Uncurled is a posture training and wellness habit app operated by Julius Cherubini. This Privacy Policy explains how personal data is handled when you use the Uncurled mobile app or website.
1. Who operates Uncurled
The data controller for Uncurled is Julius Cherubini, Kivipelto 2, 40520 Jyväskylä, Finland. You can contact us about privacy, account deletion, subscriptions or support at support@deshrimp.app.
2. Information we collect
Depending on how you use Uncurled, we may handle:
- Account and sign-in data: your email address, authentication identifiers, and information provided by Apple or Google when you use those sign-in options. Apple may provide a private relay email address if you choose to hide your email.
- Profile and preferences: your display name, onboarding answers, posture goals, selected focus areas, training schedule, rest days, notification choice, notification time, timezone and locale.
- Privacy choices: when you are signed in, Supabase stores your app-usage sharing choice, the choice date and consent version when known, Apple's current tracking permission status and when it was checked, and a random identifier for this app installation. We record acceptances and declines to document your choices. This identifier is not your advertising identifier and these records are not sent to PostHog, Tenjin, Meta or TikTok.
- Training data: workout dates, session status, start and completion times, duration, exercises, sets, reps, streaks, progress and related statistics.
- Subscription data: your Uncurled account ID, entitlement status, product and store identifiers, purchase and expiry dates, grace-period status and subscription management information. Apple and Google process payment-card details; we do not receive or store your full payment-card number.
- App usage and technical data: product-analytics events, including screens visited, onboarding choices, training activity, preference changes and subscription events, plus app version, operating system, device and session information, if you allow app-usage sharing. PostHog receives this information. When you are signed in, this activity is linked to your Uncurled account ID.
- Ad measurement events:if you allow app-usage sharing on iOS, Tenjin receives install, app-open, completed-registration and first paid subscription events. A free-trial start, if offered, is reported separately. When Apple's tracking permission is off, limited measurement through Meta's Aggregated Event Measurement (AEM) can continue. Tenjin receives your vendor identifier (IDFV), IP address, operating system and app information, tracking permission status and SDK diagnostics. These events are not anonymous at collection. We exclude the advertising identifier (IDFA), extra device properties and signed purchase receipts from this path. If you also grant Apple's tracking permission, Tenjin can receive the advertising identifier and additional device information, plus first-purchase product, transaction identifier, amount paid, currency and Apple's signed receipt, which can contain store and app-account identifiers. Tenjin forwards configured measurement events to Meta and TikTok to measure our ads, subject to Apple's tracking permission status. With Apple's tracking permission, these partners may link events with information from their services. We do not send your email, Uncurled account ID, posture or workout details to Tenjin, Meta or TikTok. Tenjin's SDK can retain failed event requests on your device and retry them when you next use the app with app-usage sharing enabled.
- Anonymous Apple ad measurement:the iOS app uses Apple's SKAdNetwork to register first opens and update limited subscription outcomes during the first two days after first open. Apple may send delayed campaign reports to Meta or TikTok, depending on which ad led to the install, and copies to Tenjin without user- or device-specific identifiers. This measurement runs even if you decline app-usage sharing or Apple's tracking permission. The app keeps the first-open date and subscription milestone locally to manage this reporting window, and a record of subscription events handed to Tenjin to avoid duplicates.
- Support communications: information you choose to include when you contact us, including account-deletion requests.
Some posture goals and training choices may be health- or fitness-related. We use them only to provide and improve your selected training experience. We do not ask for medical diagnoses, clinical measurements or medical records.
Uncurled does not intentionally collect photos, contacts, precise location, camera data, HealthKit data, Google Fit or Health Connect data. We do not intentionally collect your password in readable form or your full payment-card details.
3. How we use information
We use information to:
- create and secure your account;
- provide, sync and personalise your training experience;
- save your progress, schedule, reminders and workout history;
- document your privacy choices, including declines, separately from product analytics and ad measurement;
- process, verify, restore and manage subscriptions;
- send local workout reminders when you enable notifications;
- understand how the app is used and improve its features;
- respond to support and privacy requests;
- prevent abuse, protect the service and resolve disputes; and
- comply with legal, tax, accounting and regulatory obligations.
If you allow app-usage sharing in the prompt or Settings, we use PostHog for product analytics. On iOS, ad measurement through Tenjin and its configured partners, Meta and TikTok, uses your app-usage sharing consent. Tenjin receives installs, app opens, registrations and first subscription outcomes; detailed paid-purchase data requires Apple's tracking permission. Session replay is disabled. Turning app-usage sharing off stops new product-analytics and Tenjin events, including events forwarded to Meta and TikTok. If you decline Apple's tracking permission but allow app-usage sharing, PostHog and limited AEM measurement can still run. Apple's No is not permission for cross-company tracking, substitute tracking identifiers or device fingerprinting. Apple's anonymous SKAdNetwork reports continue regardless of either choice. We do not send posture or workout details to Tenjin, Meta or TikTok, use those details for targeted advertising, or sell personal data.
4. Legal bases in the EEA and the United Kingdom
Where data-protection law requires a legal basis, we generally process information because it is needed to provide the service you request, because you have enabled a feature such as notifications, because we have a legitimate interest in security and service improvement, or because the law requires it. We rely on your consent for app-usage sharing, which covers PostHog product analytics and Tenjin, Meta and TikTok measurement on iOS, including limited Meta AEM measurement when Apple tracking is off. Cross-company tracking separately requires Apple's tracking permission. You can decline without losing access to the core app and withdraw your choice at any time in Settings. Withdrawal does not affect processing that already took place lawfully.
5. Service providers and sharing
We share information only as needed to operate Uncurled and meet legal obligations. Service providers may include:
- Supabase: account authentication, database storage, server-side functions and delivery of authentication emails through its configured email service;
- PostHog: product analytics when you have allowed app-usage sharing;
- Tenjin: consented ad measurement on iOS and event forwarding to Meta and TikTok, including limited Meta AEM measurement when Apple tracking is off and detailed first-purchase data when it is allowed, plus anonymous campaign reports from Apple's SKAdNetwork;
- Meta: advertising and measurement of configured events forwarded by Tenjin with app-usage sharing consent, using the Apple tracking permission status for AEM, plus anonymous campaign reports from Apple's SKAdNetwork;
- TikTok: advertising and measurement of configured events forwarded by Tenjin with app-usage sharing consent, subject to Apple's tracking permission status, plus anonymous campaign reports from Apple's SKAdNetwork;
- RevenueCat: subscription and entitlement management;
- Apple and Google: app distribution, sign-in and in-app purchases when you use their services; and
- Authorities and professional advisers: only when reasonably necessary for legal, security, tax or dispute matters.
These providers may process information in countries other than Finland or your home country. When required, we use appropriate safeguards for international transfers. Each provider may also process information under its own privacy policy.
6. Website information
The website may receive basic technical request information through its hosting and security systems. The website uses Google Fonts to display the Manrope typeface, so your browser may contact Google to load those fonts. Links to Apple and Google stores take you to those providers, which then handle information under their own policies.
7. Retention
We keep account and training information while your account is active and delete it when your account is deleted, except where a limited record must be retained for legal, tax, accounting, security, fraud-prevention or dispute purposes. We may keep aggregated or de-identified analytics that can no longer reasonably be linked to you. Apple, Google and other providers may retain their own records under their policies and legal obligations.
8. Your choices and rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, restrict or object to certain processing, and withdraw consent. To make a request, email support@deshrimp.app. We may ask for reasonable information to confirm your identity and will respond within the time required by applicable law. Where the GDPR applies, this is normally one month.
You can change your app-usage sharing choice at any time in Settings under Privacy. Turning it off stops new product-analytics and Tenjin events and forwarding to Meta and TikTok, including limited Meta AEM measurement. Apple's anonymous SKAdNetwork measurement continues without user- or device-specific identifiers.
On iOS, you can also change Apple's tracking permission in your device Settings under Privacy & Security and Tracking. Revoking this permission stops the use of your advertising identifier and detailed purchase sharing. Limited AEM measurement and PostHog can continue while app-usage sharing is allowed. Turn app-usage sharing off to stop both. Neither permission is required to use Uncurled.
You may also complain to your local data-protection authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman at www.tietosuoja.fi/en.
9. Account deletion
You can request permanent account deletion inside the app or from outside the app by emailing support@deshrimp.app from the email address connected to your account. Use the subject “Account deletion” and include the email address used for Uncurled. We may ask for reasonable verification before acting on the request.
When deletion is completed, we delete your Uncurled account, profile, progress, training history and associated account data from our systems, together with retained subscription webhook records associated with that account. Local data is removed by the app when the deletion flow completes. Deletion is permanent and cannot be undone.
Deleting your account is not a refund. Check your Apple or Google subscription settings and cancel an active subscription there. We may be able to cancel some subscriptions through our subscription provider, but you remain responsible for confirming cancellation in the relevant store.
10. Children
Uncurled is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If local law requires parental or guardian permission for a person using the app, that permission must be obtained before use. If you believe a child under 13 has provided personal data, contact us at support@deshrimp.app and we will take appropriate steps to delete it.
11. Security
We use reasonable technical and organisational measures to protect information. No online service or device storage can be guaranteed to be completely secure, so please use a strong password and protect access to your device and email account.
12. Changes to this policy
We may update this Privacy Policy when the app, providers or legal requirements change. We will post the updated version on this page and update the effective date. If a change materially affects your rights, we will provide additional notice where required.
13. Contact
Privacy, deletion and support requests: support@deshrimp.app
Julius Cherubini
Kivipelto 2
40520 Jyväskylä
Finland