stay on your phone and watch; they pass between the two over Google Play services' Wear connection and are not sent to us. An account, if you make one, holds only your sign-in.
PeakBeat (phone and Wear OS). Reads the music files on your phone and, with your permission, heart rate, HRV, SpO2, resting heart rate and steps from Health Connect and the watch's sensors, to fit music to your effort. The library and workouts stay on the device. Optional: the cloud library uploads the audio files you choose to our storage on Cloudflare; health sync, where offered, sends those readings to the PeakBeat service; Spotify and YouTube Music open with what you asked to play.
PeakClothes. Your wardrobe photos, items and the body measurements you enter stay on your phone; clothing is recognised on the device. Optional: backup to our cloud storage (Supabase) or to your own Google Drive uploads the whole wardrobe, photos included; virtual try-on sends your body photo and the clothing photos to a Hugging Face-hosted try-on model, after you agree in the app; the weather tip sends the city name you type to Open-Meteo. No device location is used.
PeakVoucher. The wallet — codes, balances, pictures — is stored on your phone. "Stores near me" works out your location on the phone and never sends it. Optional: a backup sheet in your own Google Drive (readable by anyone you share it with, which you control in the app and in Drive); the AI features, after you agree and sign in with Google, send the text or picture you give them, or your wallet list without codes, to Anthropic; a hashed form of your Google id counts your AI use. Price checks send the product links you track.
PeakFinance. The household — transactions, budgets, income, members' names and the rest — is encrypted on the device. The Google Play version has no bank connection: you enter transactions yourself. The personal version's bank sync runs on your own computer with the credentials in its keychain; the app receives transactions, the last four digits of a card and a balance the bank reported, never an account number or a login. Optional: an account syncs the household through Supabase to the members of that household; the Coach, after you agree, sends Anthropic a summary of the household and up to 25 transactions it picked to answer you; backups are files sealed with your passphrase, kept on the phone or in your own Google Drive.
PeakLook. Reads your Microsoft 365 mailbox through Microsoft Graph with your consent, keeps only what it needs to run the sequences you enrol, and never stores your AI keys — they are sent per request and discarded.
PeakWatch. Has no UPeak account; your sessions run on your own relay, and the watch keeps only its pairing token.

PeakU and Health Connect

PeakU is a training and recovery coach. Its daily readiness score, training plan, workout and run logs and coach answers are all computed from the data below, by the PeakU coach service we run. The Android app asks for each Health Connect permission separately, and you can grant some, all or none, and withdraw any of them at any time in Health Connect's settings.

What it reads from Health Connect: Heart rate, resting heart rate, heart rate variability, sleep, steps, distance, calories burned (active and total), exercise sessions and exercise routes, VO2 max, blood oxygen (SpO2), respiratory rate, skin temperature, blood pressure, blood glucose, weight, body fat, height, nutrition and hydration. A route is read only after you approve that session in Health Connect's own dialog. If you allow it, PeakU also reads history older than 30 days, so your baseline is ready on the first day, and reads in the background a few times a day, so the morning score is ready when you open the app.
What it writes to Health Connect: it writes exercise sessions and their routes — the strength workouts and GPS runs you log in PeakU — so your other health apps see them. It writes nothing else.
Limited Use. PeakU uses data from Health Connect only to provide and improve the features you use in the app, and its use of that data follows the Health Connect permissions policy, including the Limited Use requirements. Health Connect data is never sold, never used for advertising or ad targeting, never used to decide creditworthiness or for lending, and never transferred to anyone except the service providers named on this page that run the features for us. No person at UPeak reads it, except with your consent, when it is needed for security (such as investigating abuse), or when the law requires it.
Runs and location: PeakU uses your device's precise location only during a run you start, to record its pace, distance and route; a notification shows for the whole run, and location stops when you end it. It is never read at any other time, and PeakU does not use background location.
Strava and Hevy (optional): if you connect them, PeakU brings your activities from Strava and your workouts from Hevy into your training log. You can disconnect either at any time.
AI (Anthropic): the coach chat sends your question and the training context needed to answer it to Anthropic, which processes it for us; the thread is stored under your account so it persists. A body photo check-in, which you start, is sent to Anthropic for analysis and the estimate comes back; the photo is not stored as a photo on our servers. A meal photo is sent to Anthropic the same way, to estimate the meal.
Sign-in: Supabase runs sign-in by emailed link, Google or Facebook; we receive your email address and, from Google or Facebook, the name on that account.
Usage analytics: PostHog receives a fixed list of screen and feature events under a random id made on your device — never your account, your email or any health reading.
Deletion: delete your account in the app (Settings, then Delete account) or follow the steps on upeak.io/delete-account/peaku/. The account, your synced health data, plans and coach history are deleted from our servers.

Why we use app data. To provide the app you chose and the features you turn on (contract); health data, precise location, photos sent for analysis and AI features only with your explicit consent, which you can withdraw in the app or in Android's settings; anonymous analytics and bug reports to keep the apps working (legitimate interest).

Where it is processed. Several processors below are in the United States, so your data may be processed there as well as in Israel and the EU.

We use the processors below, each for the job described and nothing else. Some are used only by certain apps, or only when you turn a feature on.

FormSubmit relays the waitlist form to our inbox.
Google: Google Analytics, only with your consent; Google Fonts, which receives the request for the font files; Google Translate, only when you pick a language other than English in the language switcher, which then receives the page text to translate it and reads the googtrans cookie that holds your choice; and Google Drive, where apps that offer a backup (for example PeakVoucher's backup sheet) write it to your own Drive, only after you turn the backup on and grant access.
Google sign-in and Meta (Facebook Login), only when you choose to sign in with them; and Google Play services, which carries data between a phone and its paired watch.
Strava and Hevy, only if you connect them in PeakU; Spotify and YouTube Music, when PeakBeat opens them for you.
Hugging Face, which hosts the try-on model PeakClothes uses, only for a try-on you start; and Open-Meteo, which receives the city name for a weather tip.
Upstash, which keeps PeakVoucher's AI usage counters under a hashed id.
Fly.io, which may host parts of the PeakU coach service.
Microsoft: Clarity heatmaps and session replay, only with your consent; and Microsoft Graph, which PeakLook uses to reach your Microsoft 365 mailbox with your permission.
PostHog, hosted in the US, counts page views and a few clicks, only with your consent and without cookies or a device id.
Vercel hosts this website, the feedback relay at upeak.io/api/feedback and some app backends (including the PeakU coach service and PeakVoucher's AI service), and keeps short-lived request logs.
GitHub holds the private issue tracker. When you send a bug report or feature request from inside an app, the feedback relay files it there as an issue, with secrets, email addresses and phone numbers removed from the text, plus any contact details you choose to add to the report.
Anthropic (the Claude API): the chat assistant sends your messages to it to generate each reply (see above); and, optionally, when it is switched on, the feedback relay sends the already-redacted text of a report to Anthropic to draft the issue summary; without it, a fixed template is used. Apps with AI features send Anthropic the question you ask and the data needed to answer it.
Supabase runs sign-in (authentication), the cloud database and cloud backups for the apps that have an account, so it holds your account email and the data that app syncs or backs up.
Resend sends email from upeak.io addresses, including sign-in and confirmation emails and our replies to you.
Cloudflare runs the DNS and the email routing for upeak.io, so mail you send to hello@upeak.io passes through it; runs the Turnstile human check in front of the chat assistant; and hosts parts of some app backends, including PeakBeat's cloud library.
Sentry, for crash reports from the PeakU coach service and, where an app build enables it, the app: error type, stack and device facts, never your data.
The email provider that holds our inbox.

We may disclose data if the law requires it, or to protect the rights and safety of users. If UPeak is ever acquired, your data moves with the service under this policy, and we will tell you.

How long we keep it

Waitlist data: until the beta ends or you ask us to remove you, whichever is first, and in any case no longer than 24 months after your last contact.
Analytics: Google Analytics event data is retained for 14 months, then aggregated. Microsoft Clarity keeps recordings and heatmap data for 13 months (30 days on its free tier for individual recordings), then deletes them. PostHog usage events are anonymous and are kept for the retention period of our PostHog plan, then deleted.
Hosting logs: retained by Vercel for a short rolling window.
App data on your device: until you delete it in the app or uninstall the app.
App accounts and the data synced or backed up to them: while the account exists. When you delete the account, we delete it and its data from our servers; encrypted infrastructure backups roll over within 30 days. PeakU keeps a security record of the deletion (that it happened, not your data) for up to 12 months.
Bug reports: in our private issue tracker until the issue is resolved; ask us and we remove a report.
Chat messages: the emailed copy stays in our inbox until we have acted on it, and no longer than 24 months; your browser keeps the conversation until the tab closes, and Anthropic for its limited abuse-monitoring window.

Your rights

Wherever you are, you can ask us to access, correct, export or delete the data we hold about you, to object to processing based on legitimate interest, and to withdraw consent at any time. Email hello@upeak.io from the address you signed up with; we answer within 30 days and usually much sooner. If you are in the EU/EEA or UK you also have the right to complain to your data protection authority. If you are in California, we do not sell or share personal information as defined by the CCPA, and we honour the rights above regardless of where you live.

Cookies

The site sets no cookies of its own, and no analytics cookie is set unless you choose Allow analytics. Your choice itself is kept in your browser's local storage (upeak_consent), not in a cookie. The chat assistant keeps your conversation in session storage, not a cookie, and it is gone when the tab closes. PostHog sets no cookie at all; with your consent it keeps one random session id in session storage, which ends with the tab. The language switcher sets a googtrans cookie (first-party, on upeak.io, for the browser session) only when you pick a language other than English; it holds your choice so Google Translate can show the page in that language, and picking English again removes it.

If you allow analytics, these are set:

Google Analytics (first-party, on upeak.io): _ga, _ga_*, to tell returning browsers apart; up to 2 years.
Microsoft Clarity (first-party, on upeak.io): _clck (up to 1 year) and _clsk (1 day), to tie a visit together.
Microsoft (third-party, set by Clarity's script): MUID, SM and CLID on clarity.ms, and MUID, MR and SRM_B on bing.com. Microsoft uses them to recognise a browser across its own services, including for advertising, under the Microsoft Privacy Statement.

To withdraw consent, open Cookie settings at the bottom of any page and choose Decline; we stop loading the tags and remove the first-party cookies we can reach. Third-party cookies on clarity.ms and bing.com can only be cleared in your browser. The waitlist form uses no cookies, and the site works the same whatever you choose.

Children

The site, the beta and the apps are for adults and are not directed at children. We do not knowingly collect data from anyone under 16; if you believe a child has joined the waitlist or uses an app, tell us and we will delete the data.

Changes to this policy

We will update this page when the facts change — for example when an app adds a feature that sends data somewhere new, or if we add a processor. The date at the top tells you when. Material changes to how we use waitlist data will be announced by email before they take effect.