Last updated 21 August 2026 · Version 1.5 (beta)

Privacy Policy

Pull Up School is a pull-up training log for iPhone. It can also count your reps for you, using the motion sensors in the phone in your pocket.

This policy explains exactly what the app stores, why it stores it, and what happens to it. It is written for the current beta version of the app.

In short

• There is nothing to sign up for. No email address, no password, no profile to fill in, no feed. The app creates an anonymous account for your install by itself, the first time you open it.
• The app records how your phone moved during every recorded set, and sends those recordings to us. They are the raw material used to make the rep counter more accurate. See Why we keep motion recordings.
• A recording carries no name, no contact details, no location, no audio and no images. It does carry a Tester ID: a random number identifying your install, so everything sent from one phone belongs together. We cannot tell whose phone that is. See Your Tester ID.
• The app never listens. It speaks to you, but it has no access to your microphone.
• No tracking, no advertising, no analytics, no third-party ad code.
• Once a recording has been sent, it is with us. Deleting the app does not remove it, and neither does reinstalling. You can ask us to delete it: see Your rights.
• The waitlist on this website is a separate thing from the app, and it is the one place we hold an email address. See The waitlist on this website.

Who is responsible

Pull Up School is made by Pieter de Kroon, based in the Netherlands, acting as the data controller for the processing described in this policy.

Questions, requests or complaints: get in touch through pieterdekroon.com.

What the app stores

Your training log

The workouts you log: the date of each workout, and for every set the resistance band, bodyweight or added weight you used and the number of reps. For sets that were counted automatically, the app also stores the number the detector originally counted and whether you confirmed or corrected it.

Your settings

Small preferences: the band or weight you used last, your countdown length and your voice-feedback choice.

Your Tester ID

The first time you open the app, it creates an anonymous account for your install so that recordings can be sent and kept together. That account is a random number, shown at the bottom of Settings as your Tester ID. Tap it to copy it.

Stored with it are a few technical details about the install:

• which iPhone model it is running on (for example iPhone14,5);
• which version and build of the app it is running;
• when the install was first seen, and when it was last used.

Those are there because a recording only means something if we know which sensors and which build produced it. A bug that only appears on one phone model, or only in one build, is otherwise impossible to find.

The Tester ID survives deleting the app. It is kept in the iPhone Keychain rather than in the app itself, so reinstalling gives you the same ID and the same account back. That is deliberate: it is also what lets you ask us for your recordings later.

A Tester ID carries no name, email address or anything else about who you are. It ties recordings to an install, not to a person. We cannot connect it to you unless you tell us it is yours.

Motion recordings

Every time you use Record set, the app writes a recording of that session. A recording contains:

• a timestamp for when the session took place;
• measurements of how hard the phone was accelerated and how fast it was rotating;
• the decisions the rep detector made along the way ("rep counted", "half rep, not counted", and so on);
• how many reps were detected;
• the Tester ID of the install that made it.

A recording contains no names, no contact details, no location, no audio and no images. Apart from the Tester ID, it is a stream of numbers describing movement.

You can view and share your recordings under Settings → Motion recordings. A recording is removed from your phone once it has been sent to us, because sending it is what it is for.

What the app does not touch

The app does not use your microphone. It does not read from or write to Apple Health. It does not ask for your location, your contacts, your photos or your camera.

Why we keep motion recordings

This is the part worth reading twice, because it is a deliberate choice.

Counting pull-ups from a phone in a trouser pocket is genuinely difficult. The phone cannot see you; it can only feel movement, and it has to tell a real pull-up apart from a leg swing, a re-grip or you walking back to the bar. The only way to make that judgement reliably is to compare what the detector concluded against what actually happened, on real recordings from real people with real phones and real pockets.

So the app deliberately keeps the raw movement of every recorded set, rather than throwing it away after counting. When the counter gets something wrong, that recording is what makes it possible to find out why and to fix it, and then to check that the fix does not break the sessions that already worked.

The same reasoning is why the app asks you, after each recorded set, whether the number was right. Your answer is stored next to the number the detector came up with. A recording is far more useful when we know what truly happened during it.

What leaves your phone

Motion recordings

Motion recordings are sent to us so they can be used to improve the rep detection. This happens as part of using the app; you do not have to do anything, and there is nothing to fill in. Sent with each recording are the number of reps it produced, your answer to whether that number was right, and the Tester ID of the install it came from.

What is sent is the movement, the detector's decisions and the technical details of the install described above. No name travels with it, no email address and no location, because the app holds none of those things in the first place. Recordings from one phone can be recognised as coming from the same phone; that is what the Tester ID is for.

What we do with a recording

We use it for one purpose: improving the rep detection in Pull Up School. It is replayed against the detector to find out where it went wrong, and it becomes part of a set of test recordings that every future change is checked against.

We do not sell it, we do not publish it, and we do not use it for anything other than making the app work better. It is not combined with any other source of information about you.

Apple TestFlight

While the app is in beta, it is distributed through Apple's TestFlight. Apple processes your participation as a tester, including your email address, crash reports and any feedback you send through TestFlight, under Apple's own privacy policy. We can see crash reports and the feedback you submit; we cannot see anything else about your phone through TestFlight.

The waitlist on this website

If you enter your email address on this website to be told when a build is ready, we store that address for one purpose: sending you that message.

We use it to let you know when there is a build worth handing over. It is not a newsletter, it is not used for advertising, and it is not shared with or sold to anyone. The legal basis is yourconsent (Article 6(1)(a) GDPR), given when you submit the form.

Stored alongside your address are three technical details:

• the date and time you signed up;
• the browser and operating system your browser identifies itself as (its user agent);
• the address of the page you arrived from, if your browser sent one.

Those three are there to tell a real signup apart from an automated one, and to see whether a sudden run of addresses is genuine interest or a script. They are not used to build a profile of you and are not combined with anything else.

The waitlist is not connected to the app. An address on this list is not linked to a Tester ID, and we have no way of telling which install, if any, belongs to it.

This website sets no cookies, carries no advertising code and does not follow you to any other site. It does count visits. That is Vercel Web Analytics, which runs without cookies and records which page was opened, roughly which country it was opened from, and what kind of browser and device did it. There is nothing in that we could tie back to you.

You can ask us to remove your address at any time through pieterdekroon.com, and we delete the list once the beta has ended and everyone on it has been invited. Removing your address removes those three details with it.

Who else handles this, and where

Two companies process data on our behalf. Both act only on our instructions, under their data processing terms, and neither is permitted to use what they hold for their own purposes.

Vercel

This website is hosted by Vercel Inc. (United States). Vercel serves the pages and runs the small server-side function that receives the signup form. That function runs in Vercel's Frankfurt region, inside the European Union. Vercel also processes the ordinary request data any web server sees, such as your IP address, in order to deliver the site and protect it from abuse. Nothing from the app passes through Vercel.

Supabase

Supabase Inc. (United States) runs the database and file storage behind both the app and the waitlist, hosted in its London region in the United Kingdom. Held there are: the motion recordings themselves, the rep counts and confirmations stored with them, the anonymous accounts and the install details listed under Your Tester ID, and, separately, the waitlist addresses.

The United Kingdom is outside the European Union. Transfers there are covered by the European Commission's adequacy decision for the UK, which recognises its data protection regime as offering an equivalent level of protection, so no additional safeguards are required. Where either company's US parent is involved in processing, that is covered by the safeguards in their data processing terms.

Legal basis

Motion recordings and your Tester ID. A recording carries nothing that identifies you by name, but it is tied to a Tester ID that stays the same across sessions and installs, which means everything sent from one phone can be linked together. That makes it pseudonymousdata rather than anonymous data: the GDPR applies to it in full, and so do all of your rights. We rely on our legitimate interest (Article 6(1)(f) GDPR) in making the rep counter work correctly, weighed against the fact that a recording describes movement only, is not linked to your identity, and is not combined with anything else about you.

Your waitlist email address. Your consent, as described above.

The technical details stored with it (time, user agent, referring page). Our legitimate interest (Article 6(1)(f) GDPR) in keeping the signup form usable and free of automated submissions. They are deleted together with the address they belong to.

How long we keep it

On your phone: your training log and settings stay for as long as you keep the app. A recording stays until it has been sent to us, or until you delete it in the app. Deleting the app removes the log and any recordings still on the device, but not your Tester ID, which is kept in the Keychain, and not anything already sent.

Recordings we have received: we keep them for as long as they are useful as test material for the detector. There is no automatic expiry date on them at the moment, so if you want yours gone, ask and we will delete them. Any numbers we derive from a recording for testing purposes (for example "this recording should produce 8 reps") may be kept afterwards, without the underlying recording.

Waitlist addresses: until the beta ends, or until you ask us to remove yours, whichever comes first. The technical details stored with an address are deleted at the same moment as the address itself.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. In practice, for this app:

• Everything on your phone is already in your hands. You can read every recording still on the device and share it to any app you like.
• For recordings we have received, open Settings, tap your Tester ID to copy it, and send it to us. With that number we can find everything that came from your install, send you a copy, or delete it. Telling us your Tester ID is what makes that possible: from that moment we know the connection between you and that install, and if you would rather we did not, simply do not send it.
• For your waitlist address, get in touch through pieterdekroon.com and we will send you a copy or delete it.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Children

Pull Up School is not intended for children under 16.

A note on what the app is not

Pull Up School is a training log, not a medical device. The rep count, the range-of-motion estimate and anything the voice says are informational only, and are not medical, diagnostic or training advice. Train within your limits.

Changes to this policy

The app is in active development. If what we collect or what we do with it changes, we will not change it quietly: this policy will be updated and re-dated before it happens, and we will keep older versions available so you can see what changed.

Contact

Pieter de Kroon, pieterdekroon.com