ShowUp
Privacy Policy
Last updated: 13 October 2026
ShowUp is an alarm that wants you at your workout. To do that it needs a few things from you. This page says what we keep, why, for how long, and how to delete it. ShowUp is made by Emmanuel Farias, an individual based in the United Kingdom, who is the data controller. Questions: privacy@getshowup.app.
- 1
Location only for your places
Location is used only for the training places you save. No continuous tracking, no route.
- 2
Contacts are optional
If you turn them on, only hashed phone numbers leave your iPhone. Never names.
- 3
No photos saved
The camera recognises things live. No photo is ever stored.
- 4
One frame, only when unsure
If the check on your iPhone isn't sure, one frame goes to our server and to the Google Gemini API (paid, not used for training), and is thrown away right after.
No tracking. No ads. We never sell your data.
What we keep, and why
Each part says what we keep, why, for how long and how to delete it. Deleting your account (below) deletes all of it.
Your account
What: a random user ID created the first time you open the app. If you choose Sign in with Apple, your email address (often Apple's private relay address) and the name Apple shares, which we use as the default display name. You can also skip sign-in and stay anonymous.
Why: to keep your progress and let you restore it on a new iPhone. When you sign in with Apple we also keep an encrypted Apple token, only so we can revoke it when you delete your account.
How long: while your account exists.
Delete: Settings › Account › Delete account.
Your plan, check-ins and progress
What: your training days, alarm time and travel time; for each day, when you checked in and how (arrived at the place or completed a camera check), whether you were inside the place's zone, a rough distance band and the GPS accuracy. From that we keep your XP, level, streak and ShowUps. We also keep your app preferences (alarm labels, missions, items, sound, snooze and similar settings) so we can restore them.
Why: this is what the app does: it rings, checks you in and turns showing up into XP.
How long: your progress while your account exists. The detail of each check-in (zone, distance band, accuracy) is kept for 90 days, then only the type and dates remain. Past versions of your plan are kept for 400 days.
Delete: deleting your account deletes all of it.
Training places (location)
What: the centre of each training place you save (gym, pool, mat, court or track), its 200 m radius, type and name. From your main place, your iPhone works out the city (for example "London"); only the city goes to our server, for the Local ranking.
Why: your iPhone watches only these places to notice when you arrive. We keep them in your account so they come back after a reinstall or on a new iPhone. They are never shown to anyone else.
What we never keep: where you are, your route, your address or any position other than the places you saved.
How long: until you delete the place, or your account. A deleted place leaves our servers in the next daily clean-up after the training days that used it are settled. Usually that's within a day; if a day is still waiting for your iPhone to sync, it takes longer.
Delete: delete the place in the app, or delete your account. You can also turn location off in iOS Settings at any time.
The camera
What: the camera is live only. Your iPhone recognises the item or the place on the device, and no photo is saved. Only if that check isn't sure, and only if you allowed "AI check when unsure", one frame (at most 640 px) is sent to our server, which asks the Google Gemini API whether the item is there. The request to Google carries no user ID, name or email.
Why: so a check doesn't fail just because your iPhone wasn't sure.
How long: our server keeps the frame only in memory while it waits for the answer, then throws it away. It is never written to a database, storage or logs. We use the paid Gemini API, under which Google does not use the frame to train its models; Google may keep it for a limited time only to detect abuse, as its terms describe. We keep only a daily count of these checks per account, for 35 days, to stop abuse.
Delete or stop: turn off Settings › Account › AI check when unsure. Then frames never leave your iPhone.
Friends and contacts (optional)
What: if you turn on Contacts sync, your iPhone turns each phone number in your contacts into a hash and sends only the hashes, never names, emails or the numbers themselves. If you add your own number, it is hashed the same way. On our server each hash is hashed again with a secret key.
Why: to show which of your contacts already use ShowUp, and to let people who have your number find you. Anyone who has your number can find you; turn off "Let contacts find me" if you don't want that.
How long: your contact hashes until your next sync replaces them or you delete them; your number until you remove it. A log of when you synced and how many hashes is kept for 7 days.
Delete: Settings › Privacy › Delete synced contacts, or Remove number. It takes effect immediately. Turning off Contacts sync also deletes your contact hashes.
Your profile and the Arena
What: your display name, bio, challenge names and rewards you write, who you follow, blocks, reactions and reports.
Why: to run the social side of ShowUp. Anyone can see your gladiator, display name, bio, tier, level, streak, counters, badges and your XP and rank on the boards. People you let follow you also see the times of your check-ins. People in a challenge with you see your training days and alarm time. Nobody ever sees your places, address, phone number, contacts, photos or email. You can make your profile private in Settings › Social › Public profile.
How long: while your account exists. In-app notifications are kept for 30 days. Reports are kept for 1 year.
Delete: edit or remove your name and bio at any time, or delete your account. In past seasons and challenges you then appear as "Deleted gladiator".
Subscriptions
What: the record of your subscription and its transactions, as Apple reports them to us. We never see your payment details: Apple handles payment.
Why: to unlock ShowUp Pro and to understand how subscriptions are doing.
How long: while your account exists. When you delete your account, the transaction record is kept without your user ID, because Apple's refund and renewal notices refer to it.
Delete: deleting your account removes the link to you. It doesn't cancel the subscription: manage it in iOS Settings › Apple Account › Subscriptions.
Notifications
What: the push token Apple gives your iPhone, and the app version.
Why: to send your check-in reminders and the social notifications you turned on.
How long: until Apple says the token is no longer valid, or 90 days without use.
Delete: turn notifications off in iOS Settings, or delete your account.
Analytics and diagnostics
What: how the app is used (for example which onboarding screen you reached, a check-in completed or a purchase started), with your user ID; basic technical data such as app version, iOS version, device model, language and error codes. No screen recording, no location and no free text. If you installed ShowUp from an ad in the App Store, Apple tells us which campaign, ad group and keyword it was.
Why: to see what works and fix what doesn't, and to know which ads bring people in. This is not tracking: nothing is combined with data from other companies' apps or websites.
How long: analytics for up to 2 years; the ad campaign record for 1 year.
Delete: when you delete your account, we ask PostHog to delete your analytics data and we delete the campaign record.
Fair play and security
What: a device key from Apple's App Attest, which proves requests come from the real ShowUp app, and fair-play signals worked out from your check-ins (for example too many camera checks in a day).
Why: to keep the rankings fair and the service safe. Fair-play signals can keep an account out of the rankings and challenges.
How long: the device key while your account exists; fair-play signals for 90 days.
Delete: deleting your account deletes them.
What stays on your iPhone
- The apps you choose to block (Screen Time). They never leave your iPhone.
- Camera frames from the checks on your iPhone, and any voice you record for your alarm.
- The names of your contacts. Names shown in ShowUp come from your own address book, on your iPhone.
- Share cards and videos. They are made on your iPhone, and you choose where to send them.
Who helps us
These companies process data for us, only to run ShowUp and only on our instructions.
- Supabase
- Database, accounts and server functions. Hosted in the EU (Ireland, eu-west-1).
- The Gemini API (paid), only for the one frame sent when a camera check isn't sure. Not used to train Google's models.
- PostHog
- Product analytics. Hosted in the EU.
- Apple
- Sign in with Apple, push notifications (APNs), in-app purchases, App Attest and App Store ad attribution.
When you email us, your message is kept in our mailbox to answer you.
International transfers
Supabase and PostHog keep your data in the EU, which the UK recognises as giving adequate protection. Google and Apple may process data in the United States and other countries. Where that happens, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK International Data Transfer Agreement), and where it applies, the UK Extension to the EU-US Data Privacy Framework.
Legal bases
- Contract: your account, plan, alarms, places, check-ins, XP, the Arena, notifications and your subscription. Without them we can't provide the app.
- Legitimate interests: analytics and diagnostics, ad attribution, fair play, moderation and security. You can object at any time (see your rights below).
- Consent: Contacts sync and your phone number, and sending a frame to the cloud when a camera check isn't sure. You can withdraw consent at any time in the app; it doesn't affect what happened before.
- Legal obligation: keeping transaction records we need for accounting and tax.
How long we keep data
- While your account exists
- Account, profile, progress, XP, streak, preferences, follows, challenges and subscription status.
- Until you delete them
- Training places (removed once the training days that used them are settled), contact hashes and your phone number.
- 400 days
- Past versions of your plan.
- 2 years
- Analytics. A record that an account was deleted, with no personal data.
- 1 year
- Reports, ad campaign record, invite redemptions, Apple's subscription notices.
- 90 days
- Check-in detail, fair-play signals, unused push tokens.
- 35 days
- Daily count of cloud camera checks.
- 30 days
- In-app notifications.
- 7 days
- Contact sync log, outgoing push queue, server backups.
- Never stored by us
- Photos, your position or route, contact names. The cloud camera frame is held only in memory until the answer comes back.
Delete your account
Go to Settings › Account › Delete account. It works for anonymous accounts too and takes effect immediately: we delete your profile, progress, places, preferences, contact hashes, phone number, follows and reactions, revoke your Apple sign-in token and ask PostHog to delete your analytics data. Your iPhone then clears ShowUp's data and alarms. Deleted data leaves our daily backups within 7 days.
A few things stay without your user ID: the transaction record (see Subscriptions) and your place in past seasons and challenges, shown as "Deleted gladiator".
Deleting your account doesn't cancel your subscription. Manage it in iOS Settings › Apple Account › Subscriptions. You can also ask us to delete your data at privacy@getshowup.app.
Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- access the data we hold about you;
- correct it if it's wrong;
- erase it;
- port it, in a machine-readable format;
- object to processing based on legitimate interests, and to restrict processing;
- withdraw consent at any time.
Email privacy@getshowup.app. We reply within one month. We may need to confirm the request comes from the account holder.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113. We'd appreciate the chance to sort it out first.
Age
ShowUp is for adults. You must be 18 or older to use it. If you think someone under 18 has given us data, email privacy@getshowup.app and we'll delete it.
No tracking, no selling, no ads
ShowUp doesn't track you across other companies' apps or websites, doesn't use the advertising identifier (IDFA), doesn't sell or rent your data, doesn't share it with data brokers and shows no ads.
Security
Data is encrypted in transit. Places, contact hashes and account tokens sit in parts of the database that only our server can read. Our server logs carry no personal data: no user IDs, names, coordinates, frames or free text.
Changes
If we change this policy, we'll update the date at the top. For important changes, such as new data or a new company processing it, we'll also give notice before they take effect.
Contact
Emmanuel Farias (data controller), United Kingdom.
Privacy: privacy@getshowup.app · Support: support@getshowup.app