Effective 24 September 2026. This policy explains what Bounty collects, why, who processes it, and the choices you have. It is written to be read.
Bounty is a gym-tracking app for iPhone and iPad, made and operated by Tolga Bilen ("Bounty", "we"). Contact: help@bountyliftapp.com. For anything about your personal data, write to that address with "Privacy" in the subject.
Account. Your email address, username and a hashed password, or the identifier Apple or Google gives us when you sign in with them (Sign in with Apple can hide your real email; we then only get the relay address). We use these to run your account, sign you in and send account emails.
Profile. Your display name, avatar photo, bio, title, the frames, banners and stickers you equip, your sensei choice and your language and unit preferences.
Training data. Workouts, exercises, sets, weights and reps, personal records, routines and programs, body weight, streaks, the answers you gave during onboarding (goal, experience, training days, injuries, height, weight, age), your bounty and rank, credits and chests.
Photos and video. Progress ("physique") photos and victory shots are stored on your device. Photos you send to the AI body scan are transmitted for analysis (see section 4) and are not kept by our servers; the scores and the generated image are stored in your account so you can compare later. Photos or clips you attach to a post are stored with the post so your friends can see them.
Food journal. Meal descriptions you type or dictate, meal and label photos you scan, barcodes, and the estimates that come back. Dictation is transcribed on your device by iOS; only the resulting text leaves the device.
Social activity. Posts, captions, comments, likes, friend requests, crew membership, duels, board placement and reports you file. Other users can see your username, avatar, equipped cosmetics, bio, bounty, rank, posts and crew.
Location. Only when you tap a feature that needs it (tagging a gym, finding nearby restaurants), only while the app is in use, and only after iOS asks you. The coordinates are used for that lookup and are not stored as a location history.
Apple Health. If you allow it, Bounty writes finished workouts and their active energy to Apple Health. Bounty does not read your Health data, and Health data is never used for advertising or shared with anyone.
Purchases. Bounty PRO is sold through Apple. We receive the purchase state (which plan, active until when). We never see your card or bank details.
Device and usage data. If you allow analytics (it is off until you say yes), we record which screens and features are used, the app version and coarse device type, tied to a random identifier and a hashed form of your username, never your email or name. There is no advertising identifier and no tracking of you across other apps or websites.
Support. What you send us when you report a bug, post feedback or email us.
To provide the app you asked for (contract); to keep your account safe and prevent abuse such as false lifts, spam or harassment (legitimate interest); to answer support requests (contract); to send account emails such as verification and password reset (contract); to send occasional tips and reminders by email, which you can stop with the link in any of them (legitimate interest, and consent where your law requires it); to understand which features work, only if you allowed analytics (consent); to comply with law.
Some features send your input to AI models run by other companies. Meal estimates send the meal text or photo to Anthropic (Claude) and Google (Gemini), with nutrition matching against USDA FoodData Central and Open Food Facts. Sensei coach chats send your message and a summary of your recent training to Anthropic. Scan Your Potential sends the photo you choose to Google (Gemini) to be assessed and to generate the projected image. These providers process the data to return a result under their business API terms; we have not opted into any programme that lets them use your data to train their models. Photos are not retained by Bounty's servers after the request. AI output can be wrong: estimates are estimates, the coach is not a doctor and the scan is entertainment and motivation, not a medical or body-composition measurement.
Each of them processes data on our instructions and under their own security commitments. Some are in the United States or the European Union; where your law requires it, transfers rely on standard contractual clauses or an equivalent safeguard.
We do not sell or rent your data. We do not show ads. We do not share data with data brokers. We do not track you across other companies' apps or sites. We do not use your Health data for anything but writing your workouts. We do not read your messages to other users except when one is reported.
Account data stays until you delete your account or ask us to. Content you posted is removed with the account. Photos you send to the AI scan are not kept after the request. Analytics events are kept for at most 12 months. Copies in backups expire within 30 days. Data stored only on your device is deleted when you delete the app, reset the account in Settings, or delete a photo.
Delete your account in Settings › Delete Account: it erases your account on our servers and on the device. Export your data in Settings › Export My Data (CSV). Analytics can be switched on or off in Settings at any time. Emails: unsubscribe with the link in the email. Permissions (camera, microphone, photos, location, Health, notifications) are managed in iOS Settings.
Depending on where you live (for example the EU/UK GDPR, the California CPRA, the Australian Privacy Act or Indonesia's Personal Data Protection Law) you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict certain processing, to withdraw consent, and to complain to your data-protection authority. Email help@bountyliftapp.com and we will answer within 30 days. We will not treat you differently for exercising a right.
Bounty is for people aged 13 and over (or the minimum age in your country, if higher). If you are under 18 you need a parent or guardian's permission. We do not knowingly collect data from anyone under 13; if you believe we have, email us and we will delete it. The AI body scan refuses photos of anyone who appears to be under 16.
Traffic is encrypted in transit. Passwords are stored as salted hashes. Access to the server is limited to what the app needs. No system is perfectly secure; if a breach ever affects you we will tell you and the authorities as the law requires.
Bounty is a native app and does not use browser cookies or advertising trackers. It keeps your data in the app's own storage on your device so it works offline.
When this policy changes in a way that matters, the app will show you the new version and the date above will change. Continuing to use Bounty after that means you accept the updated policy.