Privacy Policy

Ugoku (“Ugoku”, “we”, “us”) is operated by an independent developer based in Texas, United States. For the purposes of data-protection law, the operator of Ugoku is the controller of the personal data described in this policy.

For anything privacy-related, contact us at privacy@ugokuhealth.com.

Everything below is data you provide or generate by using the app. We do not buy data about you or collect data from third-party sources.

• Account data — your email address, name, and an encrypted password, used to create and secure your account.
• Body metrics — sex, birth year (age), height, weight, and a daily body-weight log if you track it, used to compute calorie targets and trends.
• Nutrition data — the foods and meals you log (including calories and macros), your diet style, weight goals, and any intermittent- fasting windows you set.
• Training data — your routines and plans, logged workouts (sets, reps, weight, RPE), functional-fitness and cardio sessions (including average heart rate if you enter it), and strength or endurance baselines used to calibrate your plan.
• Injury and pain data — injury flags with free-text notes, a sick/vacation training status, and per-exercise pain feedback (good / uncomfortable / pain), used for injury-aware exercise substitutions.
• Preferences and settings — onboarding answers (goals, experience, equipment, schedule), units, notification preferences, and dashboard layout.
• Technical data — your timezone, a coarse country code (derived from your IP address at request time, used to scope food search and regional consent defaults), and, if you enable push notifications, a push-subscription endpoint and a truncated browser user-agent string.

Free-text fields (such as workout notes and injury notes) store whatever you type into them — please only include what you are comfortable saving.

We use your data to:

• run the service — accounts, sign-in, syncing across your devices;
• personalize your training and nutrition — generating and adapting plans, computing calorie targets, tracking progress;
• power injury-aware features — suggesting exercise substitutions based on the injuries and pain feedback you record;
• communicate with you — transactional email (account confirmation, password reset) and, if you turn them on, push notifications and reminders;
• understand how the public site is used — anonymous analytics, only as described in the cookies section below;
• keep the service secure and prevent abuse.

We do not use your data for advertising, and we do not sell it to anyone.

Much of what Ugoku stores — body metrics, diet logs, heart rate, injury notes, and pain feedback — is health-related. Under laws like the GDPR (Article 9) and the CCPA/CPRA this is treated as sensitive data, and we treat it that way too.

We process this data for one purpose: to provide the fitness and nutrition service you signed up for, with your consent. You choose what to log; all health-related data in Ugoku is self-reported by you. We never use it for advertising, never sell it, and never share it except with the service providers listed below who process it on our behalf.

Ugoku is a consumer fitness app, not a healthcare provider, and it is not covered by HIPAA. Do not rely on it for medical records or medical advice.

The app itself uses only functional, first-party storage: a session cookie to keep you signed in, your theme and timezone preferences, and a service-worker cache for offline use (private pages are purged from it when you log out).

On the public marketing site we may use Google Analytics 4, loaded through Google Tag Manager, to understand which pages are useful. How it applies depends on where you are:

• EU, UK, EEA, and Switzerland: analytics is off by default and runs only if you opt in.
• United States and the rest of the world: analytics may run by default, and you can opt out at any time.
• Global Privacy Control: if your browser sends the GPC signal, we treat it as an opt-out automatically.

Your explicit choice always wins over the regional default, and you can change it any time via the “Cookie settings” link in the site footer. Analytics never receives your training, nutrition, or health data.

We do not sell your personal data, and we do not share it with advertisers or data brokers. We share it only with the service providers we need to run Ugoku, each limited to its role:

• Supabase — our database and authentication provider. It stores your account and all the app data described above.
• Vercel — our hosting provider. It processes request traffic (including IP addresses) to serve the app.
• Resend — our transactional-email provider. It receives your email address and the content of account emails (confirmation, password reset).
• Google Analytics / Google Tag Manager — site analytics on the public site, subject to the consent choices described above.
• Open Food Facts — the public food database behind food search. When you search for a food, the search text and your country code are sent to it; no account data, email, or user identifier is ever included.
• Browser push services (such as those run by Google, Mozilla, or Apple) — deliver push notifications to your device, only if you enable notifications.

Beyond these providers, we would disclose data only if required by law or to protect the rights, safety, or security of the service and its users.

Ugoku is operated from the United States, and our service providers process data in the United States. If you use Ugoku from the EU, UK, or other regions with data-transfer rules, your data is transferred to the US under appropriate safeguards offered by our providers, such as standard contractual clauses.

We keep your data for as long as your account is active, because the app needs your history (workouts, weights, meals) to work for you. We do not have fixed deletion schedules for individual records beyond that.

If you want your account and its data deleted, email privacy@ugokuhealth.com and we will delete it. Copies may persist in our providers’ routine backups for a limited period before being purged.

Depending on where you live, you have rights over your data, including:

• GDPR (EU/UK): the right to access, correct, delete, and export (data portability) your data, to withdraw consent, and to object to or restrict processing. You also have the right to lodge a complaint with your local supervisory authority.
• CCPA/CPRA (California): the right to know what we collect, to delete it, to correct it, and to opt out of “sale” or “sharing” of personal information — we do not sell or share your personal information in that sense. We will never discriminate against you for exercising your rights.

To be upfront: self-serve account deletion and data export are not built into the app yet. To exercise any of these rights today, email privacy@ugokuhealth.com and we will handle your request directly.

We take reasonable measures to protect your data: every user’s records are isolated with database row-level security so only your account can read them, connections are encrypted in transit, and administrative credentials are restricted to server-side use. No method of storage or transmission is 100% secure, so we cannot guarantee absolute security — but protecting health- related data is a design priority, not an afterthought.

Ugoku is for people aged 16 and older and is not directed to children under 16. We do not knowingly collect data from anyone under that age. If we learn that we have, we will delete it — and if you believe a child under 16 has created an account, please contact us so we can remove it.

When this policy changes, we will update the “Last updated” date at the top of this page, and for material changes we will notify you in the app or by email. Continued use of Ugoku after a change means you accept the updated policy.

Questions, concerns, or requests about your privacy? Email privacy@ugokuhealth.com. We read everything sent there.