UQUESTPrivacy Policy
Last updated: 29 October 2026
This policy explains what personal information Uquest collects, why, who receives it, where it goes, how long we keep it, and your rights. It covers the Uquest web app (app.uquest.app), the website (uquest.app) and our future mobile apps.
1. Who we are
UQUEST (Pty) Ltd ("Uquest", "we", "us") is a private company registered in South Africa, registration number 2026/788036/07, at 62B Justice Mahomed, Pretoria, 0181, South Africa.
We are the responsible party under South Africa's Protection of Personal Information Act (POPIA) and the controller under the EU and UK General Data Protection Regulations (GDPR).
- Information Officer: Kelton Mdakane, Director
- Contact: support@uquest.app
2. The short version
- We collect what you enter to track your training and nutrition, including health information. We ask for your consent to use it.
- We never sell your information and never use it for advertising.
- Your information is stored in the United States. If you use the AI coach or photo scan, relevant parts go to OpenAI to generate a reply.
- Analytics are off unless you turn them on, and never include health, food or chat data.
- You can delete your account in the app at any time. Everything is permanently deleted 30 days later.
3. Information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address and password (stored hashed by our authentication provider; we never see it), or Google sign-in | You, or Google |
| Profile | Display name, age, sex, height, weight, goal weight, goal, activity level, calorie and macro targets, unit preference, optional profile photo | You |
| Coaching preferences | Goals, past struggles, preferred coaching style, injuries or physical limitations, dietary preferences or restrictions, equipment access, notes for the coach | You |
| Health and fitness logs | Body weight entries, food and nutrition logs, workouts and activities, rest days, daily notes | You |
| AI coach | Your messages to Q and Q's replies, a short AI-written summary of earlier chats (Q's memory), weekly reviews and mid-week check-ins | You, and generated by the AI coach |
| Meal photos | Photos you take with the photo scan feature. We do not store them | You |
| Subscription | Plan, subscription status, renewal date, and identifiers from Paddle and RevenueCat. Never card details | Paddle, RevenueCat |
| Analytics (only if you opt in) | Which features you open and when, linked to a random ID. Never health, food or chat content, your email or your name | Your use of the app |
| Support and feedback | Your emails to support@uquest.app and messages you send through the in-app feedback form | You |
| Technical | IP address, browser or device type, and timestamps in server and hosting logs | Your device |
| Consent records | When you accepted the Terms and Privacy Policy, gave health data consent, and your analytics choice | You |
| Sign-up source | If you arrive through one of our links or ads, we record which campaign link you came from (the UTM tags: source, medium, campaign and ad name) and, if you choose to answer, how you heard about Uquest. This is stored on your profile. | The link you clicked, or your answer to an optional onboarding question |
| Marketing preference | Whether you have opted in to receive product updates and offers by email, and when. Only recorded if you tick the box at sign-up or turn on the toggle in your profile settings. | You |
If you sign in with Google, Google sends us your email address, name and profile picture link. Our authentication provider stores them with your login record, but the app does not use your Google name or picture.
4. Your health information
Your weight, body measurements, food intake, workouts, injuries, limitations and daily notes are health information. POPIA calls this special personal information, and the GDPR calls it special category data.
We process it only with your explicit consent, which we ask for separately when you create your account. You do not have to give it, but the trackers cannot work without it.
You can withdraw consent at any time by deleting your account in the app or by emailing support@uquest.app. Because the trackers depend on this information, withdrawing consent means we delete your health information and close your account. If you only want to keep your information away from our AI provider, stop using the AI coach and photo scan; the trackers work without them.
5. Why we use your information, and our legal basis
| Purpose | Information used | POPIA ground | GDPR / UK GDPR basis |
|---|---|---|---|
| Create and run your account | Account, profile | Needed to perform our contract with you (s 11(1)(b)) | Contract (Art 6(1)(b)) |
| Run the trackers and calculate your targets | Profile, health and fitness logs | Your consent (s 27(1)(a)) | Explicit consent (Art 9(2)(a)) and contract |
| AI coach, weekly reviews, check-ins and photo scan, when you use them | Profile, coaching preferences, logs, notes, chat, meal photos | Your consent (s 27(1)(a)) | Explicit consent (Art 9(2)(a)) and contract |
| Manage your subscription and access | Subscription data | Contract (s 11(1)(b)) | Contract (Art 6(1)(b)) |
| Send account emails (confirmation, password reset) | Email address | Contract (s 11(1)(b)) | Contract (Art 6(1)(b)) |
| Answer support requests and feedback | Support messages, account details | Contract, or our legitimate interest in helping you (s 11(1)(f)) | Contract or legitimate interests (Art 6(1)(b), (f)) |
| Understand how the app is used | Analytics events | Your consent (s 11(1)(a)) | Consent (Art 6(1)(a)) |
| Understand which marketing channels lead to sign-ups | Sign-up source (UTM tags and heard-from answer) | Our legitimate interest in measuring marketing effectiveness (s 11(1)(f)) | Legitimate interests (Art 6(1)(f)) |
| Keep the service secure and prevent misuse, including repeat free trials | Technical information, the email hash of deleted accounts | Our legitimate interest in a secure, fair service (s 11(1)(f)) | Legitimate interests (Art 6(1)(f)) |
| Send you product updates and offers by email (only if you opt in) | Your email address and marketing preference | Your consent (s 11(1)(a) and s 69) | Consent (Art 6(1)(a)) |
| Meet legal, tax and accounting duties | Records we must keep | Legal obligation (s 11(1)(c)) | Legal obligation (Art 6(1)(c)) |
We do not sell your personal information, share it for advertising, or use it to build advertising profiles.
6. The AI coach (Q) and photo scan
Q is an artificial intelligence, not a person. When you message Q, or when we prepare your weekly review or check-in, we send OpenAI the information Q needs to answer: your profile, coaching preferences (including injuries and limitations), recent logs and daily notes, Q's summary of earlier chats, and your recent messages. When you use photo scan, we send the photo to OpenAI to estimate the meal's nutrition, and you confirm or edit the estimate before anything is saved.
We do not send OpenAI your email address, payment information, or your name as an account identifier. OpenAI processes this information for us under a data processing agreement, does not use it to train its models, and may keep it for up to 30 days to detect abuse unless the law requires longer.
Q's replies are generated automatically and can be wrong. They are not medical, dietetic or physiotherapy advice; see our Terms of Service.
7. Who receives your information
We use these service providers (operators under POPIA, processors under the GDPR). Each may use your information only to provide its service to us.
| Provider | What it does for us | Where it processes data |
|---|---|---|
| Supabase | Database, authentication, server functions, file storage | United States (us-east-1) |
| OpenAI | AI coach, weekly reviews, check-ins, chat summaries, meal photo analysis | United States |
| RevenueCat | Tracks which plan you are on (receives a random user ID and purchase events) | United States |
| Resend | Sends account emails | United States (us-east-1) |
| PostHog | Opt-in usage analytics, with no health data | European Union |
| Zoho | Support mailbox | United States |
| Cloudflare | Website hosting, content delivery, email forwarding, cookie-free website statistics | Global network |
| Optional Google sign-in, and storage of encrypted backups (Google cannot read them) | United States and global |
Paddle sells Uquest subscriptions as our merchant of record. When you buy, you deal with Paddle, which collects your payment details and handles tax under its own privacy notice. We receive only your subscription status and identifiers.
We may also disclose information when the law requires it (for example to a court, SARS or a data protection authority), to our professional advisers under confidentiality, or to a buyer if the company or its business is sold, in which case we will tell you first.
8. International transfers
Uquest is run from South Africa, and your information is stored and processed in the countries listed above.
- Under POPIA, we transfer information outside South Africa under binding data processing agreements that give protection substantially similar to POPIA (section 72(1)(a)), and with your consent, which we ask for when you sign up (section 72(1)(b)).
- Under the EU and UK GDPR, our providers that process EU or UK data in other countries are bound by the European Commission's Standard Contractual Clauses and the UK addendum, or are certified under the EU-U.S. Data Privacy Framework and its UK extension. Our backups in Google Drive are encrypted before upload, and Google cannot read them. You can ask us for a copy of the relevant safeguards.
9. Cookies and similar technologies
- In the app, your browser stores your sign-in session, your analytics choice and your workout log display preference. These are needed for the app to work or to remember your settings.
- Analytics identifiers are created only after you opt in. Nothing from our analytics provider is stored before that, and turning analytics off stops collection straight away.
- On uquest.app, we use Cloudflare Web Analytics, which counts page views without cookies.
- On the plans page, Paddle's checkout loads from Paddle and may use cookies to process your payment and prevent fraud, under Paddle's privacy notice.
10. How long we keep your information
| Information | How long |
|---|---|
| Account, profile, health and fitness logs, AI coach messages, Q's memory, reviews and check-ins | While your account exists. Permanently deleted 30 days after you delete your account, or after 2 years without a sign-in and without an active subscription (we will email you at least 30 days before) |
| Meal photos | Not stored by us. OpenAI may keep them up to 30 days to detect abuse |
| Information sent to OpenAI for coaching | Up to 30 days at OpenAI, to detect abuse |
| Subscription identifiers and status | While your account exists. Paddle keeps transaction records as its legal duties require |
| Analytics events | Turning analytics off stops collection. Your analytics data is deleted when your account is deleted |
| Support emails and feedback messages | 2 years after the conversation ends, or sooner if you ask |
| Server and hosting logs | A few days |
| Encrypted backups | Rotated. Deleted information leaves every backup within 35 days of permanent deletion |
| Email hash of a deleted account | For as long as we offer free trials |
| Marketing email list | Until you unsubscribe. We then keep only your email address on a do-not-email list |
11. Deleting your account
Delete your account at any time from Profile > Delete account. Your account is locked immediately and permanently deleted 30 days later. During those 30 days you can restore it by signing back in.
Permanent deletion removes your profile, logs, notes, coach conversations, reviews, check-ins, profile photo and analytics data. It cancels any subscription bought on our website. Subscriptions bought through the Apple App Store or Google Play must be cancelled in your device settings.
To stop repeat free trials, we keep a one-way hash of your email address. It cannot be turned back into your email address and is not linked to any other information.
12. Your rights
Wherever you live, you can ask us to:
- confirm whether we hold your personal information, and give you a copy
- correct information that is wrong or incomplete
- delete your information
- object to processing based on our legitimate interests, and to direct marketing at any time
- withdraw consent at any time (this does not affect processing before you withdrew)
If the EU or UK GDPR applies to you, you can also ask us to restrict processing, and to give you the information you provided in a structured, machine-readable format (portability).
To use any right, email support@uquest.app from the email address on your account. We may ask you to confirm your identity. Requests are free. We reply within 30 days (one month under the GDPR), and tell you if we need longer where the law allows.
You can complain to a data protection authority:
- South Africa: Information Regulator, inforegulator.org.za, enquiries@inforegulator.org.za, 010 023 5200
- United Kingdom: Information Commissioner's Office, ico.org.uk
- European Union: the authority in your country, listed at edpb.europa.eu
We would appreciate the chance to fix a problem first, so please contact us.
United States residents: our Consumer Health Data Privacy Policy explains your additional rights over health data, including under Washington's My Health My Data Act.
13. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The app does apply automatic rules you agree to in our Terms: it locks the trackers when a free trial ends, applies your plan's daily limits, and locks an account during the 30 days after you ask to delete it. Calorie and macro targets are suggestions you confirm or change. You can contact us about any of these.
14. Marketing emails
We send product updates and offers by email only if you opt in at sign-up or in your profile settings. You can withdraw at any time using the unsubscribe link in any marketing email or by turning off the toggle in your profile. Our email service provider will process your email address to send these emails. Account emails (such as password resets) are part of the service and are not marketing.
15. Security
We use encrypted connections (HTTPS/TLS) for all traffic, row-level security so only you can read your records, server-side control of subscription and billing data, secret keys kept only on our servers, signature checks on payment webhooks, two-factor authentication on administrator accounts, and encrypted, rotated backups. Only our director has access to production systems.
No system is perfectly secure. If a security compromise affects your information, we will notify you and the relevant authorities as the law requires.
16. Children
Uquest is only for people aged 18 or over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, email support@uquest.app and we will delete it.
17. Changes to this policy
We will post any change here and update the date at the top. If a change is material, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires.
18. Contact
UQUEST (Pty) Ltd · Registration number 2026/788036/07 · 62B Justice Mahomed, Pretoria, 0181, South Africa · support@uquest.app · https://uquest.app