Privacy Policy

Version 1.0 Effective date: 09/15/2026 Last updated: 09/15/2026

Applies to: the UpFro iOS, Android and Web application, the UpFro Apple Watch application, UpFro widgets and Live Activities, and the UpFro website (together, the “Service”).

Table of Contents

1. Overview

2. Who We Are and How to Contact Us

3. Scope of This Policy

4. Information We Collect

5. Sensitive Information

6. Your Consent

7. Basis for Processing

8. Artificial Intelligence Features

9. Information Visible to Other Users

10. How We Share Information

11. Where Information Is Stored

12. Retention and Deletion

13. Security

14. Data Breach Notification

15. Your Rights

16. How to Exercise Your Rights

17. Region-Specific Information

18. Children

19. Apple Health Commitments

20. What We Do Not Do

21. Changes to This Policy

22. How to Contact Us

1. Overview

This Overview is provided for convenience. It summarizes but does not replace the remainder of this Privacy Policy.

UpFro is a wellness and habit-tracking application. It is not a medical service, and no part of it constitutes medical advice, diagnosis, or treatment.

The habits, goals, tasks, journal entries, mood entries, and voice recordings you create in the Service belong to you. We store them in order to operate the Service across your devices. We do not sell personal information. We do not use personal information for advertising, and we do not display advertising.

Certain information you provide is sensitive. Mood entries, written reflections, voice recordings, and information read from Apple Health may reveal your physical or mental health status. We treat this information as sensitive and use it only to provide the features you elect to use.

Creating an account requires your agreement to this Privacy Policy. At registration you must check a single box reading “I agree to the Terms of Use and Privacy Policy.” Your agreement covers all processing described in this Privacy Policy, including processing of mood entries, written reflections, voice recordings, and any Apple Health information you connect. Apart from the AI features, which ask for your separate yes (see Section 8.1), this is a single consent rather than a set of per-feature consents. Withdrawal is effected by deleting your account. See Section 6.

Information read from Apple Health remains on your device. Step counts, sleep data, heart rate, heart rate variability, and mindfulness minutes are processed on your iPhone and are not transmitted to our servers.

The AI features are powered by OpenAI and stay off until you say yes. When you use one, only what it needs is sent to OpenAI, and never your journal or reflection words, voice recordings or Apple Health information. Display names and circle names are also checked with OpenAI’s moderation tool, for everyone’s safety. See Section 8.

You may delete your account within the Service at Settings, then Delete Account. A thirty-day recovery window applies, after which your information is permanently erased.

Information is stored and processed in the United States.

2. Who We Are and How to Contact Us

The Service is provided by:

We are the controller of the personal information described in this Privacy Policy, meaning that we determine the purposes and means of its processing.

We have not appointed a Data Protection Officer. Based on the current scale and nature of our processing, we have assessed that no such appointment is required. Privacy inquiries should be directed to support@upfro.app.

3. Scope of This Policy

This Privacy Policy applies to the UpFro iOS, Android and Web application, the UpFro Apple Watch application, UpFro widgets and Live Activities, and the UpFro website.

This Privacy Policy does not apply to:

• Apple. Your App Store purchases, your Apple ID, Sign in with Apple, your Apple Health information prior to its receipt by the Service, and Apple’s push notification service are governed by Apple’s privacy policy.

• Third-party destinations. If you follow a link out of the Service, the destination operates under its own privacy policy.

The Service is offered in the United States and in other territories in which we make it available through the App Store. It is not offered to residents of the European Economic Area, the United Kingdom, or Switzerland.

4. Information We Collect

4.1 Account and Identity Information

We do not request your date of birth.

4.2 Content You Create

All content you create within the Service constitutes personal information about you. This includes:

• Habits and trackers, including titles, notes, icons, colors, schedules, reminder times, streaks, completion history, and daily check-ins

• Goals and milestones, including titles, descriptions, motivations, target dates, cover images, progress records, and attached notes

• Tasks, including titles, due dates and times, priorities, recurrence rules, and associations with goals

• Reflections and journal entries, addressed in Section 4.3

• Focus sessions, including start and end times, durations, associated subjects, and soundscape selections

• Rituals, including names, steps, and session records

• Challenges, including participation, progress, associated reflections, and challenges you create and submit

• Future letters, including their content and scheduled delivery dates

• Habit library and stacking selections

This information is processed in order to provide the Service.

4.3 Health, Mood, and Voice Information

The following categories may reveal your physical or mental health status and are treated as sensitive information under Section 5.

Processing of voice journal recordings. When you record a voice journal entry, transcription is performed on your device. The Service requires Apple’s on-device speech recognizer for this feature, and the audio is therefore not transmitted to Apple for transcription. The audio file is uploaded to our storage, into a private location accessible only to your account, so that your recordings persist across devices.

Other voice input. If you dictate into the AI Coach or use voice quick-add, those features use standard speech recognition, which may transmit your speech to Apple for transcription. Apple’s handling of that audio is governed by Apple’s privacy policy. If you prefer that speech not be transmitted, you may type instead.

On-device safety screening. During coach-led onboarding, text you enter is screened on your device for indicators of self-harm, abuse, disordered eating, substance use, or acute mental-health distress. Where an indicator is detected, your text is not transmitted to the artificial intelligence provider and is not transmitted to us; supportive content is displayed instead; and a record of the category and time, but not of your text, is written to your device so that the prompt is not repeated. This record is stored within the application’s files with iOS file protection enabled and is excluded from your device backups, including iCloud backups, so that it remains on the device on which it was created.

Second screen by the model. The on-device screen recognizes vocabulary in a limited set of languages. Where it detects no indicator, and only if you said yes to the AI coach on the first onboarding page, your text is transmitted to OpenAI as part of the onboarding exchange, and the model applies a second screen for the same indicators in any language. Where the model identifies one, it returns a flag rather than coaching content, supportive content is displayed, and a record of the category and time, but not of your text, is written to your device as described above.

This screening operates during onboarding. It does not operate within the main AI Coach conversation.

4.4 Apple Health

If you enable Health synchronization and grant permission, the Service reads the following from Apple Health:

• Step count

• Active energy burned

• Walking and running distance

• Heart rate

• Heart rate variability

• Resting heart rate

• Exercise time

• Sleeping wrist temperature

• Sleep analysis

• Mindful sessions

The Service writes only mindful session records, and only upon your completion of a focus or mindfulness session.

This information does not leave your device. It is read from Apple Health on your iPhone, processed on your iPhone to generate insights and correlations within the Service and, where you create a rule to that effect, to mark a habit complete once a figure you choose is reached, and is not uploaded to our servers, not disclosed to any third party, and not transmitted to any artificial intelligence provider. Your Health permissions are stored as a local preference on your device.

You may disable Health synchronization at any time within the Service, or revoke access entirely within Apple’s Health application.

4.5 Social Features

If you use partners, circles, the activity feed, challenges, or leaderboards:

• Your display name and profile image are visible to users with whom you are connected.

• Quantitative progress information, including completion percentages, streak lengths, and points, is shared with your partner, your circles, and challenge leaderboards.

• Titles are removed. Our servers strip habit names, goal names, milestone names, and challenge names from activity feed entries before other users can view them. Other users see that you completed an item, not what the item was.

• Messages you send to a partner, and reflections you attach to a shared challenge, are visible to the recipients.

• Reports and blocks are recorded as described in Section 4.11.

See Section 9 for a complete description of visibility.

4.6 Subscription Information

We do not receive your payment details. Purchases made on iPhone, iPad, and Apple Watch are processed by Apple. Apple is the merchant of record. Your payment card, banking details, and billing address are provided to Apple and are not provided to us.

We receive and store:

• Whether an active premium entitlement exists, and the applicable plan

• Trial status, renewal dates, and whether a subscription has lapsed or been cancelled

• Purchase and renewal event records received from our subscription management provider, including the event payload transmitted to us

• An internal subscription identifier, which corresponds to your account identifier

4.7 Device, Diagnostic, and Analytics Information

We use two categories of service provider to maintain the Service. Neither displays advertising and neither tracks you across other applications or websites.

Crash and error reporting. Upon a crash or error, we receive a technical report comprising the error, its location within the code, the application version, the operating system version, and the device model. This reporting is configured not to transmit personal information and is not associated with your account.

Product analytics. We record screen and feature usage in order to prioritize improvements. Events are transmitted with an unstable, non-reversible value derived from your account identifier rather than the identifier itself. This value changes between application launches and cannot be used to construct a profile or to identify you.

Server logs. Our backend systems maintain operational logs. Certain of these record the first eight characters of an account identifier for the purpose of diagnosing individual requests. Authentication records include your IP address and device or browser user agent.

Diagnostic reports. If you elect to submit a diagnostic report from Settings, the application assembles recent logs and application state. Prior to transmission, the application performs a redaction pass removing email addresses, identifiers, tokens, and telephone numbers.

4.8 Notifications

If you permit notifications:

• We store a push token for your device in order that Apple may deliver notifications to it.

• We store your notification preferences, including selected categories, quiet hours, frequency limits, and per-habit reminder times.

• We store the notifications queued and delivered to you, including their rendered text.

Notice regarding notification content. Notification text may contain the names of your habits, goals, tasks, or milestones. iOS displays notification text on the lock screen unless you configure it otherwise. If you prefer that such text not be displayed, enable Settings, then Notifications, then Show Previews, then When Unlocked or Never within iOS, or disable the relevant categories within the Service.

Delivery records, undeliverable notification records, and message center entries may contain that same rendered text on our servers.

4.9 Identifiers

We do not use the Advertising Identifier. We do not request App Tracking Transparency authorization, because we do not track you.

4.10 Settings and Preferences

We store your application settings on your account so that they persist across devices. These include theme and accent color, notification settings, privacy settings, AI coach settings, general settings such as week start and language, focus timer settings, reminder schedules, and vacation periods.

Certain preferences are stored on your device rather than on your account, because they describe that device. These comprise whether the app lock is enabled and its delay, and the habit associated with any NFC tag you write. Where you enable the app lock, the comparison is performed by iOS and we receive only its result; we do not receive or store biometric information.

4.11 Safety and Moderation Records

In order to maintain the safety of social features, we retain:

• Reports submitted by you or concerning you, including the stated reason, any detail provided, a snapshot of the reported content, and our handling notes

• Blocks, including the parties involved and the reason code

• Automated moderation checks performed on text submitted through social and notification features, including a one-way hash of the text, the classifier response, and any action taken

• Moderation restrictions applied to an account

These records are retained in order to protect users and to establish, exercise, or defend legal claims. Certain of these records survive account deletion in de-identified form, as described in Section 12.

4.12 Cookies and Similar Technologies

The iOS and Apple Watch applications are not web pages and do not use cookies. What they store on your device is described elsewhere in this Section 4.

Our website. The website at www.upfro.app sets no cookies and writes nothing to local storage or session storage. It uses a page-view measurement provided by our website hosting platform, which records that a page was viewed without setting a cookie, storing an identifier on your device, or following you to other websites. The website carries a Cookie settings control permitting you to switch that measurement off. Switching it off stores a single preference on your device so that the choice survives to your next visit; that preference is not an identifier and is not transmitted to us.

Our web application. The web application at app.upfro.app sets authentication cookies through our database and authentication provider, in order to keep you signed in and to refresh your session. It additionally stores interface preferences, including appearance, language, week start day, focus timer state, and sound selection, in your browser’s local storage. Both are strictly necessary: removing the authentication cookies signs you out, and removing the preference storage returns the application to its default settings.

We use no advertising or marketing cookies, no cross-site tracking, no tracking pixels, and no social media tracking buttons on either.

The Cookie Policy describes each of these in full, together with the means of controlling them.

5. Sensitive Information

Certain information processed by the Service constitutes sensitive information or consumer health data under applicable United States state law.

Information we treat as sensitive:

• Mood and energy ratings

• Written reflections, journal entries, and daily check-in responses

• Voice journal recordings and transcripts

• Mindfulness, sleep, activity, and heart-rate information read from Apple Health

• The on-device safety categories described in Section 4.3

How we treat it:

1. Each such feature is optional and inactive until enabled by you. The core of the Service, comprising habits, goals, tasks, and streaks, operates without mood tracking, journaling, voice recording, or Health synchronization. Your agreement to this Privacy Policy does not obligate you to use any of these features; it governs the processing that occurs if you do.

2. We rely on your consent, which is obtained once, at registration. A single acknowledgment covers this Privacy Policy in its entirety, including all sensitive categories identified above. The Service does not request consent again at the point a feature is enabled and does not provide per-feature consent controls. Section 6 describes the consent and the record we retain of it.

3. Withdrawal is not partial. You may discontinue use of any feature at any time, revoke any device permission within iOS Settings, and delete individual entries. These are product controls. They prevent the creation of further information but do not by themselves constitute withdrawal of consent and do not delete information already stored. Consent is withdrawn by deleting your account.

4. We do not sell sensitive information.

5. We do not use sensitive information for advertising, marketing, or profiling for the benefit of any third party.

6. We do not infer emotional state from biometric signals. Mood within the Service is always self-reported. We do not analyze voice tone, facial imagery, or heart rate to infer emotional state.

6. Your Consent

6.1 What You Agree To

Upon creating an account, you must check a single box reading:

“I agree to the Terms of Use and Privacy Policy.”

Checking that box constitutes your agreement to all processing described in this Privacy Policy, including processing of:

• your mood and energy ratings;

• your written reflections, journal entries, gratitude entries, and daily check-in responses;

• your voice journal recordings and their transcripts;

• any Apple Health information you elect to connect, comprising activity, sleep, heart rate, heart rate variability, and mindfulness data, which is processed on your device as described in Section 4.4;

• the wellness patterns computed from the foregoing; and

• all other processing described in Section 4, including visibility to other users under Section 9. Transmissions to OpenAI for the AI features are not covered by this box: they need your separate yes, described in Section 8.1.

A substantial portion of the foregoing constitutes sensitive information. Section 5 describes its treatment.

Agreement does not obligate use. You may maintain an account and never record a reflection, never record voice audio, and never connect Apple Health. The consent governs processing that occurs if and when you elect to use those features.

6.2 Consent Is Required

An account cannot be created without checking the box. The requirement applies on both registration surfaces and governs both registration methods, comprising email and password registration and Sign in with Apple.

6.3 Consent Is Not Granular

The Service does not provide per-feature consent. There is no separate consent for mood tracking, journaling, voice recording, or Apple Health, and there is no interface permitting agreement to some processing described in this Privacy Policy and refusal of the remainder.

The device permission prompts presented by iOS, comprising microphone, speech recognition, Health, notifications, and photo library, are Apple permissions governing application access to your device. They may be refused or revoked at any time. They do not constitute a consent mechanism for our processing, and refusal of any one of them does not constitute partial withdrawal of the consent described in this Section.

6.4 Record of Acceptance

Upon your acceptance and the creation of your account, a record is written to our database comprising:

• the fact of acceptance;

• the date and time of acceptance, as recorded by your device;

• the version of this Privacy Policy accepted;

• the version of the Terms of Use accepted;

• the application version and build number in use;

• the platform in use;

• the language and region setting of your device; and

• the surface on which acceptance occurred.

The record contains no content drawn from your journal entries, mood entries, recordings, or health information.

These records are append-only. Records are added and are never edited or deleted while your account exists.

You may view your own record within the Service, in Settings. The record is a receipt and not a control; it contains no setting to alter.

6.5 Withdrawal of Consent

Withdrawal is not partial. Consent cannot be withdrawn for mood entries while journaling continues, or withdrawn for voice recordings while Apple Health synchronization continues. The Service provides no such mechanism.

Consent is withdrawn by deleting your account. You may do so at any time within the Service, at Settings, then Delete Account. Re-authentication is required. Your account is marked for deletion immediately, a thirty-day recovery period applies, and your information is permanently erased thereafter. Section 12 describes the process in full.

Separately from withdrawal, you may delete individual items, including any habit, goal, task, reflection, voice recording, or focus session, within the Service at any time.

6.6 Changes to This Policy

Where we make a material change, we will notify you, and where required by applicable law we will request your acceptance again. A subsequent acceptance writes a new record bearing the new version and a new timestamp. The prior record is preserved without alteration.

7. Basis for Processing

We process personal information on the following bases.

Where consent is identified above, that consent is the acknowledgment described in Section 6.

8. AI Features (powered by OpenAI)

UpFro’s AI features are powered by OpenAI. They are software, not a person.

8.1 We Ask First

The AI features are off until you say yes. The UpFro app asks when you join, and you can change your answer at any time in Settings › AI Coach. Until you say yes, nothing about you is sent to OpenAI for them. We keep a record of your answers (yes, no or withdrawn, when, the wording you saw and the kind of device).

8.2 What Is Sent, and When

Information goes to OpenAI only when you use an AI feature, and only what that feature needs to answer you. The safety check on names (Section 8.5) is the one exception.

Your name is included only when “Use My Name” is on in Settings › AI Coach. During sign-up, the onboarding coach sends only what you type (Section 4.3).

8.3 Never Sent

Your journal and reflection words, voice recordings, Apple Health data, calendar, email address, password and payment details are never sent.

8.4 How OpenAI Handles It

OpenAI uses what we send only to answer you, never to train its models, and may keep it for up to 30 days to detect abuse before deleting it.

8.5 Safety Check on Names

Names and messages you share with others are always checked by UpFro before others see them. For everyone’s safety, display names and circle names are also checked with OpenAI’s moderation tool when you save them, even if the AI features are off. Only the name is sent.

8.6 Good to Know

AI answers can be wrong and are not medical or other professional advice. If you are unwell or in crisis, contact a professional or your local emergency services. No decision with legal or similarly significant effects is made about you automatically. The crisis check in Section 4.3 runs during sign-up only. Please don’t enter other people’s personal details.

8.7 Legal Basis

The AI features rely on your explicit consent (GDPR Article 6(1)(a), and Article 9(2)(a) for mood). Turning them off withdraws it: nothing new is sent from then on, but earlier processing is not undone. The safety check on names relies on our legitimate interest in keeping the community safe (Article 6(1)(f)).

9. Information Visible to Other Users

Your privacy settings permit control of activity visibility. You may also block another user, which prevents mutual visibility.

10. How We Share Information

We do not sell personal information. We have not sold personal information. We do not share personal information for advertising purposes.

We engage the following categories of service provider. Each is bound by contract to process information solely on our instructions and for no independent purpose.

We additionally interact with Apple in its capacity as platform operator. Apple receives your purchase and billing details as merchant of record, your Apple identity token where you use Sign in with Apple, push notification content including any habit or goal name contained within it, and speech dictated into the AI Coach or quick-add. Apple’s handling of that information is governed by Apple’s privacy policy.

We may also disclose personal information:

• To comply with law, in response to a valid court order, subpoena, or regulatory demand. We will notify you unless legally prohibited from doing so.

• To protect persons, where we reasonably believe disclosure necessary to prevent serious harm, fraud, or a threat to safety.

• In connection with a business transfer, including a sale, merger, or acquisition of assets, in which case personal information may transfer to the acquiring party. The acquiring party will be bound by this Privacy Policy, and we will notify you before any change takes effect.

11. Where Information Is Stored

Personal information is stored and processed in the United States.

If you access the Service from outside the United States, your information is transferred to and processed in the United States, which may not afford the same legal protections as your jurisdiction of residence. By using the Service, you acknowledge that transfer.

We maintain contractual data processing terms with each service provider identified in Section 10, and we apply encryption in transit and at rest together with access controls.

OpenAI processes requests for the AI features and the name safety check in the United States.

12. Retention and Deletion

12.1 While Your Account Remains Open

We retain your content for the duration of your account, as historical records and streaks constitute core functionality of the Service.

12.2 Account Deletion

Account deletion is available within the Service, at Settings, then Delete Account. The process operates as follows:

1. Identity verification. You re-enter your password, or re-authenticate with Apple where you registered by that method. We do not process deletion on an unverified request.

2. Immediate suspension. Your account is marked for deletion and access is withdrawn. A permanent purge is scheduled for thirty days thereafter.

3. Revocation. Where you registered through Sign in with Apple, we revoke that connection on our servers.

4. Recovery period. During the thirty-day period you may cancel the deletion within the Service, and your account is restored in full. No information has been destroyed during this period.

5. Permanent deletion. After thirty days, an automated process permanently deletes your account and associated information, comprising habits, goals, tasks, reflections, mood entries, voice recordings, focus sessions, rituals, challenge participation, social connections, settings, and notification records.

12.3 Deletion as Withdrawal of Consent

Account deletion constitutes the sole mechanism for withdrawal of the consent described in Section 6. No partial withdrawal is available.

• Disabling a feature or revoking a device permission within iOS Settings is a product control. It prevents the creation of further information of that category. It does not withdraw consent and does not delete information already stored.

• Deletion of individual items removes those items and does not constitute withdrawal of consent.

• Withdrawal is not retroactive. It does not render processing prior to withdrawal unlawful, and a limited set of records survives the purge in the de-identified form described below.

Your acceptance records are deleted together with your account, by the same thirty-day purge. We retain no record of your acceptance after your account is deleted.

12.4 Records Surviving Deletion

A limited set of records is retained following the purge, with identifying information removed such that the records can no longer be associated with you:

• Abuse reports you submitted, so that a report concerning another user is not lost upon your departure

• Moderation actions and social event records, with the acting account identifier removed

• Notification audit and campaign records, without an associated account

• Transaction and tax records, retained as required by law. Apple maintains the payment record; we retain the minimum necessary for accounting purposes

12.5 Backups

We maintain daily backup copies of our database. Each copy is retained for seven days before being overwritten.

Upon deletion of your account, your information is removed from our live database at the conclusion of the thirty-day period described above. A copy may persist within a backup for up to a further seven days before that backup is overwritten. We do not restore deleted accounts from backups.

12.6 Retention Periods

12.7 Deletion of Individual Items

You may delete any individual habit, goal, task, reflection, voice recording, or focus session within the Service at any time. Deletion of a goal also deletes habits and tasks associated with it. Deletion of individual items does not constitute withdrawal of consent.

13. Security

We apply the following measures:

• Encryption in transit, using HTTPS and TLS for all communication between your device and our servers, and encryption at rest for our database and file storage.

• Row-level access control within the database, such that a query can reach only records belonging to the account issuing it.

• Private storage. Voice recordings and images are not publicly readable. Access is provided through short-lived signed links issued only to the account owner.

• On-device file protection. The local database and voice recordings use iOS file protection, and are excluded from device backups.

• Re-authentication prior to destructive operations, including account deletion.

• Automated moderation of text submitted through social and notification features.

• No payment data. We do not hold payment card details.

We ask that you use a strong and unique password, maintain device security, and notify us promptly at support@upfro.app if you believe your account has been accessed without authorization.

No system is entirely secure. We cannot guarantee that our security measures will not be defeated.

14. Data Breach Notification

In the event of a breach of personal information, we will:

• investigate promptly and take steps to contain the breach;

• notify the United States Federal Trade Commission and affected individuals where the Health Breach Notification Rule applies, without unreasonable delay and in any event within sixty days;

• notify affected individuals directly, without undue delay, where the breach is likely to result in a significant risk to those individuals, which we presume in respect of any breach involving mood, journal, voice, or health information; and

• notify state attorneys general and other authorities as required by applicable law.

We will describe what occurred, the categories of information involved, the measures taken in response, and the steps you should take.

15. Your Rights

We extend the following to all users, irrespective of location, except where verification of identity is not possible:

• Access. Obtain a copy of the personal information we hold about you.

• Correction. Correct inaccurate information. Most information is editable within the Service.

• Deletion. Delete your account and associated information as described in Section 12, or delete individual items within the Service.

• Withdrawal of consent. Withdraw the consent described in Section 6 by deleting your account. No partial withdrawal is available, as the Service provides no per-feature consent controls. You may discontinue use of any optional feature and revoke any device permission within iOS Settings; these are product controls rather than withdrawal of consent.

• Opt out of marketing. Unsubscribe from marketing email, or disable notification categories within Settings.

• Non-discrimination. We will not treat you differently for exercising any right.

Data portability. The Service includes a premium Data Export feature exporting insights reports in CSV and PDF format. That export covers habit, task, and completion analytics. It does not include reflections, journal text, voice recordings, or AI Coach messages. Where you require a complete copy of your information, contact support@upfro.app and we will compile one.

16. How to Exercise Your Rights

Submit requests to support@upfro.app.

• We will acknowledge within five business days and respond within thirty days. Where a request is complex, we may extend by up to two further months and will notify you of the extension and its reasons within the first month.

• No fee applies. We may charge a reasonable fee, or decline a request, only where the request is manifestly unfounded, excessive, or repetitive.

• We will verify your identity before acting. Verification ordinarily requires a response from the email address associated with the account, or confirmation of a detail known only to the account holder. Deletion performed within the Service re-authenticates you directly.

• You may use an authorized agent where applicable law permits. We will require proof of authority and may verify your identity directly.

• Where we decline a request, we will state the reason and the means of challenging the decision. To appeal, reply to our decision with the word “Appeal.” We will review and respond within forty-five days.

For account deletion, the most direct route is within the Service, at Settings, then Delete Account.

Complaints. If you are dissatisfied with our handling of your information, contact support@upfro.app. We will acknowledge within thirty days and respond substantively as promptly as practicable. You may also contact the applicable regulatory authority.

17. Region-Specific Information

17.1 Washington State: Consumer Health Data

This Section applies to residents of Washington State and to any person whose consumer health data is collected in Washington State.

Consumer health data collected. Information identifying your past, present, or future physical or mental health status, comprising:

• mood and energy ratings you record;

• written reflections, journal entries, and daily check-in responses;

• voice journal recordings and transcripts;

• bodily functions and vital signs read from Apple Health where you enable that feature, comprising step count, active energy, walking and running distance, heart rate, heart rate variability, resting heart rate, exercise time, sleeping wrist temperature, sleep analysis, and mindful sessions;

• mindfulness and focus minutes;

• wellness inferences derived from the foregoing, including mood averages and trends; and

Sources. All such information originates from you, whether directly through entry, recording, or rating, or from Apple Health with your permission, or is derived by us from information you provided.

Purposes. Such information is collected solely to provide the features you have enabled, comprising journaling and mood tracking, health and habit correlation, and, only with your separate yes, AI coaching responses and summaries. It is not used for advertising or marketing.

Recipients. For the categories that leave your device:

We do not sell consumer health data. We have not sold consumer health data and will not do so. We collect no authorization to sell, because none is required.

Your rights under the Act:

• Confirmation and access. Confirm whether we collect, share, or sell your consumer health data and obtain access to it, including a list of all third parties and affiliates to which it has been shared or sold, together with an active contact for each.

• Withdrawal of consent to collection and sharing. Within the Service, withdrawal is effected by deleting your account, as no per-feature withdrawal is available. Where you wish to withdraw without deleting your account, contact support@upfro.app and we will action the request manually.

• Deletion. Upon your deletion request we will delete such information from our records, including archived and backup systems, and will direct our service providers to do the same, within thirty days.

Exercising these rights. Submit requests to support@upfro.app bearing the subject line “Washington consumer health data request.” We will respond within forty-five days and may extend once by a further forty-five days where reasonably necessary, in which case we will notify you within the initial period. Where a request is denied, you may appeal by replying with the word “Appeal”; we will respond within forty-five days. Where an appeal is denied, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Consent. Consent is obtained once, at registration, through the single required acknowledgment described in Section 6, which links to this Privacy Policy. We do not request consent a second time prior to collecting consumer health data, and we do not request separate consent prior to sharing it with the service providers identified above. The Service contains no separate consumer health data consent screen and no per-feature control.

17.2 Nevada

Nevada residents hold equivalent rights in respect of consumer health data under Nevada Senate Bill 370. Section 17.1 applies in its entirety, including our commitment that we do not sell consumer health data. The same contact address and request process apply. Nevada residents may additionally contact the Nevada Attorney General.

17.3 California

Applicability. The Service is presently below each applicability threshold of the California Consumer Privacy Act as amended by the California Privacy Rights Act. We do not exceed the revenue threshold, we do not process the personal information of 100,000 or more California consumers or households, and we derive no revenue from the sale or sharing of personal information. We therefore do not represent that we are a “business” subject to that Act.

Rights extended as a matter of practice:

• We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as defined by that Act. We provide no “Do Not Sell or Share” link, as there is no such activity from which to opt out.

• We do not use or disclose sensitive personal information for any purpose other than those described in this Privacy Policy.

• You may request access to, correction of, and deletion of personal information under Section 16, on the same terms as all other users.

• We will not discriminate against you for exercising a right.

• We do not knowingly sell the personal information of any person under sixteen, as we do not sell personal information.

17.4 Other United States Jurisdictions

Comprehensive state privacy statutes, including those of Virginia, Colorado, Connecticut, Utah, Oregon, Montana, and Texas, apply above thresholds the Service presently does not meet. We nonetheless extend the rights described in Section 15 to all users.

Irrespective of threshold, Texas and Nebraska prohibit the sale of sensitive personal data, including health data and precise geolocation, without consent. We do not sell any personal information, and accordingly this prohibition is not engaged.

17.5 Canada

We rely on your express, opt-in consent in respect of health information and other sensitive information. That consent is the acknowledgment described in Section 6. It is required, it is not subdivided by feature, and it is withdrawn by deleting your account. You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of Quebec additionally hold rights of portability and de-indexing under Law 25.

17.6 Brazil

Health information constitutes sensitive personal data under the Lei Geral de Proteção de Dados. Consent is obtained through the single acknowledgment described in Section 6, which expressly identifies the sensitive categories processed. You hold rights of confirmation, access, correction, anonymization, portability, deletion, information regarding sharing, and withdrawal of consent. Withdrawal is effected by deleting your account or by contacting support@upfro.app. You may complain to the Autoridade Nacional de Proteção de Dados. Requests under that statute should be directed to support@upfro.app.

17.7 Australia

We handle health information in accordance with the Australian Privacy Principles. You may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

17.8 Japan, South Korea, and India

• Japan. Health information constitutes special care-required personal information under the Act on the Protection of Personal Information. We rely on your opt-in consent as described in Section 6. Cross-border transfers are made to the United States, and you may request information regarding the data protection regime applicable there.

• South Korea. Consent in respect of sensitive information is obtained through the single acknowledgment described in Section 6, which expressly identifies the sensitive categories processed. The Service does not provide a separate consent step for sensitive information. We will notify the Personal Information Protection Commission and affected users of a breach within seventy-two hours.

• India. The substantive obligations of the Digital Personal Data Protection Act apply from 13 May 2027. We will update this Privacy Policy before that date. Under that Act, a “child” is any person under eighteen years of age.

18. Children

The Service is not directed to children. You must be at least 13 years of age to use the Service.

• We do not knowingly collect personal information from any person under 13 years of age.

• Where we learn that we have done so, we will delete the account and its associated information promptly.

• Where a parent or guardian believes that a child has created an account, contact support@upfro.app and we will delete it.

We do not request your date of birth and the Service does not verify age.

19. Apple Health Commitments

Because the Service reads information from Apple Health, we make the following commitments expressly:

• We do not use health or fitness information obtained from HealthKit for advertising, marketing, or any use-based data mining other than improving health management within the Service.

• We do not disclose HealthKit information to any third party for advertising, marketing, or data mining.

• We do not store HealthKit information in iCloud and do not upload it to our servers.

• We do not transmit HealthKit information to any artificial intelligence provider.

• We do not write false information to Apple Health. The Service writes only a mindful session record, and only upon your completion of a session.

• We read only the Health data types you have specifically authorized, and you may revoke that authorization within Apple’s Health application at any time.

20. What We Do Not Do

• We do not sell personal information.

• We do not display advertising.

• We do not track you across other applications or websites. We do not use the Advertising Identifier and do not request App Tracking Transparency authorization.

• We do not use your journal entries, mood entries, voice recordings, or health information to profile you for the benefit of any third party.

• We do not infer emotional state from voice, facial imagery, or biometric signals.

• We do not make automated decisions producing legal effects or similarly significant effects.

21. Changes to This Policy

We will update this Privacy Policy as the Service or applicable law changes.

• The version number and dates at the head of this document identify the version you are reading.

• In respect of material changes, we will notify you within the Service or by email before those changes take effect, and where required by applicable law we will request your acceptance again.

• Each acceptance is versioned. The record of your acceptance identifies the version accepted. A subsequent acceptance writes a new record and does not overwrite the prior record.

22. How to Contact Us

UpFro Privacy Policy, version 1.0. © 2026 UpFro. All rights reserved.