Privacy Policy

Last updated September 12, 2026

stirUp is a group workout accountability app. You log workouts; the people in your group see that you did. This policy describes exactly what that means for your data.

What we collect

Account details. Your email address and a display name. If you sign in with Google, we receive your name and email address for sign-in. Connecting Google Health is a separate, optional choice described below. We never receive your Google password.

Your timezone. Detected from your browser. It decides which week a workout counts toward, so a Sunday-night session isn't filed under Monday.

Workouts you log. Activity type, duration, the time it happened, an optional note, and an optional photo you choose to attach.

Group membership. Which groups you belong to and your weekly totals within them.

Meal photos, if your group runs the food track. The photo you take, any note you add, the grade it receives, and a restaurant you explicitly choose to attach.

We do not run advertising, third-party analytics, or tracking pixels. We do not collect contacts. We import steps and weight only when you choose to send or connect them.

Steps and weight, if you connect them. You can enter these yourself, send them through a phone automation, or connect Google Health. The Google Health integration reads only your selected steps and weight plus your Google Health account identifier. We store daily step totals, weight in pounds, their recorded dates and source, selected permissions, consent and sync times, and an encrypted credential for future imports. We do not save raw health samples or weight notes. The permissions Google offers cover broader categories, but StirUp does not request other measurements from its API.

Google Health data is used for your visible fitness tracking and, with your agreement when connecting, group steps and weight tracking. It is not sent to our meal grader, used for advertising, sold, or used to train AI models. StirUp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Restaurant lookup is optional and off by default. If you turn it on while reviewing a meal photo, your browser asks for location permission. Your precise device coordinates are sent once to Geoapify to suggest nearby restaurants. stirUp does not save those coordinates. It saves only the restaurant name and address you confirm.

Meal photos go to an AI grader

Meal grading uses a separate service as described here.

When you log a meal, the photo and your note are sent to OpenRouter, which routes them to the model that assigns the grade. That means a third-party company processes your photo. Photos of food routinely catch faces, children, homes, and restaurant interiors — assume anything in frame is included.

We keep OpenRouter's “providers that may train on inputs” setting disabled, so requests are not routed to providers who train on what we send. We rely on OpenRouter to enforce that; we cannot independently audit it.

We do not sell your data, share it with advertisers, or use it to train machine learning models ourselves. The grading step above only happens for meals you choose to log.

The grade is a game score, not nutrition advice. It is one model's impression of a photograph. It does not know your body, your goals, your medical history, or what else you ate. Do not treat it as dietary guidance.

You can sit out the food track entirely and stay in your group — nothing is sent for grading if you never log a meal.

Who can see it

Members of a group you join can see your display name, the workouts you log to that group, your notes and photos, your meal photos and grades, and your weekly totals and streak. If you attach a restaurant to a meal, they can also see that restaurant's name and address. That visibility is the point of the app. Anyone outside the group cannot see any of it.

A meal photo is visible to every group you belong to, not just the one you were logging for at the time — meals are yours, not tied to a single group, so a photo you take is one thing your whole food-tracking week, wherever you log it. A restaurant you attach to that meal follows the same visibility rule.

Your email address is never shown to other members.

Steps, weight readings, and weight changes can appear to members of every group you belong to, including groups you join later. The Google Health connection screen asks you to agree to this sharing before connecting. Connection credentials and your Google Health account identifier are never shown to group members.

Where it lives

Data is stored with Appwrite Cloud (San Francisco region), which hosts our database, file storage, and accounts. The app itself runs on Vercel. Google handles Google sign-in and, if you separately connect Google Health, receives authorization and data-read requests. This integration does not write health measurements back to Google or Samsung Health.

Meal photos and notes go to the AI grader described above. If you opt into restaurant lookup, your one-time coordinates go to Geoapify, which uses OpenStreetMap data to return nearby places.

How long we keep it

Your account and workout history stay until you ask us to delete them. Removing a check-in deletes it and its photo, and rolls it back out of your group's totals.

Disconnecting Google Health in account settings stops future imports and removes the saved credential, Google Health account identifier, and connection metadata. It also attempts to revoke Google access; if that cannot finish, settings directs you to remove access in your Google Account. Previously imported daily records remain until you ask us to delete them. To request deletion of these records, email markquiambao@gmail.com; we will action it within 30 days, including updating affected group totals.

Your choices

• Delete any check-in you logged, at any time, from the group page.
• Leave a group — you stop appearing on its leaderboard.
• Ask for your account and all associated data to be deleted by emailing markquiambao@gmail.com. We will action it within 30 days.
• Revoke Google access at any time from your Google Account → Security → Third-party access page.

Children

stirUp is not intended for anyone under 13, and we do not knowingly collect data from them. If you believe a child has an account, email markquiambao@gmail.com and we will remove it.

Changes

If this policy changes in a way that affects what we collect or who can see it, we will update the date above and notify you in the app.

Contact

Questions about any of this: markquiambao@gmail.com