1. Who we are and what this covers
JUST START is a discipline app made by UpbelStudio, Lima, Peru. This policy covers the JUST START mobile app for iOS and Android and this website. It does not cover the App Store, Google Play, or any site you reach through a link you pasted into the app.
The short version: we collect what the app needs to keep your record, we do not sell it, we do not show ads, we do not run third-party analytics or advertising SDKs, and you can delete everything from inside the app.
2. What we collect
| Category | What, exactly | Why |
|---|---|---|
| Account | Email address; a password (stored hashed, never readable) or your Google account identity if you sign in with Google; display name; your time-zone offset; your reminder time and notification preferences. | To create and secure your account, to know what “today” is where you live, and to send the reminder you asked for. |
| Campaigns and habits | Which campaigns you started, abandoned or completed and when; each day’s outcome (delivered or missed), energy and phase; your habits, their schedule and each day’s completion; the micro-steps generated for a habit; Task Slayer sessions (the friction you chose and the step you took); the coach’s messages to you. | This is the product: your service record, streaks, tolerance and Hall of Records are computed from it. |
| Receipts | The text you write, the links you paste and the photos you upload to close a day, with the time you committed and the time you delivered. | To close the day, and to keep the build log you can read back later. |
| Location | Only during a live GPS session in a distance campaign (Ground Control): your route, distance, pace and GPS accuracy for that session. See section 6. | To measure the distance the day asks for. Never collected outside a session you started. |
| Subscription | Whether you have an active Premium subscription or trial, and the anonymous customer identifier RevenueCat assigns. We never receive your card or bank details. | To unlock what you paid for on every device you sign in on. |
| Technical | Platform (iOS/Android), app version, and the time on our server when the app checks its clock. | To keep the day honest (a phone clock set forward cannot close tomorrow today) and to support you. |
We do not collect contacts, advertising identifiers, precise location outside a GPS session, or anything from other apps. There is no analytics SDK in the app: we do not track screens, taps or sessions.
3. How we use it
- To run the app: resolve today’s action, score the day, keep your record, sync across your devices, send the reminder you set.
- To write the coach’s line: see section 4.
- To keep it fair: detect a clock that was moved forward, refuse a receipt that does not meet the day’s floor, prevent abuse of the trial.
- To support you: answer your emails and investigate problems you report.
- To comply with the law and enforce our Terms.
We do not use your data to build advertising profiles, and we do not make automated decisions with legal or similarly significant effects on you.
4. The AI coach, Task Slayer and habit micro-steps
Some lines in the app are written by an AI model on request: the coach’s message after a day, the first move Task Slayer hands you, and the micro-steps for a habit. To generate them we send OpenAI (model gpt-4o-mini) a small context: the day number, the phase, your energy percentage, and — for Task Slayer or a habit — the title of that action or habit and the friction you picked. We do not send your name, email, receipts, photos, or location. OpenAI processes this under its API terms and does not use API data to train its models. Every AI-written line is labelled as the coach’s; none of it is medical, legal or financial advice.
5. Photo receipts
Only you see them. A photo you upload as a receipt is stored in a private folder that belongs to your account. It is never shown to other users, never shared, never used for anything but your own record. We do not scan, analyse or use photos to train anything.
- Photos are compressed on your phone before upload (JPEG, with a 5 MB server-side limit) and stored encrypted in transit and at rest on Supabase Storage.
- The app reads them back through short-lived signed links; there is no public URL to a photo.
- Before your first photo, the app shows these terms once and records the time you accepted them.
- Photos are deleted together with your account (section 8). If you want a single photo removed earlier, email us and we will remove it.
- You are responsible for what you upload: only what is yours to upload, no one who did not agree to be in it, nothing unlawful. See the Terms.
6. Location
The app asks for location permission only if you start a distance campaign. During a session you began, it records your position to measure distance, pace and route, including while the screen is off (a visible notification shows the session is running). The session ends when you stop it or when the distance is met; no location is collected outside it. The route is stored as part of that day’s receipt so you can see it later. You can revoke the permission in your system settings at any time; distance campaigns will not work without it, everything else will.
7. Who processes your data
We do not sell personal data and we do not share it with advertisers. The following companies process data on our behalf, only to provide the service:
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, authentication, file storage (photo receipts) and the server functions the app calls. Runs on Amazon Web Services. | United States |
| Sign in with Google, if you choose it; Google Play billing. | United States | |
| Apple | App Store billing and subscription management. | United States |
| RevenueCat | Validates your subscription with the store and syncs it across devices. | United States |
| OpenAI | Generates the coach’s lines from the limited context in section 4. | United States |
We may also disclose data if the law requires it, to protect someone’s safety, or to enforce our Terms. If UpbelStudio is ever acquired or merged, your data would move with the service under this same policy, and we would tell you before anything changed.
8. Retention and deletion
We keep your data for as long as your account exists. There is no separate archive: your service record, receipts and photos are your account.
Deleting your account — Profile → Delete account — removes, immediately and irreversibly: your profile and preferences, every campaign, day, habit and log, every receipt including every photo in your storage folder, your coach history, and your sign-in. Residual copies in encrypted backups are overwritten within 30 days. We do not keep anonymised copies of your record.
Your subscription is managed by the store, not by us: deleting the account does not cancel a subscription. Cancel it in the App Store or Google Play before or after.
9. Security
Data travels over TLS and is encrypted at rest. Every table and the photo bucket enforce row-level security: a request can only read or write rows and files that belong to the signed-in account. Passwords are hashed with bcrypt; we never see them. Photos are compressed on the device and the server rejects files over 5 MB or outside the accepted image formats. Access to production systems is limited to the developer. No system is perfect; if we ever learn of a breach affecting you, we will tell you within 72 hours of confirming it.
10. Your rights
Wherever you live, you can:
- Access your data — most of it is visible in the app; email us for a machine-readable copy (JSON).
- Correct it — profile details and preferences from the app; anything else by email.
- Delete it — from the app, in one step (section 8).
- Withdraw consent — turn off notifications, revoke location or Google sign-in in your system settings, or stop using photo receipts (every step that takes a photo also takes a link).
- Object or restrict processing, and port your data, where your law provides it.
Email upbelstudio.help@gmail.com from the address on your account. We answer within 30 days.
Peru
Under Law 29733 you hold the rights of access, rectification, cancellation and opposition (ARCO). You may also file a claim with the Autoridad Nacional de Protección de Datos Personales.
European Economic Area and United Kingdom
Our legal bases are: performance of a contract (running the app), your consent (notifications, location, photo receipts, AI-written lines where required), and legitimate interest (security, fraud prevention, support). You may lodge a complaint with your supervisory authority.
California
We do not sell or share personal information as the CCPA defines those terms, and we do not discriminate against you for exercising your rights.
11. Children
JUST START is not for children under 13, and we do not knowingly collect their data. If you are between 13 and 18, you need a parent’s or guardian’s permission. If we learn we hold data from a child under 13, we delete it.
12. International transfers
Our processors are in the United States; your data is stored and processed there regardless of where you live. Where required, transfers rely on the processors’ standard contractual clauses and equivalent safeguards.
13. Changes to this policy
When we change something that matters — a new category of data, a new processor, a new purpose — we update the effective date above and tell you in the app before the change applies. Minor wording changes are reflected here without notice.
14. Contact
UpbelStudio · Lima, Peru
upbelstudio.help@gmail.com
Data-protection requests and privacy questions go to the same address.
THIS POLICY IS ALSO AVAILABLE IN SPANISH. THE ENGLISH VERSION GOVERNS, EXCEPT WHERE THE LAW OF YOUR COUNTRY REQUIRES OTHERWISE.