Effective October 6, 2026

Privacy policy

The short version

BULK has no account and keeps no copy of your training on a server. Everything you log lives on your phone. Data leaves the phone in four cases only: a crash report, a purchase, a check for app updates, and Spot’s Cloud engine if you switch it on.

What stays on your phone

• Routines, schedules, workouts, sets and feedback
• Notes, voice recordings and their transcripts
• Your history, charts and settings

Voice notes are transcribed on the phone, and the audio never leaves it. When Spot runs on this phone, it reads your notes there too. An export is a file you send where you choose, never to us. You can delete the recordings, or everything, in Settings.

What leaves your phone

Crash reports. If the app crashes, a report goes to Sentry so we can fix it. It carries a per-device id that is not an advertising id, no name and no account. Your notes and transcripts are removed before it is sent.

Purchases. Pro is sold through the App Store. Apple takes the payment, and RevenueCat tells the app you have Pro. RevenueCat sees the purchase and an anonymous id the app makes, the Support ID, never your name or email.

Spot’s Cloud engine. Only if you have Pro, choose Cloud and say yes. When a workout finishes, your sets, taps and notes go to our server and on to TypeSafe, which makes the call. Never ids, dates or audio. Nothing is kept for training.

Our server runs on Expo’s EAS Hosting. To prove a call comes from the real app and to count the daily limit, the phone also sends Apple’s App Attest key id: a random id made for this install, never joined to anything else. With Pro, it also sends your Support ID, so our server can ask RevenueCat whether you have Pro. The server keeps that id beside the key id, never sends it to TypeSafe and never logs it. Upstash keeps those ids and the day’s count, and nothing about a workout. The host’s request log keeps the time, the phone’s operating system and a rough location (country and region), never what was sent.

App updates. The app asks Expo’s update server for fixes. The request carries the app’s version and a random id Expo makes for this install to count installs, never anything you logged.

The model download. A Pro phone with no built-in model can download the model Spot runs on the phone, Gemma 4, once, from Hugging Face. The request carries nothing of yours.

What we do not collect

No name, no email, no login. No location access. No contacts. No advertising identifier. No analytics or ad SDKs in the app.

This website

This site counts page views with Vercel Web Analytics. It sets no cookies, and it cannot follow you from one day to the next or across other sites: it sees the page, the site you came from, your browser, operating system, device type and country. The site loads no ad tags. Its fonts are served by the site itself, so no font service sees your visit. Your light or dark choice is kept in your browser’s storage and never leaves it. The site is hosted on Vercel, which keeps standard request logs (IP address, page, time) to run and secure it.

Contact

Questions about this policy: support@bulkloop.app.