Unison — Privacy Policy
Last updated: 23 September 2026
This explains what Unison knows about you, who else sees it, and how to get rid of it. It is written to be read, not to be survived.
Unison is operated from Victoria, Australia. Contact: [email protected]
1. The short version
- We never record where you are. Unison uses GPS while you run, but only to measure how far and how much you climbed. No coordinates, no route, no map is ever stored — see section 5.
- Your email address is never shown to another user.
- We do not sell your information, and there is no advertising or analytics tracking in the app.
- You can delete everything yourself, permanently, from Settings.
2. What we hold
About you
| Your name | Shown to anyone who can see you |
| Your email | For signing in and resetting your password. Never shown to other users |
| Your password | Stored only as a cryptographic hash. We cannot read it |
| City and country | Optional, if you gave them at sign-up |
| Your time zone | So your challenge week starts on your Monday, not ours |
| Your profile photo | Optional |
| Your notification and background-tracking settings |
What you do
Your attempts and their splits — times, distance, elevation gain, whether GPS verified them — plus achievements, who you follow, who follows you, your cheers, your comments and likes, anyone you have blocked, and your rivalries.
For security
Sign-in sessions and short-lived password reset codes.
3. How we get it
Two ways, and only two.
You tell us. Your name, email and password when you sign up; your city and country if you choose to give them; your photo if you add one; your comments and cheers as you write them.
Your phone measures it. While an activity is running, and only then — the times, distances and elevation in section 2. Your phone does the measuring and sends us the results. Section 5 covers what that does and does not involve.
We do not buy information about you, and we do not collect it from anyone else. Nothing about you reaches us from another app, another service, or another person.
4. You do not have to use your real name
Australian privacy law says you should be able to deal with us without identifying yourself, where that is practicable. For Unison it is partly practicable, so here is exactly where the line falls.
Your name is whatever you want to be known by. Nothing checks it and it does not have to be your real one. It is the name other people see, so pick something you are happy being called.
Your email address does have to be real, because it is how you sign in and the only way back into your account if you forget your password. It is never shown to another user (section 6).
We do not ask for your date of birth, your address, your phone number, or any kind of identity document, and an ordinary account never will.
5. Location — what we do and do not keep
This deserves its own section because most fitness apps answer it differently.
When you record a run, your phone's GPS is used while the activity is running to work out two numbers: how far you went and how much you climbed. Those two numbers are saved.
Nothing else is. No latitude or longitude, no path, no start or finish point, no map. There is no route to look at, because none is kept — not by us, and not on our servers.
If you turn on background tracking, the same is true: it only means the measurement keeps working when your phone is in your pocket or the screen is off. It does not change what is stored.
You can decline location permission entirely and still use Unison — you time the activity yourself instead.
6. Who can see what
- Your email: nobody but you.
- Your workouts: people who follow you.
- Your profile photo: any signed-in Unison user. It is not public — there is no address anyone can open without being signed in.
- Your comments and cheers: anyone who can see the workout they are on.
- Anyone you block: you and they become invisible to each other, in both directions, everywhere in the app — including your photo. They are not told.
7. Who else handles it
We use a small number of services to run Unison. They only ever act on our instructions.
| Service | What it handles |
|---|---|
| Railway | Hosts the database — so, in principle, everything above |
| Cloudflare | Stores profile photos; routes email sent to our support address |
| Resend | Sends password reset emails — your address, and the code |
| Expo, Apple, Google | Deliver push notifications, if you allow them |
| Apple, Google | Are told a review was requested — never who you are, never what you did |
Where your information is stored. Unison's database is hosted in Singapore, and profile photos are stored in Oceania (Australia and New Zealand). Password reset emails are sent through a service in the United States, and push notifications pass through services in the United States on their way to your phone. By using Unison you agree to your information being stored and handled in those places. We chose providers that let us say exactly where, and we will update this section if that changes.
We do not sell your information to anyone, for any purpose. There is no advertising network and no analytics SDK in Unison.
We do not do marketing. We will never email you about an offer or a promotion, and we will never give your address to anyone who would. The only emails Unison sends are ones you caused: a password reset you asked for, and the notifications you turned on yourself, which you can turn off again in Settings at any time.
No cookies. unisonfitnessapp.com sets no cookies and loads nothing from anywhere else — no fonts, no scripts, no analytics, nothing embedded. The app itself is not a web browser and carries none either.
8. How long we keep it
We keep your information while your account exists.
When you delete your account it is gone immediately and permanently — Settings → Delete account, confirmed with your password. That removes your profile, workouts, times, achievements, comments, cheers, follows, blocks, rivalries and photo. We cannot restore it afterwards, and neither can you.
Sign-in sessions end at once. Password reset codes expire on their own within minutes.
Deleting your account also removes rivalries you were part of, which means they disappear from the other person's history too.
9. Your rights
You can:
- See what we hold — most of it is visible in the app; ask us for the rest.
- Correct it — your name, city, country and photo are editable in the app.
- Delete it — yourself, from Settings, at any time.
- Complain. If you think we have mishandled your information, tell us first at [email protected]. If we do not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
10. Security
Passwords are stored only as bcrypt hashes — we never hold the password itself and cannot recover it, which is why a reset sends a code rather than your old one. Sessions use short-lived tokens that can be revoked, and every request is over an encrypted connection.
No system is perfectly secure, and we will not pretend otherwise. If there is a data breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner. That is the Notifiable Data Breaches scheme, and it sets out both what we have to do and how quickly.
11. Children
Unison is for people 13 and over. We do not knowingly collect information about anyone younger. If you believe a child under 13 has an account, tell us at [email protected] and we will delete it.
12. Changes
If we change this policy we will update the date at the top, and tell you in the app or by email when the change materially affects you.