Privacy Policy

Last updated: October 2026. This policy applies to the website keepupsquad.com and the web app app.keepupsquad.com ("KeepUp").

1. Controller

Moritz Gärtner
Breulingstraat 23A
6211 SB Maastricht
Netherlands
Email: hello@keepupsquad.com

2. What data we process and why

• Account: your email address and password (stored encrypted) or, if you sign in with Google, the email address and account ID Google sends us. Also your username and, optionally, a profile picture. Purpose: providing your account (Art. 6(1)(b) GDPR).
• Check-ins: the photos you take with the camera (gym photo and optional selfie), with date and time. Only members of your squads can see them. Purpose: the core function of the app (Art. 6(1)(b) GDPR).
• Gym at check-in (optional): only if you allow location access in your browser, the app determines your location when you open the camera and looks up the nearest gym. For this, your coordinates (rounded to about 10 metres) are sent to the OpenStreetMap service Overpass API. We do not store your coordinates. We only store the name of the gym found with your check-in, and members of your squads see it. If you do not allow location access, your check-in is shown with "No gym verified". You can withdraw the permission at any time in your browser or phone settings. Legal basis: your consent (Art. 6(1)(a) GDPR; for accessing your device's location also Art. 5(3) ePrivacy Directive / Art. 11.7a Telecommunicatiewet).
• Squads and interactions: squad memberships, likes, comments and GIFs you post or upload (Art. 6(1)(b) GDPR).
• Blocking: who you have blocked, so we no longer show you their posts and comments. The blocked person is not told (Art. 6(1)(b) GDPR).
• Reports: when you report content, we store your user ID, the reported person, the reason, the time and a copy of the reported text or the address of the reported photo or GIF. The reported person does not find out who reported them. Reports sent by email are handled the same way. Purpose: reviewing and removing illegal content and preventing abuse (Art. 6(1)(c) GDPR in conjunction with Art. 16 Digital Services Act, and Art. 6(1)(f) GDPR). If we remove content or suspend an account as a result, we use that person's email address to tell them why.
• Emails to us: when you write to us, we process your email address and the content of your message to reply (Art. 6(1)(b) or (f) GDPR). Emails are forwarded via Cloudflare Email Routing to a Google (Gmail) mailbox.
• Anonymous usage statistics: when the app is opened, we store the time, device type (phone or computer), whether it was opened from the home screen and the domain of the referring site (e.g. "tiktok.com"). No IP address, no link to your account. Purpose: improving the app (Art. 6(1)(f) GDPR).
• Error reports: when a technical error occurs in the app, we store the error message, browser identifier (user agent), the page and, if you are logged in, your user ID. Purpose: fixing bugs (Art. 6(1)(f) GDPR).
• Server logs: when you open our pages, our hosting provider necessarily processes your IP address, the time and the requested address to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR).

The app only accesses your camera while the camera screen is open. Only the photo you send with "Send" is stored. Apart from the optional gym lookup described above, we do not collect location data.

We use no advertising trackers, no third-party analytics tools and no marketing cookies. Fonts and code libraries are served from our own server.

3. Storage in your browser

The app stores your login session, your confirmation of the minimum age and the Terms, and cached image addresses in your browser's local storage, so you stay logged in and photos load faster. This is strictly necessary to run the app (Art. 5(3) ePrivacy Directive, implemented in the Netherlands in Art. 11.7a Telecommunicatiewet).

4. Recipients and service providers

• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): hosting and delivery of the website and app. Cloudflare is certified under the EU-US Data Privacy Framework.
• Supabase, Inc. (970 Toa Payoh North #07-04, Singapore): database, file storage and login. The data is stored in a data centre in Ireland (EU). We have a data processing agreement with Supabase including the EU Standard Contractual Clauses.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): if you choose "Continue with Google" (Google's privacy policy also applies) and as the provider of the mailbox that receives emails sent to hello@keepupsquad.com.
• Overpass API (overpass-api.de, operated in Germany as a public OpenStreetMap service): only when you allow location access, to find the nearest gym. It receives your rounded coordinates and your IP address and returns the gyms nearby.
• GIPHY, Inc. (USA): only when you open the GIF search in comments. Your search term and IP address are then sent to GIPHY and the GIFs are loaded from GIPHY's servers (Art. 6(1)(b) GDPR; transfer to the USA based on Art. 49(1)(b) GDPR or the EU Standard Contractual Clauses).

5. How long we keep data

We keep account data, photos (including the gym name), comments and likes until you delete them or your account. You can delete your own posts and comments in the app at any time. When you delete your account, we immediately delete your profile, photos, check-ins, comments, likes, blocks and squad memberships. Error reports and usage statistics are deleted automatically after 12 months, closed reports 12 months after they were made. We delete emails to us once the matter is resolved, unless we are legally required to keep them longer. Server logs at Cloudflare are deleted automatically after a short time.

6. Minimum age

KeepUp is for people aged 16 and over.

7. Required data and automated decisions

Without an email address (or Google account) and a username we cannot create an account for you; everything else, such as a profile picture or selfie, is optional. We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR. Reported content is always reviewed by a human.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just email hello@keepupsquad.com.

You can also lodge a complaint with a data protection authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), but you can also contact the authority in the EU country where you live or work (Art. 77 GDPR).

9. Changes

We update this policy when the app or the law changes. The current version is always available at keepupsquad.com/privacy.