Privacy Policy

Last updated: August 4, 2026

This policy describes how Pump Dump ("we," "us," "the app") collects, uses, and protects your information. Pump Dump is a social app for weightlifters to log workouts, track personal records, and share progress with people they follow.

Who we are

Pump Dump is operated by Pump Dump. Questions about this policy or your data can be sent to massspurs5@gmail.com.

Information we collect

Account information. Email address and password (handled by our authentication provider, Supabase Auth — we never see or store your raw password). If you sign in with Google or Apple, we receive the email address and name associated with that account, and a unique identifier from that provider.

Profile information you choose to add. Display name, bio, avatar photo, gym name, favorite lift, and years lifting. All of these are optional.

Content you post. Workout posts, including photos, captions, muscle-group tags, and logged lifts (exercise, weight, reps, and unit). Comments and likes you leave on posts. Posts you save (bookmark).

Social graph. Who you follow and who follows you, and — if your account is private — pending follow requests. Accounts you block or mute (this is private to you; the other person is not notified).

Safety reports. If you report a post or account, we store the report and the reason you gave, so it can be reviewed.

Location — only if you tag a gym. Tagging a gym on a post is optional. If you use it, we ask for your device's location once, at that moment, to suggest nearby gyms or let you add a new one — we don't track your location in the background, and we don't request it until you tap "Tag a gym." The gym's coordinates (a fixed, public venue location, not your personal location) are stored so the gym can be suggested to other lifters nearby. If you never use this feature, we never request or receive your location.

Push notification token — only if you turn on notifications. Push notifications are off by default. If you turn them on in Settings, we store a device push token so we can notify you about likes, comments, and new followers. Turning notifications off removes this token.

What we do not collect. We do not use advertising SDKs or third-party analytics/tracking libraries. We do not sell your data to anyone, for any reason.

How we use your information

• To operate the core features of the app: your feed, posts, profile, follows, comments, likes, notifications, and search.
• To calculate personal records and posting streaks from your logged workouts.
• To enforce safety features you or others use: blocking, muting, and reviewing reported content.
• To keep the service secure and prevent abuse.

We do not use your data for advertising, and we do not build advertising profiles about you.

Who we share it with

• Supabase — our database, authentication, and file-storage provider. Your account data, posts, and photos are stored on Supabase's infrastructure under their security and privacy commitments.
• Apple and Google — only if you choose to sign in using "Sign in with Apple" or Google Sign-In, in which case those providers handle the authentication handshake per their own privacy policies.
• Sentry — our crash and error reporting provider. If the app crashes or hits an unexpected error, technical details (device type, OS version, stack trace) are sent to Sentry so we can fix it. This does not include your workout content, and is used only for debugging, never advertising.
• Expo's push notification service — only if you turn on push notifications. Your device's push token is sent through Expo's relay to deliver notifications to your device; Expo does not receive your workout content, only the notification text (e.g. "Someone liked your pump").
• Other users, as intended by the app's design — your display name, bio, avatar, posts, and lift history are visible to your followers (or to everyone, if your account is public). Your followers/following lists are visible per the same rule. If you set your account to private, only approved followers can see your posts.

We do not share your data with data brokers, advertisers, or any other third party beyond what's described above.

Your choices and rights

• Edit or remove content at any time from within the app (edit your profile, delete individual posts).
• Control who sees your content by making your account private, and control who can follow you via follow-request approval.
• Block or mute any account, at any time, from that account's profile.
• Delete your account at any time from Settings → Delete Account. This permanently removes your profile, posts, photos, comments, likes, follows, and reports you filed. This action cannot be undone.
• Request a copy of your data or ask questions by emailing massspurs5@gmail.com.

Data retention

We keep your information for as long as your account is active. If you delete your account, your data is permanently removed as described above, except where we're legally required to retain certain records for a limited period (for example, to investigate abuse reports filed against you before deletion).

Children's privacy

Pump Dump is not directed at children under 13, and we do not knowingly collect information from children under 13. If you believe a child has created an account, contact us at massspurs5@gmail.com and we will remove it.

Security

We use industry-standard practices to protect your data, including encrypted connections (HTTPS) and database-level access rules that restrict who can read or write which data. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above and, where required, notify you in the app.

Contact

Questions, requests, or concerns about this policy or your data: massspurs5@gmail.com.