Uthold

Draft · not yet reviewed by a lawyer

Privacy

The short version: the field test sends nothing anywhere, we store your email address only if you ask to join the waitlist, and no health data ever reaches an advertiser or an analytics tool.

This is a draft. It describes what the site and the app actually do, written by the team building them. It has not been reviewed by a lawyer, and it must be before the app is submitted to the App Store. Treat every section below as a statement of intent to be verified, not as a finished legal document.

The free VO₂ max test

The test at uthold.com/test runs entirely in your browser. Your age, sex, weight, distance, time and heart rate are used to calculate an estimate on your own device and are never transmitted. There is no account, no cookie set by us, and no record kept. Close the tab and nothing remains.

The health screening questions work the same way. They only decide what the page shows you.

The waitlist

If you submit the waitlist form we store your email address and nothing else. It is delivered through Formspree, a hosted form service acting for us; we do not sell it or share it with anyone else. We use it once, to tell you the app is available, and for nothing further. You can ask us to delete it at any time and we will.

Your test result is deliberately not attached to that email. A VO₂ max estimate is health data, and we do not send health data to third parties.

Analytics and advertising

We run no advertising SDK, no attribution SDK and no audience tool, on the site or in the app. If we ever add analytics it will see page views only, and it will never receive anything derived from your health data.

The site loads web fonts from Google Fonts, which means Google receives the request for those font files, including your IP address, as it would for any site using them.

The waitlist form posts your email address to Formspree, the hosted form service that delivers it to us — so Formspree processes that address on our behalf. It receives nothing else: not your test result, which never leaves your browser, and nothing about what you did on the site. Those two are the only third parties these pages contact.

The app, when it ships

These are commitments for the iOS app, written down now so they are on the record:

  • HealthKit access is read-only, and limited to the types actually used: VO₂ max, heart rate, resting heart rate and your date of birth, then workouts, sleep and heart-rate variability for the features that need them. We do not write to HealthKit.
  • Permission is requested in context, when you first use the feature that needs it — not as a wall of prompts during onboarding.
  • Health data is never stored in iCloud and never passed to advertising or analytics.
  • Strava is a write-only destination. If you connect it, we post your session there. We never read your Strava data back, and it is never used to train any model.
  • No AI model receives your health data. Training decisions are made by explicit rules, not by a language model. Any AI feature explaining a decision would run on your device.

The app’s privacy manifest currently declares zero collected data types, because nothing leaves your device. If that ever changes, it changes in the same release, and this page changes with it.

Your rights

If you are in the UK or EU, the GDPR gives you the right to access, correct, export or delete the personal data we hold about you — which, unless you joined the waitlist, is none. Email us and we will act on it.