Unison — Privacy Policy
Last updated: 8 September 2026
This explains what Unison knows about you, who else sees it, and how to get rid of it. It is written to be read, not to be survived.
Unison is operated from New South Wales, Australia. Contact: contactus@unisonfitnessapp.com
1. The short version
- We never record where you are. Unison uses GPS while you run, but only to measure how far and how much you climbed. No coordinates, no route, no map is ever stored — see section 3.
- Your email address is never shown to another user.
- We do not sell your information, and there is no advertising or analytics tracking in the app.
- You can delete everything yourself, permanently, from Settings.
2. What we hold
About you
| Your name | Shown to anyone who can see you |
| Your email | For signing in and resetting your password. Never shown to other users |
| Your password | Stored only as a cryptographic hash. We cannot read it |
| City and country | Optional, if you gave them at sign-up |
| Your time zone | So your challenge week starts on your Monday, not ours |
| Your profile photo | Optional |
| Your notification and background-tracking settings |
What you do
Your attempts and their splits — times, distance, elevation gain, whether GPS verified them — plus achievements, who you follow, who follows you, your cheers, your comments and likes, anyone you have blocked, and your rivalries.
For security
Sign-in sessions and short-lived password reset codes.
3. Location — what we do and do not keep
This deserves its own section because most fitness apps answer it differently.
When you record a run, your phone's GPS is used while the activity is running to work out two numbers: how far you went and how much you climbed. Those two numbers are saved.
Nothing else is. No latitude or longitude, no path, no start or finish point, no map. There is no route to look at, because none is kept — not by us, and not on our servers.
If you turn on background tracking, the same is true: it only means the measurement keeps working when your phone is in your pocket or the screen is off. It does not change what is stored.
You can decline location permission entirely and still use Unison — you time the activity yourself instead.
4. Who can see what
- Your email: nobody but you.
- Your workouts: people who follow you.
- Your profile photo: any signed-in Unison user. It is not public — there is no address anyone can open without being signed in.
- Your comments and cheers: anyone who can see the workout they are on.
- Anyone you block: you and they become invisible to each other, in both directions, everywhere in the app — including your photo. They are not told.
5. Who else handles it
We use a small number of services to run Unison. They only ever act on our instructions.
| Service | What it handles |
|---|---|
| Railway | Hosts the database — so, in principle, everything above |
| Cloudflare | Stores profile photos; routes email sent to our support address |
| Resend | Sends password reset emails — your address, and the code |
| Expo, Apple, Google | Deliver push notifications, if you allow them |
| Apple, Google | Are told a review was requested — never who you are, never what you did |
To be confirmed before publication: the countries in which Railway and Cloudflare store this data, so this section can name them. Australian privacy law requires disclosing overseas storage, and we should say where rather than gesture at it.
We do not sell your information to anyone, for any purpose. There is no advertising network and no analytics SDK in Unison.
6. How long we keep it
We keep your information while your account exists.
When you delete your account it is gone immediately and permanently — Settings → Delete account, confirmed with your password. That removes your profile, workouts, times, achievements, comments, cheers, follows, blocks, rivalries and photo. We cannot restore it afterwards, and neither can you.
Sign-in sessions end at once. Password reset codes expire on their own within minutes.
Deleting your account also removes rivalries you were part of, which means they disappear from the other person's history too.
7. Your rights
You can:
- See what we hold — most of it is visible in the app; ask us for the rest.
- Correct it — your name, city, country and photo are editable in the app.
- Delete it — yourself, from Settings, at any time.
- Complain. If you think we have mishandled your information, tell us first at contactus@unisonfitnessapp.com. If we do not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
8. Security
Passwords are stored only as bcrypt hashes — we never hold the password itself and cannot recover it, which is why a reset sends a code rather than your old one. Sessions use short-lived tokens that can be revoked, and every request is over an encrypted connection.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects you, we will tell you and the regulator as the law requires.
9. Children
Unison is for people 13 and over. We do not knowingly collect information about anyone younger. If you believe a child under 13 has an account, tell us at contactus@unisonfitnessapp.com and we will delete it.
10. Changes
If we change this policy we will update the date at the top, and tell you in the app or by email when the change materially affects you.
11. Contact
contactus@unisonfitnessapp.com