Privacy
Last updated 23 October 2026
URBDY is a gym, food and budget-meal app for UK uni students. This page explains what we collect, why, where it's kept, how long for, and what you can do about it. We've kept it in plain English.
Who we are
URBDY is run by Xpo8 Limited, a company registered in Hong Kong. We are the "data controller" for the information described here.
For anything about your data, email privacy@urbdy.com. We reply within one month.
The short version
- We never sell your data and never use it for ads.
- The website has no cookies, no analytics and no trackers.
- Your health information (weight, food, workouts) is only used to run the app for you, and only with your clear "I agree".
- Your student proof is deleted as soon as it's been checked.
- Posts and photos are only seen by followers you've approved.
- You can download everything or delete your account at any time, from inside the app.
This website
The waitlist
If you join the waitlist we keep your email address and, if you give it, your uni. We use them to send you one email when URBDY launches, and to show how many people from each uni are waiting (as a number only, never names or emails).
Our legal reason is your consent. We keep the list until six months after the launch email, then delete it. To be removed sooner, email privacy@urbdy.com.
Everything else on the site
- No cookies, analytics or trackers. Fonts and scripts are served from our own site, so nothing about your visit goes to Google or anyone else.
- If you pick your uni on the page, your browser remembers it on your own device. It isn't sent to us unless you join the waitlist.
- The site is hosted by Cloudflare. Like any web host, it sees your IP address to deliver the page and to block attacks.
The app: what we collect and why
| What | Why | Legal reason |
|---|---|---|
| Email, name, date of birth | Your account. Date of birth checks you're 18 or over. | Contract (running the app you signed up for) |
| Weight, height, goals, food log, workouts, and Apple Health data if you switch it on | Your targets, meal plans, progress and backups. This is health information. | Your explicit consent, asked for separately at sign-up |
| Student proof (an enrolment letter, council tax certificate or student card) | Checking you can have the student price | Contract |
| Your @name, posts, photos, comments, likes, follows, clubs and club chats | The social side of the app, if you use it | Contract |
| Gym buddy checks (who confirmed a workout with whom) | Fair leagues | Contract |
| Foods you share and photos of food labels | Adding foods for everyone, read by AI and checked by us | Contract |
| Whether you have a plan or free trial | Unlocking the app | Contract |
| Reports you make about posts, comments or foods | Keeping the community safe | Legitimate interest (safety) |
Your logs live on your phone. When you're signed in, a copy is backed up to your account so it's there on a new phone.
We don't use your data to make automatic decisions about you that have legal or similarly big effects. The uni league counts verified students per uni and shows totals only.
Who else handles your data
We use a small number of companies to run URBDY. Each only gets what it needs, and each has a contract with us to protect it.
| Company | What for | Where |
|---|---|---|
| Supabase | Accounts, backups, social features, the waitlist | London, UK |
| Anthropic | Reading food label photos, and writing your weekly coach check-in. The coach only gets numbers (like average calories and sessions), never your name or email. | USA |
| Resend | Sending sign-in codes by email | USA |
| Apple | App Store payments and Apple Health (on your phone) | Your phone / Apple |
| RevenueCat | Checking whether your subscription is active. It gets a random account number, not your name or health data. | USA |
| Sentry | Crash reports: the error, app version and phone model only. No name, email, IP address or health data. | EU |
| Cloudflare | Hosting this website | Global network |
| Open Food Facts | Looking up a barcode you scan. Only the barcode is sent. | France |
Where data goes to the USA, it's protected by the UK's approved safeguards (the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum).
How long we keep it
- Your account and logs: until you delete your account. Deleting it removes everything from our servers straight away, including your photos.
- Student proof documents: deleted as soon as they've been checked. We keep only the result and the date your student price runs until.
- Foods you shared: stay in the shared database after you leave, with no link back to you.
- Waitlist: six months after the launch email.
- Backups held by Supabase roll off within days.
Your rights
Under UK data protection law you can:
- Get a copy of your data: in the app, Profile → Download my data.
- Delete your account and data: in the app, Profile → Delete account.
- Withdraw consent for health information at any time (Profile). URBDY can't work without it, so this deletes your account.
- Correct anything that's wrong, most of it straight in the app.
- Object to or ask us to limit how we use your data.
Email privacy@urbdy.com for any of these. If you're unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
18 and over
URBDY is only for people aged 18 or over. If we learn an account belongs to someone younger, we delete it.
Keeping it safe
Data is encrypted in transit and at rest. Our database is locked so each person can only reach their own data, and student proof is only visible to the people who check it.
Changes
If we change this page in a way that matters, we'll tell you in the app before it applies. The date at the top shows the latest version.