FlowUp ENTR Download

Effective date: 2026-10-27

Privacy Policy

FlowUp is a personal training, nutrition and body-measurement app. This page explains what we collect, why, who processes it, how long we keep it and how you can delete it.

The data controller is Eren Bahadır (sole proprietorship). In this policy, "we" means the controller. The Turkish notice under the Personal Data Protection Law is on the KVKK page.

We collect only what the app needs to work:

  • Account: your Apple or Google sign-in identifier, the e-mail address and name that Apple or Google share with us (Apple may give a private relay address), your language and the date of your last visit. We never see your Apple or Google password. If you add or change an e-mail address inside the app, we send a verification code to it.
  • Profile: gender, height, birth date, activity level, training level, training place, equipment, measurement day and water target.
  • Body data (health-related): weight, neck, waist and hip measurements, estimated body fat and lean mass, silhouette choice, notes, and your goals.
  • Nutrition (health-related): logged meals and foods, calories and macros, water intake, and the photos you take or pick to recognize a meal.
  • Training: your programs, workouts, sets, repetitions, weights, effort ratings and notes.
  • Chat and voice with Flow: the messages you type or dictate, Flow's replies and the changes Flow makes to your plan. This may include things you choose to tell Flow, such as an injury or a health condition.
  • Subscription: your plan status, product, renewal state and expiry date. We do not receive your card or payment details; the App Store or Google Play handles payment.
  • Technical: a device label for each signed-in session, session tokens and short-lived usage counters (for free-plan limits).

FlowUp has no advertising, no ad or marketing SDK, no analytics service and no crash-reporting service. We do not sell your data, and we do not share it for advertising. We do not use push notifications; reminders and the rest-timer cue are local notifications scheduled on your device. We do not read your contacts, location or Apple Health / Google Health Connect data.

We use your data to create your account, calculate your goal, calories and plan, recognize meals, run Flow, provide your subscription, keep the service secure and answer your requests.

  • Performing the service you asked for (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
  • Your explicit consent for health-related data (weight, body measurements, nutrition, injuries you mention to Flow) and for transfers abroad (GDPR Art. 9(2)(a); KVKK Art. 6 and Art. 9). You give it when you create an account and enter this information, and you can withdraw it at any time by deleting your account or writing to us. Withdrawal means we can no longer provide the features that need this data.
  • Our legitimate interest in security and abuse prevention (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
  • Legal obligations such as tax and accounting records (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).

We use these service providers. Each receives only what its task needs:

  • Anthropic (Claude), USA: recognizes foods in the meal photos you scan, and powers Flow's chat and program editing. Photos and the text of your messages, together with the profile, plan and training context needed to answer, are sent to Anthropic for each request.
  • Google Cloud (Gemini speech), USA: turns Flow's text replies into spoken audio when voice is on. Only Flow's reply text is sent.
  • Apple and Google sign-in: verify who you are when you sign in or delete your account.
  • RevenueCat, USA: manages subscription status together with the App Store and Google Play. It receives an app user identifier and purchase information.
  • Apple App Store and Google Play: process purchases and subscriptions under their own terms.
  • Open Food Facts and USDA FoodData Central: when you look up a barcode or search a food, our server asks these public databases. The query is sent from our server without your account details.
  • Hosting: our API and database run on servers that we operate or rent for this purpose.
  • Speech to text: when you dictate to Flow, your phone's own speech recognition service turns your voice into text. We receive only the resulting text, not the audio. The speech service of your device's maker (Apple or Google) may process the audio under its own policy.

These providers act on our instructions for the tasks above. We do not allow them to use your data for their own advertising.

Anthropic, Google Cloud and RevenueCat are based in the United States, so your data is transferred outside Turkey and the European Economic Area for the purposes above. We rely on your explicit consent and on the safeguards the providers offer (such as standard contractual clauses) under KVKK Art. 9 and GDPR Chapter V.

  • Account, profile, body, nutrition, training, scan photos and goals: until you delete your account.
  • Flow chat messages: automatically deleted after 30 days. Flow action cards: 24 hours. Usage counters: 8 days.
  • Sign-in sessions: 30 days, or until you sign out.
  • When you delete your account, we erase your account and all of this data, including the stored meal photos, right away. Records that we must keep by law (for example invoices) and subscription records held by Apple, Google and RevenueCat follow their own retention rules. Data in our routine backups disappears when those backups are rotated.

In the app: Me tab, Account, Delete account, then confirm with Apple or Google. Without the app, e-mail us from the address on your account. Step by step: Delete your account.

Under KVKK Art. 11 and, where it applies, the GDPR, you can ask whether we process your data, get a copy, have wrong data corrected, have it deleted, object to processing, withdraw consent, and ask us to tell the providers we shared it with. Write to [email protected]. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Board (KVKK) or to your local data protection authority.

Traffic between the app and our server is encrypted (HTTPS). Session tokens are stored in the secure storage of your device and only a hash of the refresh token is kept on our server. Access to our systems is limited. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

FlowUp and Flow give general fitness and nutrition guidance. Body-fat results are estimates, not laboratory measurements. FlowUp is not a medical device and does not diagnose, treat or prevent any condition. Talk to a doctor before you change your diet or start training, especially if you are pregnant, have a health condition or an injury.

FlowUp is not directed to children under 13 and we do not knowingly collect their data. If you are under 18, use the app with a parent or guardian's permission; where local law sets a higher age for consent, that age applies. If you think a child has given us data, write to us and we will delete it.

If we change this policy in a significant way, we update the effective date above and, where required, tell you in the app.

Eren Bahadır (sole proprietorship / şahıs şirketi), Kavaklı Mah. Bağlar Cad. C Blok No:12 İç Kapı No:11 Beylikdüzü/İstanbul, Türkiye, [email protected]