Privacy Policy

1. Introduction

Welcome to PullPoint. PullPoint is a social training app: you can log any workout, follow and create workouts and plans, build a personal library of exercises, share your training and highlight videos with other athletes, message them, join events, and find places to train — today, calisthenics parks and outdoor workout spots worldwide. PullPoint also runs the website pullpoint.net, which publishes a free directory of those spots.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the PullPoint mobile application (the "App") and the website (together, the "Services"). Please read it carefully. Section 3 covers what applies to website visitors who don't use the App.

2. Information We Collect

2.1 Information You Provide

• Account and Profile Information: When you create an account, we collect your name, email address, username, and how you signed up (email and password, Sign in with Apple, or Google). You can add a profile photo, bio, and link, and choose settings such as your athlete type, a country flag, your weight unit, and your privacy and notification preferences.
• Training Data: The workouts and workout plans you create or save, and the workouts you log — exercises, sets, repetitions, weights, durations, dates, and notes — along with the statistics, progress, and achievements we calculate from them.
• Training Profile (optional): If you choose to fill it in, your answers to the training-profile questions: your training goals, gender, height, body weight, where you train, the equipment you have, your best sets of pull-ups, push-ups, squats, and dips (repetitions and any added weight), and your preferred weight unit. You can use PullPoint without it. See Section 8.
• Custom Exercises: Exercises you create, including their names and details, and any demo video you record or attach. Custom exercise demo videos are private and not shown to other users (see Section 5).
• Shared Workout Posts: When you share a completed workout, we collect the workout data, the Spot you trained at if you choose one, any photo you attach, private notes you add, and the audience you select.
• Highlight Videos: Videos you upload to your profile as highlights, their titles, and generated thumbnails.
• Spot Contributions: When you submit a new calisthenics park or outdoor workout location (a "Spot"), suggest a change, or add photos to one, we collect what you submit: the Spot's position, name, address, equipment, description, and photos, and — where your photos contain it — the location each photo was taken at (see Section 2.2).
• Community Content: Comments, likes, bookmarks, events you create or join, and reports you file about Spots, content, or other users.
• Messages: The content of messages and reactions you send through in-app messaging, including event group chats (see Section 17).
• AI Workout Generation: If you use AI workout or plan generation, your answers to its questionnaire and any notes you choose to add (see Section 7).
• Purchases: If you subscribe to PullPoint Pro, your subscription status and the transaction and purchase identifiers needed to verify it. Payment itself is handled by Apple or Google; we never receive your card details.
• Feedback and Support: Feedback you send from the App (together with your app version, platform, and operating system version) and anything you tell us when you contact us.

2.2 Information Collected Automatically

• Location Data: With your permission, the App uses your device's precise location to show Spots and distances near you. That calculation happens on your device. Your location is sent to our servers only in these cases:
  • If you turn on location sharing (it is off by default), your coordinates are sent to us and converted into your country, city, district, and neighborhood with the help of Mapbox. We store only those area names — not your coordinates or a location history — and use them for "nearby athletes", where other users can see them (see Section 5). Turning location sharing off, or revoking location permission, removes them.
  • To find events near you.
  • When you submit a Spot, its position is sent with your submission.
  To fill in an address, your device may also send coordinates to Apple (on iOS) or Google (on Android) for geocoding. We do not collect your location in the background.
• Photo Location Metadata: Photos can contain the location where they were taken. When you add photos to a Spot submission or a Spot update, the App reads that location and sends it with your submission so our reviewers can place and verify the Spot. It is shown to reviewers, not to other users. If you don't want this, turn off location tagging in your camera settings or remove the metadata before uploading.
• Advertising Identifiers: We and our advertising partner, Google AdMob, use advertising identifiers such as Apple's Identifier for Advertisers (IDFA) and the Google Advertising ID to show and measure ads, including personalized ads. On iOS we ask your permission through App Tracking Transparency first, and where the law requires it (for example in the EEA, the UK, and Türkiye) we ask for your consent through Google's consent form. See Section 12.
• Analytics and Diagnostic Data: Google Analytics for Firebase collects app-usage events (such as screens viewed and features used) and an app-instance identifier. On iOS it also records sign-ups, searches you run, and your PullPoint account ID, and Firebase Crashlytics collects crash reports and diagnostics.
• Device Information: Device model, operating system and version, app version, language setting, and push notification tokens.
• Log Data: When the App or website talks to our servers, our systems record technical information such as your IP address, the request made, and the time. Because requests from location features contain coordinates, these can appear in our server logs.

2.3 Information from Third Parties

• Sign-In Providers: If you sign in with Apple or Google, we receive your name, email address, and account identifier as permitted by the provider and your settings.
• App Stores and RevenueCat: Apple, Google, and our subscription provider RevenueCat tell us whether your subscription is active, renewed, or cancelled.

3. The PullPoint Website

You can read pullpoint.net without an account. The website sets no cookies and runs no analytics or advertising trackers.

• Server Logs: Our hosting provider, Amazon Web Services, may record standard request information such as your IP address, the page requested, your browser's user agent, and the time.
• Distance From You: On Spot pages you can ask how far each Spot is from you. Only if you allow your browser's location prompt, your position — rounded to roughly 11 meters — is sent to our servers, which return approximate distances. We do not store it. Your browser keeps it for up to 10 minutes in the same tab, so the next page doesn't ask again.
• Spot Photos: Photos shown on the website are re-processed before publication, which removes any embedded metadata such as location, and carry a PullPoint watermark.
• Share Pages: When someone opens a link to your profile, an event, or a Spot shared from the App, the website shows a preview. Profile previews show only your name, username, bio, and profile photo. Share pages are not indexed by search engines.
• Reporting a Spot: Anyone can report a Spot, or its photo, from the Spot's page. We store what you write and, only if you choose to give them, your name and email address, so our team can review the report and reply to you. Your IP address is used to limit how many reports one network can send, and appears in server logs as described above. Reports are kept as a record of how they were handled.

4. Spot Data and OpenStreetMap

Most Spot information in PullPoint — positions, names, and equipment — comes from OpenStreetMap, used under the Open Database License (see our Credits & Data Sources). The rest comes from our users and our team. Spot information describes public places, not people.

In September 2026 we rebuilt the Spot catalogue from OpenStreetMap. Spots our users created, and Spots with photos, were left unchanged. Spots with other community activity — comments, likes, bookmarks, events, or shared workouts — were never removed; some of them now carry an updated name, position, or equipment from OpenStreetMap, and all of that activity is still attached to them. Spots that could not be matched to OpenStreetMap, and duplicates, were removed from the App and the website.

We do not send any personal information to OpenStreetMap. Spots you submit are published in PullPoint only; we do not add them to OpenStreetMap.

5. User Content and Visibility

Content in PullPoint has different visibility depending on its type and the settings you choose. In the App's privacy settings you can choose who sees your friends list, workouts, contributions, highlights, and liked, commented, and bookmarked Spots, and who can message you — everyone, friends, or nobody.

• Public Content: Approved Spots and their photos, your public profile information, comments, and — depending on your settings — highlight videos and any workout, plan, or exercise you make public can be seen by other users.
• Published on the Web: Spot information — name, address, equipment, and a cover photo — is published on pullpoint.net, where anyone can read it and search engines and AI services can index it. Spot photos you contributed may appear there without your name.
• Audience-Controlled Content: Shared workout posts can be shown to everyone, to your friends, to athletes viewing the Spot you trained at, or to you only. A post you keep to yourself may still count toward a Spot's activity as an anonymous, locked entry that reveals neither you nor its content.
• Nearby Athletes: If you turn on location sharing, other users can see your country, city, district, and neighborhood in "nearby athletes". They never see your exact position.
• Private Content: Your workouts and workout plans are private by default, and your custom exercise demo videos are never shown to other users.

"Private" means content that is not visible to other users. It does not mean PullPoint cannot access the content. As described in Section 6, we may access, analyze, or remove any content, including private content, where necessary to operate the Services, comply with legal obligations, or respond to reports of abuse or illegal material.

6. Content Moderation and Reporting

• Automated Moderation: Uploaded images and frames from highlight videos are analyzed by Amazon Rekognition, an automated content-moderation service running in the European Union, to detect prohibited content such as explicit or graphic material. Media that does not pass moderation may be rejected and not stored.
• Reporting and Admin Review: Users can report Spots, comments, exercises, workouts, workout plans, shared workout posts, highlight videos, and other users, and anyone can report a Spot or its photo from the website (see Section 3). Reported content is reviewed by our administrators and may be removed, and the responsible account may be suspended or terminated.
• Blocking: You can block other users to limit interactions with them.
• Spot Review: User-submitted Spots and Spot changes are reviewed by our administrators before they become public.

7. AI Workout and Plan Generation

PullPoint Pro includes AI-generated workouts and plans. When you generate one, we send your questionnaire answers (such as your goal, available equipment, schedule, and focus areas), your training profile if you have filled it in (see Section 8) and a strength level we estimate from it, any notes you type, and our exercise catalogue to Anthropic's Claude model, which runs on Amazon Bedrock in the European Union. We do not send your name, email address, account ID, or location. Under Amazon Bedrock's terms, these requests are not used to train AI models.

Your notes are optional. If you mention an injury or other health information there, you consent to us using it to tailor your workout or plan; if you don't want it processed, leave it out.

Generated workouts and plans are saved to your account as private items marked as AI-generated. We also keep a count of how much you use the feature, to apply plan limits.

8. Training Profile

The training profile is a short, optional set of questions in the App about how you train: your goals, gender, height, body weight, where you train, your equipment, and your best sets. We offer it before you first create a workout or plan with AI, and as a dismissible card in the Workouts tab. You can skip it, answer only some questions, and change your answers at any time in Settings → Training profile.

• What we use it for: To estimate your strength level and to tailor AI-generated workouts and plans to you (see Section 7) — for example, sizing volume and choosing exercises you can do with your equipment. Nothing else.
• Who can see it: Only you. It is not shown on your profile or to other users, and it is not published on the website.
• What we don’t do with it: We don't use it for advertising, don't send it to our analytics or advertising partners, and don't sell it. The only provider that receives it is Amazon Web Services, which hosts our servers and runs AI generation.
• Deleting it: Your answers are deleted when you delete your account (see Section 14). To delete them without deleting your account, email contact@pullpoint.net.

Details such as your height, body weight, and gender can be considered sensitive or health-related personal data in some countries. We process them only because you choose to give them to us, for the purpose above, and you can withdraw that consent at any time by removing or changing your answers or by contacting us.

9. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services, including workouts, plans, workout logging, exercises, Spots, highlights, sharing, events, messaging, and AI generation.
• Tailor AI-generated workouts and plans to your training profile, if you have filled it in.
• Show Spots near you, distances, and location-based search.
• Create and manage your account, and process and verify subscriptions.
• Process, moderate, and display user content, and review Spot submissions.
• Send service notifications and push notifications, according to your preferences.
• Understand how the Services are used, diagnose crashes, and improve performance and features.
• Show advertising, including personalized advertising where you have allowed it, and measure its performance (see Section 12).
• Detect, prevent, and address fraud, abuse, spam, security issues, and prohibited content, and enforce our Terms of Use.
• Respond to your requests and comply with legal obligations.

10. Legal Bases for Processing

Where data protection laws such as the GDPR, the UK GDPR, or Türkiye's Personal Data Protection Law (KVKK) apply, we rely on:

• Contract: to provide the Services you signed up for — your account, training data, content, messaging, and subscriptions;
• Consent: for precise location, location sharing, photo location metadata, personalized advertising and tracking, push notifications, your training profile (including your gender, height, and body weight), and any health information you include in AI notes. You can withdraw consent at any time in the App or your device settings;
• Legitimate Interests: to keep the Services safe (moderation, abuse and fraud prevention), to understand and improve them through analytics and diagnostics, and to run the website;
• Legal Obligation: where we must keep or disclose information by law.

11. Sharing of Your Information

We do not sell your personal information for money. Some jurisdictions (such as California) define "sale" or "sharing" broadly enough to include giving identifiers to advertising partners for personalized advertising; you can opt out of that as described in Section 12. We share information in these circumstances:

• With Other Users: According to the visibility described in Section 5. Messages are delivered to their recipients.
• With Service Providers: Companies that run parts of the Services for us, listed below. They may use your information only to provide their services to us, and are required to protect it to the same or an equal standard as described in this Privacy Policy.
• Legal Requirements: If required by law, regulation, legal process, or a governmental request.
• Safety and Enforcement: If we believe it is necessary to investigate, prevent, or act on violations of our Terms, illegal activity, suspected fraud, or threats to anyone's safety.
• Business Transfers: As part of a merger, acquisition, or sale of assets.
• With Your Consent: For other purposes you agree to.

Google and Apple also process some of this data under their own privacy policies where they act on their own behalf — for example, Google for personalized advertising.

12. Analytics and Advertising

The App is free to use and supported by ads. It uses Google services to measure usage and show ads:

• Google Analytics for Firebase: Collects app-usage events and an app-instance identifier to help us understand how the App is used.
• Firebase Crashlytics (iOS): Collects crash reports and diagnostic data to help us improve stability.
• Google AdMob: Shows ads in the App, including personalized ads, using advertising identifiers such as the IDFA and the Google Advertising ID. Ad impressions and revenue are also reported to RevenueCat.

11.1 Personalized Advertising and Tracking

Where required by law (for example in the European Economic Area, the United Kingdom, and Türkiye), Google's consent form asks for your choice before any ads are personalized. On Apple devices we also use App Tracking Transparency to ask your permission before tracking you or using your advertising identifier. If you decline, you will still see ads, but they won't be personalized using your identifier.

11.2 Your Choices

• iOS: Settings → Privacy & Security → Tracking to control app tracking, and Settings → Privacy & Security → Apple Advertising to limit ad personalization.
• Android: Settings → Google → Ads to reset or delete your advertising ID and opt out of ad personalization.
• You can review Google's use of data for advertising at adssettings.google.com. These services are subject to Google's Privacy Policy and its description of how Google uses data from apps that use its services.

13. Data Storage, Security, and International Transfers

Your information, including uploaded images and videos, is stored with Amazon Web Services in the European Union (Stockholm, Sweden). Content moderation runs in Ireland, and AI generation in AWS's European Union regions.

Some of our providers — Google, Apple, Mapbox, and RevenueCat — process data in the United States and other countries whose data protection laws may differ from yours. Where the law requires it, these transfers rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses.

We protect your data with encryption in transit (TLS), access controls, and the security features of our hosting provider. Uploaded photos and videos are served from long, hard-to-guess web addresses rather than behind a login, so anyone who has a file's exact address can open it. No method of storage or transmission over the Internet is 100% secure, so we cannot guarantee absolute security.

15. Your Rights and Choices

14.1 In the App

• Access and Update: View and edit your profile and account information in the App's settings.
• Training Profile: View, change, or skip your answers in Settings → Training profile (see Section 8).
• Privacy Settings: Choose who can see each part of your profile and who can message you.
• Location: Turn location sharing off in the App at any time, or revoke location permission in your device settings. Some features need location to work.
• Advertising and Tracking: See Section 12.
• Push Notifications: Manage them in the App's notification settings or your device settings.
• Account Deletion: In the App's account settings. See Section 14 for what is deleted and what is kept.

14.2 Rights Under Applicable Laws

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data; to restrict or object to its processing; to withdraw consent; and to lodge a complaint with a data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK). To exercise any of these rights, email contact@pullpoint.net. We may need to verify your identity before acting on a request.

16. Children's Privacy

PullPoint is not intended for children under 13, and we do not knowingly collect personal information from them or show them personalized advertising. If you are under 13, please do not use the App. If we learn we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has given us personal information, contact us at contact@pullpoint.net.

17. In-App Messaging

• Messages are sent through and stored on our servers so they can be delivered. They are not end-to-end encrypted.
• Message notifications show the sender's name and a preview of the message, delivered through Apple's or Google's push notification service. You can turn message notifications off in the App's settings.
• We may access message content to enforce our Terms, respond to legal requirements, or investigate reports of abuse or misconduct.
• When you delete your account, your messages are deleted, including from the conversations of the people you messaged.
• Don't share sensitive information, such as financial details or passwords, in messages. Violations of our community guidelines may lead to suspension or termination.

18. Third-Party Services and Links

The Services link to third-party services — for example, opening a Spot in Apple Maps, Google Maps, or another map app, or visiting our social media accounts. What those services collect is governed by their own privacy policies, and we are not responsible for their practices.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes in the App and update the "Effective Date" above. Your continued use of the Services after a change means you accept the updated policy.

20. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or our data practices, contact us at: