SlouchPrivacy policy
Last updated 29 September 2026
The short version. Everything you tell SlouchPal about yourself (your answers, your routines, how they felt, your check-ins and your safety check) stays on your phone. We never see it. If you choose to use Friends, we keep what’s needed to connect you: a name, your pal, your streak, whether you moved today, and your messages. There are no ads and no tracking across other apps or websites. We collect anonymous usage data (which screens you reach and which steps you take, never your answers) to see where the app can be made better, and you can turn it off in Settings.
What stays on your phone
These are stored only on your device. They are not sent to us or anyone else:
- Your safety check answers
- What you told SlouchPal about yourself: which areas you want to focus on, how long you’ve noticed it, your space and equipment
- Your plan, your routines, and the feedback you give on each movement
- Weekly check-ins, walking goals and posture check answers
- Your pal’s look
- Your reminder time. Reminders are scheduled on the phone itself; no server is involved.
Erase All Data in Settings deletes all of this from your phone. Deleting the app does too.
Friends (optional)
Friends needs an account, made with Sign in with Apple (see below) - no password. Nothing is sent to us until you sign in. We store:
| What | Why |
|---|---|
| The name you choose, and your pal’s look and profile picture settings | So friends know who you are |
| Your streak, and on each day you move: that you moved, whether you finished the routine, and the names of the exercises (unless you turn that off in Settings) | So friends can see how you’re doing |
| Your friends, the people you’ve blocked, and your invite code | To connect you, and to keep people you’ve blocked away. Anyone who opens your invite link sees your name, so they know who it’s from |
| Messages and cheers you send and receive | To deliver them and show your conversations |
| Messages and profiles you report, and who reported them | So we can review them and keep Friends safe |
| A push notification token, if you allow notifications | To tell you about messages, cheers and accepted invites. A notification carries the sender’s name and, for a message, its text |
| Sign-in session records, which can include the IP address and device type used | To keep your account signed in and secure |
| Counters of recent actions, such as how many messages you sent in the last few minutes | To stop spam and abuse |
Friends never see your health answers, how a routine felt, your check-ins or your safety check. None of those leave your phone.
Our legal basis for this is providing the Friends feature you asked for (contract), and our legitimate interest in keeping it safe and free of spam.
Sign in with Apple
Friends uses Sign in with Apple, which also keeps your friends if you change phones. Apple gives us an identifier for you and an email address, or a private relay address if you choose to hide yours. We use them only to sign you in, and we keep the token Apple issues so that we can revoke it when you delete your account.
Subscriptions
Payments are handled by Apple. We never see your card details. The subscription screen is shown by Superwall, which receives a random ID for this install, basic device information (model, operating system, language and region), your subscription status and purchase receipts from the App Store, and events on that screen, such as when it was shown and whether a purchase or restore went through. We use this to show the right offer, unlock your plan, and see how the subscription screen is doing. Superwall never receives your answers, routines, check-ins or anything from Friends.
Usage data
To see where people get stuck and what to improve, SlouchPal sends usage events to PostHog: which screens are opened, and steps such as finishing onboarding, starting a plan, finishing a routine, answering a weekly check-in or opening the subscription screen. Each event carries a random ID for this install, the app version, the device model, the operating system, and language and time zone settings.
Usage events say that something happened, never what you said: not your safety check answers or outcome, not what you told SlouchPal about yourself, not which plan you’re on, not how a routine felt, not your check-in scores, and not your name, messages or anything from Friends. They aren’t linked to your Friends account or your email, there is no screen recording, and we don’t look up your location.
Our legal basis is our legitimate interest in understanding how the app is used so we can improve it. You can turn this off at any time with Share usage data in Settings. Erase All Data starts a new random ID, so nothing sent afterwards can be joined to what was sent before.
Who processes data for us
| Service | What for | Where |
|---|---|---|
| Convex | Hosts the Friends database and sign-in | European Union |
| Expo (650 Industries) | Relays push notifications to Apple | United States |
| Apple | Sign in with Apple, push notifications, payments | United States and elsewhere |
| Superwall | Shows the paywall and checks your subscription | United States |
| PostHog | Anonymous usage data | European Union |
| Cloudflare | Hosts this website and invite pages | Global |
Where data goes outside the UK or EU, it’s protected by the safeguards those providers offer, such as the EU Standard Contractual Clauses and the UK Extension to the EU–US Data Privacy Framework.
How long we keep it
- Friends data is kept for as long as your Friends account exists.
- Messages and cheers are deleted after 90 days.
- Invite codes expire after a week, and are deleted then.
- If a Friends account isn’t opened for a year, we delete it and everything in it.
- Delete Account in Settings deletes your profile, friendships, activity, messages and invites from our servers, and revokes Sign in with Apple.
- Usage events are kept by PostHog for up to a year.
- Reports are kept for up to a year, even if either account is deleted, so that abuse can still be looked into. A report holds the reported message or name, and who made it.
This website
This site sets no cookies and runs no analytics or tracking. Fonts and images are served from this site, not from third parties. Cloudflare, which hosts it, processes basic request logs (such as IP addresses) to deliver the site and protect it from attacks. An invite page asks our Friends server for the inviter’s name, and nothing else.
Children
SlouchPal is for adults. It isn’t intended for anyone under 18.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Most of it you can delete yourself in Settings. For anything else, email [email protected]. You can also complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
Changes
If this policy changes, we’ll update this page and the date at the top. If a change affects what we do with your data, we’ll tell you in the app.