Last Updated: September 21, 2026
Your privacy is important to us. This Privacy Policy explains how Upside App Studio ("we", "our", "us") collects, uses, and protects information when you use the Splay mobile application (the "App"). By using the App, you agree to the practices described below.
We comply with applicable data protection standards including the European General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK, Law No. 6698), and the California Consumer Privacy Act (CCPA).
Splay is a posture and flexibility coach. It uses your camera to measure how your body moves, and it builds stretching sessions from those measurements.
Your camera feed never leaves your phone. Posture is read on the device itself. No photo, video, or camera frame is uploaded, stored, or transmitted anywhere, at any time.
We do not ask for your name, email address, or phone number. The App has no sign-up screen and no password.
What we store is the result of your scans (angles, not images), your practice history, your daily check-ins, the body areas you flag as sore, your goal, and your age and sex — all kept under an anonymous identifier, not under your name.
We do measure how the App is used and which advertisement brought you here. The App includes an analytics SDK and an advertising-attribution SDK, and on iOS it asks your permission to track before the attribution part begins. Section 5 lists every event we send, including the ones that carry an answer you gave during setup.
We do not sell your data, and we do not share your scans, your measurements, or your practice content with advertisers.
Nothing here is used to decide anything about your health.
This policy applies to the Splay iOS application and the services we operate for it. It does not apply to third-party websites, services, or applications that may be linked from within the App.
Splay's scan is the heart of the App, and it is the part we have designed most carefully.
When you run a scan, the App opens your camera and runs a pose-detection model directly on your device (Google ML Kit, and optionally Apple Vision, both of which execute locally). That model converts the live picture into a set of body-joint coordinates, which are turned into angles — how far your spine extends, how far you fold forward, how far you reach to each side.
Camera frames are processed in memory and discarded immediately. They are never written to disk, never added to your photo library, and never transmitted off the device.
No image, video, screenshot, or recording of you is created, stored, or uploaded by the App, on our servers or anywhere else.
No biometric identification takes place. The model measures the geometry of a body in frame. It does not identify a face, and it does not build a template that could be used to recognise you.
What leaves the scan is a small set of numbers — for example, "backbend: 23 degrees" — together with quality notes about the reading (whether the body was still, whether it was fully in frame).
Camera access is requested only when you start a scan, and you can revoke it at any time in iOS Settings. Revoking it disables scanning; the rest of the App continues to work.
During a scan the App reads your device's accelerometer to know which way is down and to detect whether the phone is being shaken or is resting steadily. This reading is used in the moment to keep the measurement honest and to show you guidance. It is processed on the device and is released as soon as the scan ends.
The App has no sign-up form. We never ask for your name, email address, phone number, postal address, or payment details. The following is what is actually stored:
The App signs you in anonymously through Firebase Authentication. This produces a random identifier (a "uid") that is not derived from you, your device, your email, or your Apple ID, and that we cannot use to contact you or to look you up anywhere else. Everything below is stored under that identifier so that your history is still there when you reopen the App.
This identifier is kept in your device's keychain, which means it can survive deleting and reinstalling the App. See Section 9 for how to have it and its data erased.
To do its job, the App stores:
Scan results — the measured angles and capability estimates described in Section 2, plus posture observations such as forward-head or shoulder-alignment ratios, with a timestamp and the time of day.
Practice history — which session you did, when, how long it lasted, which poses it contained, how long you actually held each one, and whether you chose a gentler variation.
Daily check-ins — how you told the App you feel that day (the moods you selected) and any areas you marked as tender for that day.
Body flags — the areas of the body you mark on the body map as sore or as areas to protect. These are used to remove unsafe poses from your sessions.
Your goal and training preferences — the long-term goal you chose, the days and frequency you said you want to practise, and whether spoken guidance is on.
This is health-related information, and we treat it as such: it is stored under your anonymous identifier, it is transmitted over encrypted connections, and it is never shared with advertisers, insurers, employers, data brokers, or any other third party.
The App does not read or write Apple Health / HealthKit, and it does not request access to it.
The App asks for your age and your sex once, during setup. Both are optional to the degree that you can leave the App at that point; they are stored with your profile. Age is limited to the range 13–99.
These two fields do not change which poses you are given or how your body is measured — no exercise is selected or withheld on the basis of either. They are used as context for how the App's written guidance addresses you, and they are also reported to our analytics provider as answers to the setup questions (see Section 5).
Optional premium subscriptions are processed by Apple through the App Store and managed through RevenueCat. We receive only the information needed to unlock premium features: whether a subscription is active, in trial, expired, or refunded, which product it is, and when it renews.
We never receive, see, or store your credit card number, billing address, Apple ID, or any payment instrument data. Apple does not give it to us.
Like any connected app, Splay makes network requests, and the services that answer them necessarily see the technical details of the connection — including your device's IP address, the device model and iOS version, and the App version. This happens when:
your data is saved to or read from our cloud database (Google Firebase);
a stretching video is streamed from our content delivery network (Bunny CDN);
an AI-assisted session plan is requested (see Section 5);
your subscription status is checked (RevenueCat, Apple);
usage events and advertising-attribution data are sent (see Section 5).
Our analytics and attribution providers use this technical information, together with device identifiers, to recognise a device across launches and to match an install to the advertisement that produced it. We do not use it to build a profile of your health, and no measurement, scan, or session content is part of it.
For the avoidance of doubt, the App does not collect, and contains no code capable of collecting:
photos, videos, or camera frames;
audio, and it never requests microphone access;
your location, at any precision;
your contacts, calendar, messages, files, or photo library;
your browsing or search history;
crash-reporting telemetry — the App contains no crash-reporting SDK;
any image, angle, measurement, posture finding, or session content as part of an analytics or advertising event — what we do send is listed exhaustively in Section 5.
We measure how the App is used, and which advertisement brought someone to it, through two providers: Scate (product analytics and remote configuration) and Adjust (advertising attribution, which is delivered inside the Scate SDK). This section describes exactly what that involves.
The App sends a fixed, hand-written list of events. It does not send a general stream of everything you do, and it cannot: every event the App is capable of sending is declared in one file in our source code.
Launch checkpoints — that the subscription service started, that attribution started, and that the opening screen finished.
Setup progress — that the intro carousel opened, which intro card is on screen, which of the seven setup questions is on screen, and that setup finished.
The answers you give during setup. This is the part to read closely. When you answer a setup question, the answer is sent as the value of that question's event: your age, your sex, the moods you pick for that day (for example "tired", "stiff", "sore"), the lifestyle options you tick, how often you say you move, the areas of your body you mark as sore on the body map (as a body region, for example "neck" or "lower back" — never the individual points you touched), and the long-term goal you choose. A selection you take back is not sent.
Subscription funnel — that the paywall was shown, that a purchase was started, cancelled, failed, restored, or completed, which of the App's screens the paywall was opened from, and whether the purchased plan was weekly, monthly, or yearly.
Engagement — that the main screen opened, and which tab you moved to, including when you open the scan screen or a practice session. Opening the scan is reported; what the scan measured is not.
Session creation — that a session was requested, and that it succeeded or failed, together with whether the account is subscribed. The session's contents — which poses, for how long, for which part of your body — are not sent.
Service outcome — whether the one network request the App makes on your behalf (the AI planner in Section 6) succeeded or failed.
What is never in an analytics event: any image or camera frame, any measured angle or capability, any posture finding, any pose, any session or its duration, and any note. Your scan results and your practice content stay between your device and our own cloud database.
Our analytics provider may place your device into a test group in order to compare two versions of a screen — for example, which subscription offer is presented. Your device's group is recorded with the events above. These tests change what the App looks like or which offer it shows. They never change how your body is measured, which exercises are selected, or any safety rule.
If you reached Splay through an advertisement, we want to know which one. Adjust matches your install, and any subsequent subscription, to that advertisement. To do it, Adjust processes device and network information, and — only if you allow it — your device's advertising identifier (IDFA). The subscription service also receives your Adjust device identifier and device identifiers so that a purchase can be matched to the campaign that produced it.
This is "tracking" as Apple defines it, and we ask first. On iOS, the App presents the App Tracking Transparency prompt on the first screen after launch.
If you allow tracking, the identifiers above may be used to link your activity in Splay with advertising data from other companies' apps and websites, for measuring advertising.
If you ask the App not to track, no advertising identifier is used and no such linking takes place. We may still learn, in aggregate and without identifying you, that a campaign produced installs.
You can change your mind at any time in iOS Settings → Privacy & Security → Tracking.
Declining costs you nothing. No feature, limit, price, or piece of content in the App depends on your answer.
The product-analytics events in Section 5.1 are sent whether or not you allow tracking; what your answer controls is the advertising identifier and the cross-app linking described here.
A build of the App configured without an analytics identifier sends nothing at all, opens no connection to these providers, and never presents the tracking prompt. This is the state every automated test of the App runs in.
Splay builds each session on your device first. Once it already has a complete, safe session, it may ask an AI model to refine the ordering and write short guidance notes.
When that happens, the App sends a compact brief through our own server (a Google Cloud Run service hosted in the European Union, region europe-west1), which forwards it to our AI provider, OpenAI. The brief contains:
your measured angles and their estimated levels;
the posture observations from your scan;
how you said you feel today, and how many minutes you asked for;
the body areas you flagged and the safety substitutions already applied;
your goal, your age and your sex;
the list of poses the App has already cleared as safe for you, and the poses you practised recently.
The brief contains no name, no email address, no account identifier, no device identifier, and no image or video. Your anonymous uid is used to authenticate the request to our own server and is not forwarded to the AI provider.
The AI is advisory only: the App re-checks everything it proposes against its own safety rules before anything reaches you, and a failed or refused AI request costs you nothing but a short wait. The AI provider processes these requests only to return a response, under the data-usage policy that applies to its developer API — which, as at the date of this policy, does not use API requests to train its models. AI-generated text may be inaccurate; see the Terms of Use.
The answer is cached under your anonymous identifier so that the same question is not asked twice.
We use the information described above to:
measure your mobility and build stretching sessions that suit it;
remove poses that would be unsafe given the areas you have flagged;
keep your history, streaks, and progress available when you reopen the App;
validate your subscription status and apply free-tier limits;
diagnose and fix faults in the service;
understand how the App is used, so we can decide what to build and what to fix;
measure which advertising brings people to Splay, and compare two versions of a screen;
comply with applicable legal obligations.
We do not use your health-related information — your scans, measurements, posture findings, or practice content — for advertising or marketing, and we do not use any of your information for automated decisions producing legal effects.
Legal bases (GDPR / KVKK). Where the GDPR or KVKK applies, we process your health-related information on the basis of your explicit consent, given when you choose to run a scan, complete a check-in, or flag an area of your body — and withdrawable at any time by contacting us or deleting the App. Other processing rests on the performance of a contract with you (delivering the App and your subscription) and on our legitimate interests in keeping the service secure and working. Advertising attribution and the use of an advertising identifier rest on your consent, which is what the App Tracking Transparency prompt asks for and which you can withdraw at any time in iOS Settings.
Service
Provider
What it receives
Authentication and cloud database
Firebase / Google
Your anonymous identifier and the data in Section 4.2–4.3
AI session planning
OpenAI, via our own EU server
The brief described in Section 5
Subscription management
RevenueCat
Your anonymous identifier and your purchase status
In-app purchases and distribution
Apple
Your purchase, under your Apple ID — we see only its status
Video delivery
Bunny CDN
The request for a stretching clip, and its technical metadata
Product analytics and A/B testing
Scate
The events in Section 5.1, including your setup answers, and your test group
Advertising attribution
Adjust (delivered inside the Scate SDK)
Install and subscription events, device and network information, and — only with your permission — your advertising identifier
Each provider operates under its own privacy policy and its own contractual data-protection commitments to us. We share with them only the minimum information needed to deliver the relevant feature.
We do not sell your personal data.
Advertising measurement is the one case that needs stating plainly. If you allow tracking, the identifiers described in Section 5.3 are used to match your install and your subscription to an advertising campaign, which involves our attribution provider exchanging that information with the advertising platform the campaign ran on. Under some laws — notably the CPRA in California — this counts as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands. Declining the tracking prompt, or turning tracking off in iOS Settings, stops it. We never share your scans, measurements, posture findings, or practice content this way, or in any other way, with any advertising party.
Otherwise, we share information only:
with the service providers listed in Section 7, strictly to operate the App;
when required by law, court order, or a lawful request from a public authority;
where necessary to establish, exercise, or defend legal claims, or to protect the rights, safety, or property of our users or of us;
in connection with a corporate transaction (merger, acquisition, asset sale), in which case we will notify you through the App or our website before your data becomes subject to a different policy.
Your scans, sessions, check-ins, and profile are retained for as long as your anonymous identifier is in use, so that your history and progress remain available.
Cached AI answers are replaced whenever you take a new scan; older ones are discarded.
If the App cannot reach our cloud database, it runs entirely in the device's memory for that session and nothing is kept.
To have your data deleted, write to info@upsideappstudio.com — the Contact support row on the App's Profile screen opens a message to that address for you.
Because the App holds no name, email address, or account you could log in to, we usually cannot connect an incoming message to a stored record on our own. To act on a request we will need the anonymous identifier that the record is kept under, and we will tell you where to find it and what we need. Where we genuinely cannot identify you from the data we hold, we are not required to act on an access or erasure request until you can supply information that identifies the record (GDPR Article 11) — this is a consequence of the App deliberately not knowing who you are.
Note that deleting the App from your device does not by itself erase the cloud record, because the anonymous identifier is preserved in the iOS keychain so that a reinstall finds your history. Use the request above to erase it.
We use encrypted transport (TLS) for everything the App sends, scoped per-user access rules on our database so that one user's record cannot be read by another, and authenticated endpoints for the AI service. Our AI proxy verifies a valid authentication token before it will answer.
No digital system can guarantee absolute security. We cannot promise that unauthorised access will never occur, and you use the App at your own risk.
Depending on where you live, you may have the right to:
access the personal information we hold about you;
rectify information that is inaccurate or incomplete;
erase your information ("right to be forgotten");
restrict or object to certain processing;
port your data to another service in a machine-readable form;
withdraw consent you previously gave, without affecting processing already carried out;
opt out of the sharing described in Section 9 — in the App, by declining the tracking prompt, and at any time afterwards in iOS Settings → Privacy & Security → Tracking, which is the single switch that turns it off;
not be discriminated against for exercising these rights (CCPA) — and note that nothing in Splay changes, costs more, or is withheld if you decline tracking.
Under KVKK Article 11 you additionally have the right to learn whether your personal data is processed, to request information about the processing, to learn its purpose and whether it is used accordingly, to know the third parties to whom it is transferred, and to request notification of corrections or erasure to those third parties.
To exercise any of these, contact info@upsideappstudio.com. We will respond within 30 days (KVKK), one month (GDPR), or 45 days (CCPA), as applicable to you. There is no charge for a reasonable request.
If you believe we have handled your data improperly, you may lodge a complaint with your local supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK); in the EU, your national data protection authority.
Splay is not directed to children under 13 years of age, and the App will not accept an age below 13. We do not knowingly collect personal information from children under 13.
Where the GDPR or an equivalent law sets a higher age for consenting to data processing on one's own (16 in some countries), a parent or guardian should give the consents described in this policy — including the answer to the tracking prompt — on the child's behalf. If you believe a child has provided us with personal information, contact us at info@upsideappstudio.com and we will remove it.
We are based in Türkiye. Our cloud database and AI proxy are hosted in the European Union; our subscription, analytics, attribution, and AI providers are based in the United States or process data there. Your information may therefore be processed outside the country in which you live.
Where required, these transfers are covered by appropriate safeguards — Standard Contractual Clauses for transfers out of the EEA, and the explicit consent or contractual-necessity grounds permitted by KVKK Article 9 for transfers out of Türkiye.
We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated through the App before they take effect. Continued use of the App after a change indicates acceptance of the updated policy.
If you have questions or concerns about this Privacy Policy or your data:
Upside App Studio Istanbul, Türkiye Email: info@upsideappstudio.com