This revised policy takes effect on October 19, 2026. Until then, the policy effective October 6, 2026 applies. What is changing: if you allow it, we collect and use your step count (Sections 1, 2, 3 and 9).
RebelUp (the "Company") establishes and discloses the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (PIPA) of Korea, in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly. This Policy applies to the mobile application RebelUp (Rebel-Up) and the website rebelup.kr (collectively, the "Service") provided by the Company.
The Company processes personal information for the following purposes and does not use it for any other purpose. If the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent.
You can register by signing in with a Google or Apple account, or by signing up with a mobile phone number (and setting a password).
If you sign in with an Apple account and choose "Hide My Email," the Company receives only an anonymized relay address and cannot know your actual email address.
| Category | Items | When collected |
|---|---|---|
| Body information (sensitive information) | Sex, age, height, weight, target weight, activity level, exercise experience, injured or painful areas, dietary restrictions | During onboarding and when settings are changed |
| Health measurements (sensitive information) | Weight change records, body-composition (InBody) muscle mass and body fat by body part, daily fatigue level, areas of pain | When entered by the user |
| Step count (if you allow it) | Daily step counts for the last 7 days — read from Motion & Fitness (iPhone) or Health Connect (Android) | When you open the app after allowing step access |
| Workout records | Exercises performed, sets, repetitions and weights, session duration, whether the session was ended early and the reason | When a workout is performed |
| Diet records | Food name, calories, protein, fat and carbohydrates, meal type | When a meal is logged |
| Lifestyle records | Sleep duration, water intake, type of schedule for the day (company dinner, drinking plans, meal plans, etc.) | When entered by the user |
| Photos | Progress photos, workout proof photos, profile photo | When the user takes or selects and uploads them |
| Community activity | Friend and group relationships, pokes and claps, likes, daily quiz answers and scores, posts shared to Everyone's Records, report and block records | When the relevant feature is used |
| Inquiry content | Inquiry title and content, related exercise | When an inquiry is submitted |
| Subscription information | Subscription product identifier, subscription status, scheduled renewal date, payment store | When a subscription payment is made |
The Company does not collect payment method information. Payments for paid subscriptions are made through the Apple App Store or Google Play, and payment method information such as card numbers is handled by each store. The Company receives only "whether a subscription is active" and "when it will renew."
The Company does not collect advertising identifiers (IDFA/GAID) in the app and does not use in-app usage records for advertising. However, the promotional website (rebelup.kr) uses the Meta Pixel to measure advertising performance; the items collected and the related outsourcing and overseas transfer are described in Sections 6 and 7.
RebelUp has features that users do together. The information below is visible to other users within the scope stated in the table. Health measurements such as weight, body composition, body photos and pain areas, as well as your email address and phone number, are not visible to other users.
| Visible information | Where and to whom | How you control it |
|---|---|---|
| Nickname, profile photo, character level | Friends and groups, weekly leagues, the daily quiz ranking, Everyone's Records, like notifications | You can change these at any time in profile settings (a photo is optional). |
| Streak days, number of active days this week | Weekly league (users in the same league, up to 15), friends and groups, Everyone's Records | You join the weekly league when you open the app that week, and can leave it with "Hide me from the league". |
| Whether you worked out in the last 7 days and whether you finished today | Users in the same group (up to 6) | You join a group only by accepting an invitation, and can leave at any time. |
| Daily quiz score | Users who took that day's quiz | You appear in the ranking only when you take the quiz. |
| Summaries of workout and meal records posted to Everyone's Records (food names and calories; exercises, sets and duration) and the number of likes received | All app users | We ask each time before posting. If you turn on "Always share", posts go up without asking; you can turn this off in "Everyone's Records settings" on the My tab. You can delete a post at any time with "Remove". |
| Likes, pokes and claps you send | The post's author or your friend (your nickname is shown in the notification) | Sent only when you tap them. |
For the essential functions of the Service (providing personalized workout and diet plans), the Company processes health-related information that constitutes sensitive information under Article 23 of the Personal Information Protection Act. Such information is processed only after separate consent has been obtained, distinct from consent to the processing of other personal information.
The Company does not use sensitive information for advertising or marketing purposes and does not sell it to third parties. Specific health figures are not transmitted for service usage analysis (PostHog, see Section 6) either.
As a rule, the Company destroys personal information without delay when a member withdraws. However, where retention is required under applicable laws, the information is retained for the periods below.
| Items retained | Retention period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of subscription | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records on payment and the supply of goods, etc. | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records on consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Service access logs | 3 months | Protection of Communications Secrets Act |
The Company does not provide users' personal information to third parties. The following cases are exceptions.
To provide the Service smoothly, the Company outsources personal information processing tasks as follows. The outsourcing agreements set out matters concerning the safe management of personal information, and the Company supervises whether the trustees process personal information safely.
| Trustee | Outsourced work | Items transferred | Retention and use period |
|---|---|---|---|
| Supabase, Inc. | Database and file storage, member authentication | All items listed in Section 2 | Until termination of the outsourcing agreement or withdrawal of membership |
| RevenueCat, Inc. | Verification and management of subscription status | Member identifier, subscription product, status and renewal date | |
| PostHog, Inc. | Analysis of service usage patterns and identification of errors | Anonymous identifier, device and app information, screen and feature usage records (excluding health figures, photos, and contact details) | |
| Anthropic PBC | AI diet analysis and plan generation (see Section 8) | Meal photos, body information necessary for plan generation | |
| Meta Platforms, Inc. | Measurement of advertising performance on the promotional website | Website visit and pre-registration completion records, cookie-based identifiers (excluding health figures, photos, and contact details) | |
| Functional Software, Inc. (Sentry) | Analysis of app errors and performance | Member identifier, device and app information, error records (on-screen text and images are masked before sending) (excluding health figures, photos, and contact details) | |
| 650 Industries, Inc. (Expo) | Sending push notifications | Push notification token, notification text | |
| Octoverse Co., Ltd. (OCTOMO) | Mobile phone number verification (checking the verification text message you send) | Mobile phone number, verification code |
In addition, Apple Inc. and Google LLC process social login authentication and in-app payments, and such processing is governed by each company's own privacy policy.
Pursuant to Article 28-8(1)3 of the Personal Information Protection Act, the Company discloses the following matters concerning the outsourcing and storage of personal information that is necessary for the performance of the contract entered into with the data subject and for enhancing convenience.
| Recipient | Country of transfer | Date and method of transfer | Items transferred | Purpose of use and retention period |
|---|---|---|---|---|
| Supabase, Inc. (Contact for the information manager: privacy@supabase.io) |
Data is stored in the Republic of Korea (Seoul region), and the corporation is located in the United States | Transmitted over the network from time to time when the Service is used | All items listed in Section 2 | Operation of the database and storage / until withdrawal of membership |
| RevenueCat, Inc. (support@revenuecat.com) |
United States | Transmitted over the network at the time of subscription payment and verification | Member identifier, subscription product, status and renewal date | Management of subscription status / until termination of the outsourcing agreement |
| PostHog, Inc. (privacy@posthog.com) |
United States | Transmitted over the network from time to time when the app is used | Anonymous identifier, device and app information, screen and feature usage records | Usage analysis for service improvement / until termination of the outsourcing agreement |
| Meta Platforms, Inc. (https://www.facebook.com/privacy/policy) |
United States | Transmitted over the network from time to time when the promotional website (rebelup.kr) is visited | Website visit and pre-registration completion records, cookie-based identifiers | Measurement of advertising performance / until termination of the outsourcing agreement |
| Anthropic PBC (privacy@anthropic.com) |
United States | Transmitted over the network at the time an AI feature is used | Meal photos, body information necessary for plan generation | Generation of AI analysis results / deleted without delay after processing is complete |
| Functional Software, Inc. (Sentry) (privacy@sentry.io) |
United States | Transmitted over the network when an error occurs in the app | Member identifier, device and app information, error records | Identifying and fixing errors / until termination of the outsourcing agreement |
| 650 Industries, Inc. (Expo) (privacy@expo.dev) |
United States | Transmitted over the network when a notification is sent | Push notification token, notification text | Sending push notifications / until termination of the outsourcing agreement |
Users may refuse the overseas transfer of their personal information. If you refuse, however, member registration and use of the Service may be restricted. If you wish to refuse, please contact the Personal Information Protection Officer listed in Section 14.
The Company uses the Claude API provided by Anthropic PBC for the following features.
What to know when using AI features
The Company requests only the minimum permissions necessary to provide the Service, and all permissions are optional. Even if you do not grant them, you can use the rest of the Service normally, apart from the relevant features.
| Permission | Purpose of use | Required |
|---|---|---|
| Camera | Taking workout proof photos and food photos for AI diet analysis | Optional |
| Photo library | Uploading progress photos and a profile photo | Optional |
| Notifications | Sending workout and logging reminders | Optional |
| Motion & Fitness (iPhone) Health Connect — Steps (Android) | Reading your step count to count days with 8,000 steps as workout days. Without it you can still enter walking time yourself. Step counts are never used for advertising or provided to third parties. | Optional |
You can change permissions again at any time in your device settings. The Company stores progress photos, workout proof photos and meal photos in private storage, and makes them accessible only through a signed URL that is valid for a limited time when they are viewed. However, your profile photo is kept in public storage so that other users can see it, and anyone with the photo's address can view it (Section 2-D).
Users may exercise the following rights against the Company at any time.
You may exercise these rights directly in the Settings screen of the app, or by submitting a request in writing or by email to the contact listed in Section 14. The Company will take action without delay.
You can request account deletion directly from Settings → Delete Account in the app. Upon deletion, all personal information is destroyed except for the items subject to statutory retention listed in Section 4. Deleted data cannot be recovered.
When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys that personal information without delay.
The Company does not accept member registration by children under the age of 14. If the Company becomes aware that personal information of a child under the age of 14 has been collected, it will destroy that information and delete the account without delay.
The Company has designated a Personal Information Protection Officer as follows, who takes overall responsibility for personal information processing and handles complaints and remedies for data subjects in relation to personal information processing.
| Category | Details |
|---|---|
| Personal Information Protection Officer | Kim Tae-un |
| fightingman012@gmail.com | |
| Business name | RebelUp |
| Representative | Kim Tae-un |
| Business registration number | 174-76-00664 |
Users may contact the Personal Information Protection Officer regarding any matter relating to personal information protection, complaint handling, or remedies for damage arising while using the Service. The Company will respond and take action without delay.
If you need counseling or remedies for damage caused by a personal information breach, you may contact the following organizations.
This Privacy Policy applies from its effective date. If there are any additions, deletions, or modifications to its content due to changes in laws, policies, or security technology, the Company will give notice through in-app announcements and this page from 7 days before the changes take effect. However, where a material change to users' rights occurs, notice will be given at least 30 days in advance.
Previous versions: effective October 6, 2026 · effective August 4, 2026