RebelUp (the "Company") establishes and discloses the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (PIPA) of Korea, in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly. This Policy applies to the mobile application RebelUp (Rebel-Up) and the website rebelup.kr (collectively, the "Service") provided by the Company.
The Company processes personal information for the following purposes and does not use it for any other purpose. If the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent.
The Company does not collect a separate ID or password, and supports social login through a Google or Apple account only.
If you sign in with an Apple account and choose "Hide My Email," the Company receives only an anonymized relay address and cannot know your actual email address.
| Category | Items | When collected |
|---|---|---|
| Body information (sensitive information) | Sex, age, height, weight, target weight, activity level, exercise experience, injured or painful areas, dietary restrictions | During onboarding and when settings are changed |
| Health measurements (sensitive information) | Weight change records, body-composition (InBody) muscle mass and body fat by body part, daily fatigue level, areas of pain | When entered by the user |
| Workout records | Exercises performed, sets, repetitions and weights, session duration, whether the session was ended early and the reason | When a workout is performed |
| Diet records | Food name, calories, protein, fat and carbohydrates, meal type | When a meal is logged |
| Lifestyle records | Sleep duration, water intake, type of schedule for the day (company dinner, drinking plans, meal plans, etc.) | When entered by the user |
| Photos | Progress photos, workout proof photos | When the user takes or selects and uploads them |
| Inquiry content | Inquiry title and content, related exercise | When an inquiry is submitted |
| Subscription information | Subscription product identifier, subscription status, scheduled renewal date, payment store | When a subscription payment is made |
The Company does not collect payment method information. Payments for paid subscriptions are made through the Apple App Store or Google Play, and payment method information such as card numbers is handled by each store. The Company receives only "whether a subscription is active" and "when it will renew."
The Company does not collect advertising identifiers (IDFA/GAID) in the app and does not use in-app usage records for advertising. However, the promotional website (rebelup.kr) uses the Meta Pixel to measure advertising performance; the items collected and the related outsourcing and overseas transfer are described in Sections 6 and 7.
For the essential functions of the Service (providing personalized workout and diet plans), the Company processes health-related information that constitutes sensitive information under Article 23 of the Personal Information Protection Act. Such information is processed only after separate consent has been obtained, distinct from consent to the processing of other personal information.
The Company does not use sensitive information for advertising or marketing purposes and does not sell it to third parties. Specific health figures are not transmitted for service usage analysis (PostHog, see Section 6) either.
As a rule, the Company destroys personal information without delay when a member withdraws. However, where retention is required under applicable laws, the information is retained for the periods below.
| Items retained | Retention period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of subscription | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records on payment and the supply of goods, etc. | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records on consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Service access logs | 3 months | Protection of Communications Secrets Act |
The Company does not provide users' personal information to third parties. The following cases are exceptions.
To provide the Service smoothly, the Company outsources personal information processing tasks as follows. The outsourcing agreements set out matters concerning the safe management of personal information, and the Company supervises whether the trustees process personal information safely.
| Trustee | Outsourced work | Items transferred | Retention and use period |
|---|---|---|---|
| Supabase, Inc. | Database and file storage, member authentication | All items listed in Section 2 | Until termination of the outsourcing agreement or withdrawal of membership |
| RevenueCat, Inc. | Verification and management of subscription status | Member identifier, subscription product, status and renewal date | |
| PostHog, Inc. | Analysis of service usage patterns and identification of errors | Anonymous identifier, device and app information, screen and feature usage records (excluding health figures, photos, and contact details) | |
| Anthropic PBC | AI diet analysis and plan generation (see Section 8) | Meal photos, body information necessary for plan generation | |
| Meta Platforms, Inc. | Measurement of advertising performance on the promotional website | Website visit and pre-registration completion records, cookie-based identifiers (excluding health figures, photos, and contact details) |
In addition, Apple Inc. and Google LLC process social login authentication and in-app payments, and such processing is governed by each company's own privacy policy.
Pursuant to Article 28-8(1)3 of the Personal Information Protection Act, the Company discloses the following matters concerning the outsourcing and storage of personal information that is necessary for the performance of the contract entered into with the data subject and for enhancing convenience.
| Recipient | Country of transfer | Date and method of transfer | Items transferred | Purpose of use and retention period |
|---|---|---|---|---|
| Supabase, Inc. (Contact for the information manager: privacy@supabase.io) |
Data is stored in the Republic of Korea (Seoul region), and the corporation is located in the United States | Transmitted over the network from time to time when the Service is used | All items listed in Section 2 | Operation of the database and storage / until withdrawal of membership |
| RevenueCat, Inc. (support@revenuecat.com) |
United States | Transmitted over the network at the time of subscription payment and verification | Member identifier, subscription product, status and renewal date | Management of subscription status / until termination of the outsourcing agreement |
| PostHog, Inc. (privacy@posthog.com) |
United States | Transmitted over the network from time to time when the app is used | Anonymous identifier, device and app information, screen and feature usage records | Usage analysis for service improvement / until termination of the outsourcing agreement |
| Meta Platforms, Inc. (https://www.facebook.com/privacy/policy) |
United States | Transmitted over the network from time to time when the promotional website (rebelup.kr) is visited | Website visit and pre-registration completion records, cookie-based identifiers | Measurement of advertising performance / until termination of the outsourcing agreement |
| Anthropic PBC (privacy@anthropic.com) |
United States | Transmitted over the network at the time an AI feature is used | Meal photos, body information necessary for plan generation | Generation of AI analysis results / deleted without delay after processing is complete |
Users may refuse the overseas transfer of their personal information. If you refuse, however, member registration and use of the Service may be restricted. If you wish to refuse, please contact the Personal Information Protection Officer listed in Section 14.
The Company uses the Claude API provided by Anthropic PBC for the following features.
What to know when using AI features
The Company requests only the minimum permissions necessary to provide the Service, and all permissions are optional. Even if you do not grant them, you can use the rest of the Service normally, apart from the relevant features.
| Permission | Purpose of use | Required |
|---|---|---|
| Camera | Taking workout proof photos and food photos for AI diet analysis | Optional |
| Photo library | Uploading progress photos | Optional |
| Notifications | Sending workout and logging reminders | Optional |
You can change permissions again at any time in your device settings. The Company stores photos you take in private storage, and makes them accessible only through a signed URL that is valid for a limited time when they are viewed.
Users may exercise the following rights against the Company at any time.
You may exercise these rights directly in the Settings screen of the app, or by submitting a request in writing or by email to the contact listed in Section 14. The Company will take action without delay.
You can request account deletion directly from Settings → Delete Account in the app. Upon deletion, all personal information is destroyed except for the items subject to statutory retention listed in Section 4. Deleted data cannot be recovered.
When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys that personal information without delay.
The Company does not accept member registration by children under the age of 14. If the Company becomes aware that personal information of a child under the age of 14 has been collected, it will destroy that information and delete the account without delay.
The Company has designated a Personal Information Protection Officer as follows, who takes overall responsibility for personal information processing and handles complaints and remedies for data subjects in relation to personal information processing.
| Category | Details |
|---|---|
| Personal Information Protection Officer | Kim Tae-un |
| fightingman012@gmail.com | |
| Business name | RebelUp |
| Representative | Kim Tae-un |
| Business registration number | 174-76-00664 |
Users may contact the Personal Information Protection Officer regarding any matter relating to personal information protection, complaint handling, or remedies for damage arising while using the Service. The Company will respond and take action without delay.
If you need counseling or remedies for damage caused by a personal information breach, you may contact the following organizations.
This Privacy Policy applies from its effective date. If there are any additions, deletions, or modifications to its content due to changes in laws, policies, or security technology, the Company will give notice through in-app announcements and this page from 7 days before the changes take effect. However, where a material change to users' rights occurs, notice will be given at least 30 days in advance.