PRIVACY POLICY

Last Updated: March 25, 2026

1. Introduction

This Privacy Policy explains how Sebastian George Lungu ("ULTRA+," "we," "our," or "us") collects, uses, stores, and shares personal information when you use the ULTRA+ mobile application (the "App"), our website (the "Site"), and related services (collectively, the "Services").

This Policy is intended to work alongside our Terms of Service and any just-in-time notices or permission prompts shown in the App, such as the signup Terms / Privacy acceptance flow, the AI Coach acknowledgment, device permission prompts, and Apple's App Tracking Transparency prompt on iOS where applicable.

2. Information We Collect

We collect information you provide directly, information created through your use of the Services, and limited device / technical information.

A. Account and Contact Information

• name;
• email address;
• authentication credentials and login metadata handled through our authentication providers; and
• support or other communications you send us.

B. Onboarding and Profile Information

When you create an account and complete onboarding, we collect the information you choose to provide to set up and personalize the Service.

• age, height, weight, biological sex, and preferred units;
• goals, target weight, motivation, and timeline;
• activity level and training frequency;
• injuries, equipment, training experience, and related fitness preferences; and
• dietary preferences, nutrition struggles, interests, and onboarding source information.

C. Fitness, Nutrition, and Wellness Information

• workout logs, exercise history, sets, reps, weight, templates, and session timing;
• nutrition logs, calorie and macro data, meal history, and barcode scans;
• body measurements and progress data; and
• recovery or wellness inputs you choose to log, such as sleep-quality flags or similar self-reported data.

D. AI Feature Inputs and Context

• messages, prompts, or food descriptions you submit;
• the output generated for you; and
• the relevant account context needed to answer your request, such as profile data, workout history, nutrition history, injuries, equipment, or other related in-app context.

E. Subscription and Billing Information

• subscription status, entitlement status, and expiration dates;
• purchase channel information;
• trial status and billing state;
• RevenueCat customer identifiers and purchase metadata; and
• website billing metadata and customer portal information for web-based subscriptions.

We do not store full payment card numbers in the App.

F. Device, Technical, Analytics, and Permission Data

• device type, OS version, app version, language, time zone, crash / diagnostic signals, and performance metrics;
• in-app usage and event data;
• push notification tokens and notification preference settings;
• camera permission state when you use barcode scanning;
• analytics identifiers and app-event data through providers such as PostHog; and
• where enabled and permitted, measurement or attribution identifiers through services such as RevenueCat or Meta / Facebook.

On iOS, if tracking permission is required for a specific tracking or attribution use case, we request it through Apple's App Tracking Transparency prompt before enabling that iOS tracking path.

3. How We Use Information

1. create and manage your account;
2. complete onboarding and configure your personalized fitness experience;
3. provide workout, nutrition, progress-tracking, barcode-scanning, and related app features;
4. operate subscriptions, entitlements, trials, billing support, and purchase restoration;
5. provide AI-powered features you choose to use;
6. send service-related notifications, reminders, and alerts;
7. analyze performance, reliability, feature usage, fraud, abuse, and security incidents;
8. improve the Services, troubleshoot issues, and support users;
9. comply with legal obligations, enforce our Terms, and protect our rights; and
10. where permitted, measure marketing or app-install attribution and understand acquisition performance.

4. Legal Bases for Processing

If you are located in the EEA, UK, or another jurisdiction that requires a legal basis for processing, we generally rely on one or more of the following:

• Contract: to create your account, provide the Services, personalize your plan, maintain subscriptions, and deliver the features you request.
• Legitimate Interests: to secure the Services, prevent abuse, debug issues, understand service performance, and improve reliability and product quality.
• Consent: where required by law or platform rules, including for certain health-related processing, optional AI feature acknowledgments, push-notification permissions, camera access, and iOS tracking permissions under App Tracking Transparency.
• Legal Obligation: when we must retain or disclose information to comply with applicable law, regulation, court orders, or lawful requests.

5. How We Share Information

We do not sell your personal information for money. We share information only as reasonably necessary to operate the Services, comply with law, protect users, or carry out the uses described in this Policy.

6. Tracking, Analytics, and Your Choices

We use analytics tools to understand app performance, product usage, and service quality. These tools may collect event data, technical metadata, and device-related identifiers.

On iOS, where a tracking or attribution use case requires permission under Apple's App Tracking Transparency framework, we will request that permission through Apple's system prompt before enabling that iOS tracking path. If you select "Ask App Not to Track," we will not enable that iOS ATT-gated tracking path.

• Push notifications: optional and manageable through device settings and in-app controls.
• Camera access: requested only when you use barcode scanning or another camera-dependent feature.

7. Data Retention and Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

• We retain information for as long as reasonably necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements.
• If you delete your account, your live account data is queued for deletion from active systems in accordance with our backend deletion process.
• Encrypted backups may persist for a limited period before routine overwrite or deletion.
• Certain records may be retained where required by law, tax, fraud-prevention, or dispute-handling obligations.

8. International Transfers

Your information may be processed in countries other than the one where you live, including the United States and other jurisdictions where our vendors or infrastructure providers operate.

Where required, we use appropriate safeguards for international transfers, such as contractual protections or other recognized transfer mechanisms.

9. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, port, object to, or restrict certain processing of your personal information, and to withdraw consent where processing is based on consent.

We do not sell personal information for money. However, certain analytics or advertising-related disclosures may be considered "sharing" under California law. You may exercise applicable rights by contacting us at contact@ultraplus.fit.

You can request deletion through the in-app delete-account flow when available or by contacting contact@ultraplus.fit if you cannot access the App. Deleting your account does not automatically cancel a subscription billed through Apple, Google, Stripe, or another billing provider.

10. Children's Privacy

The Services are not directed to children under 13, or under a higher minimum age where required by local law. We do not knowingly collect personal information from children in violation of applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date and may provide additional notice where appropriate.

12. Contact Us

Sebastian George Lungu
Email: contact@ultraplus.fit