Upend points a camera at you at 6:30 in the morning. This page is the accounting of what happens to what it sees, and it is written to be checked rather than trusted.
Effective 25 August 2026
Three of the four challenge types use the camera. In all three, the camera frames are processed on the device and then discarded. Nothing that the camera sees is written to disk, and nothing that the camera sees is sent to us.
Apple's Vision framework finds a body pose in each frame, on the device. The app reads a knee angle from it and counts a rep when the angle sweeps far enough. Only the angle, the detection rate, and the rep count move between parts of the app — the pixels are released frame by frame.
The pose keypoints themselves — the few kilobytes we call the Tape — are never written to storage in the shipping app at all. The code that can export them is compiled only into internal development builds, and it is marked so that a release build can be searched for its absence rather than assumed to lack it.
The photo is used to establish that you got up and went somewhere. The image is discarded without ever being turned into a picture: no part of the app asks the capture buffer for an image representation, so there is nothing to save, upload, or leak. What is recorded is that a photo was taken.
The scanner runs on the device and looks for any barcode. The code it reads is not stored and not transmitted; what is recorded is that a scan succeeded.
The challenge still resolves. Upend has a four-level ladder — verified, assisted, motion, self-reported — precisely so that a challenge always produces a result rather than a failure to measure. A denied camera moves you down the ladder; it never traps you.
This is the whole list. It is the set of columns in our database, not a summary of them.
| What | Why it exists |
|---|---|
| An Apple account identifier | Sign in with Apple returns a stable identifier for your Apple account and this app. It is how we know a returning device is you. We ask Apple only for your name — not your email — so we never receive an email address, real or relayed. |
| Your name | Two forms. The display name is the name on your side of a scoreboard; it starts as the first name Apple offers once, at first sign-in, and you can change it in the app. The full name Apple offered is kept as well, and is shown only when two rivals would otherwise read the same. |
| A device push token | To tell you a challenge arrived and that a result is ready. Nothing else is sent. |
| Who your rivals are | One row per direction, so that adding someone does not put you on their list until they say the same. |
| The terms of each challenge | Type, difficulty, target, how long the window is, and when the invite expires. |
| The clock of each challenge | The time you set your alarm for, the deadline that follows it, the moment you stopped the alarm, and when your window closes. Your score is the time from your own alarm-stop, so the server has to hold those instants to adjudicate it. |
| Your result | Elapsed time, rep count, and which level of the ladder it was measured at. |
| Your rivalry record | Wins, losses, dead heats, no-contests, walkover wins, both streaks, and the count of consecutive no-shows that pauses a series. |
| A published result card | Once a challenge resolves, the card that both of you see and can share: two names, two times, the outcome, and one line of commentary. |
| Housekeeping | A one-time hashed sign-in value that expires, and the identifiers that let a retried delivery be recognised as a repeat rather than counted twice. |
That is everything. There is no column for a photograph, a video, a barcode, a keypoint, a location, a heart rate, a step count, or a sleep record, because none of those is ever sent.
While a challenge is running, your opponent sees presence and nothing else — asleep, up, started, finished. Not your time, not your rep count, not where you stand. That is a rule the server enforces rather than a habit the app has: until a result is settled there is no field in the response that could carry a number.
When it settles, you both see the result at once, stamped at one server instant. From then on the result has a web address of its own, and that page is public and unauthenticated: anyone you send the link to can see both display names, both times and the outcome, without an account and without the app. That is the point of it — the scoreboard has to be visible to a friend on Android — but it means a shared link is genuinely shared.
An invite link works the same way, and more so: the unguessable address in the link is the invitation. Whoever holds it can take the open side of that challenge. Send it to the person you meant to challenge.
We do not sell your information, and we do not share it with anyone for advertising. The only third parties involved are the ones that run the service: Apple, for sign-in and for delivering notifications, and our hosting and database providers, who store the rows listed above on our behalf.
A rivalry is a running record, so results are kept for as long as the account exists — that accumulating history is what the product is.
To delete your account, open Upend, find your name under You, and tap Delete account. Apple asks you to confirm, and then everything goes: your account, your rivals, your rivalry records, every past result, and every card you have shared — those links stop resolving. We also ask Apple to forget that you ever signed in to Upend, so it disappears from your Apple Account's Sign in with Apple list.
Two things are handled rather than deleted, because a rival's phone is still running them. A challenge nobody has scheduled yet is cancelled. A race already under way is conceded — your rival gets the walkover, exactly as if you had slept through it — and on that one row your name is replaced with Deleted account before the result is stamped.
If you cannot get into the app, email support@getupend.com from the device you signed in on and we do the same by hand.
Upend is not directed to children under 13, and we do not knowingly collect information from them.
If this page changes in a way that affects what we collect, the date at the top changes with it. Questions, corrections, or a deletion request: support@getupend.com.