Privacy Notice

PUMP is operated by PUMP. For the purposes of data protection law, PUMP is the data controller for the personal data described in this notice.

• Account data — your name and email address when you create an account, and your login credentials (stored only as secure hashes).
• Profile data — your city, fitness goal, budget, favorite activities, and saved gyms, if you choose to add them.
• Calendar data — workout sessions and reminders you create.
• Usage and device data — basic telemetry such as pages visited, approximate location you search from, device type, and IP address.
• Support messages — anything you send us when you ask for help.

Payment details (card numbers, billing address) are collected and processed directly by Paddle, our Merchant of Record — we never see or store your full card details.

• Providing the service — creating your account, showing gyms near you, saving favorites, and running your calendar (performance of our contract with you).
• Security and fraud prevention — protecting accounts and payments (our legitimate interests).
• Product improvement — understanding how PUMP is used so we can make it better (our legitimate interests).
• Customer support — responding to your requests (performance of our contract / legitimate interests).
• Legal obligations — keeping records where the law requires it.

• Service providers — hosting, database, analytics, and email delivery providers that process data on our behalf.
• Paddle — our Merchant of Record, for the sale of PUMP Premium, subscription and payment management, tax compliance, and invoicing.
• Professional advisers — such as lawyers and accountants, where needed.
• Authorities — where we are required to by law.

We do not sell your personal data.

Some of our service providers process data outside the UK/EEA. Where that happens, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

We keep your personal data only for as long as needed for the purposes above — for example, while your account is active, and for a limited period afterwards to meet legal, tax, and accounting requirements. When data is no longer needed, it is deleted or anonymised.

Depending on where you live, you may have the right to access, correct, or delete your personal data; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. If you are in the UK/EEA, you also have the right to complain to your data protection supervisory authority. We respond to requests within one month. To exercise any of these rights, contact us via the support contact shown on your receipt or at checkout.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed credentials, and access controls that limit who can see personal data.

PUMP uses essential cookies and local storage to keep you signed in and remember your preferences. We do not use marketing cookies. You can clear cookies and site data at any time in your browser settings; doing so will sign you out.

We may update this notice from time to time. The "last updated" date at the top shows the current version; material changes will be flagged in the app.