Privacy Policy
config.js), confirm that each listed service provider and setting matches your production configuration, and have the text reviewed by a qualified lawyer for the EU/EEA, UK and US states where you distribute. It is not a statement of legal compliance.1. Who we are
MoveCombo (the "App") and this website are operated by , ("we", "us"). We are the data controller for the personal data described here. Contact: .
2. Camera & pose data
The App asks for camera access only when you start setting up a game. While you play:
- Camera frames are analysed on your device by a pose-estimation model to locate body points such as shoulders, elbows, wrists and hips, and to compute angles that tell a full push-up apart from other movement.
- Frames and body landmarks are kept in memory only for as long as needed to process them (fractions of a second), then discarded. They are never uploaded to us or to any third party, never saved to your photo library, and never used to identify you.
- The camera is switched off when you leave the game screen or the App goes to the background.
- The App does not record video and does not request microphone access.
- Your calibration values (for example, your typical "arms up" and "arms down" angles) are numbers stored only on your device so the next game starts faster.
If you deny camera access the App cannot detect push-ups, and it will explain how to enable access in your device settings.
3. What we collect in the App
| Data | When | Where it goes |
|---|---|---|
| Game progress — scores, personal bests, push-up totals, games played, achievements, settings | Always | Stored on your device only. |
| Anonymous player ID — a random identifier created by our backend | Only when you first use an online feature (leaderboard, daily challenge board) | Our backend (Supabase). Not linked to your name, email or device identifiers. |
| Nickname you choose | Only if you set one | Our backend; shown publicly on leaderboards. |
| Submitted scores — score, push-up count, difficulty, game duration, date, and basic game-integrity data used to detect impossible scores | When you submit a score to a leaderboard | Our backend; score and nickname are shown publicly. |
| Purchase information — an anonymous app-user ID, products bought, subscription status, store transaction identifiers | If you view the store screen or buy/restore Pro | Apple App Store or Google Play (who process payment — we never see your card details) and RevenueCat, which verifies purchases. |
| Product analytics — events such as "game started", "calibration completed", "share tapped", with game-level properties (difficulty, score, mode), app version, OS and device model | Only if you opt in; you can change this anytime in Settings | PostHog (EU hosting). No camera data, landmarks, video, advertising IDs, or precise location. |
| Challenge links you share — contain difficulty, score, a course seed and your nickname if set | When you tap share | Wherever you choose to send them. Anyone with the link can see those values. |
| Support messages | If you contact us | Our email provider; used only to answer you. |
Share images (score cards) are generated on your device and passed to your phone's share sheet; we do not receive them. We do not collect your contacts, photos, precise location, health records or advertising identifier, and we do not use third-party advertising or cross-app tracking SDKs.
Although the App involves exercise, it does not collect health or medical information. Push-up counts are game statistics. They stay on your device unless you submit a score to a leaderboard.
4. Website & waitlist
- Waitlist sign-up: your email address, the phone type you pick (optional), your browser language, the date and time you agreed to receive the launch email and the wording you agreed to, plus any campaign tags in the link you arrived from (for example
utm_source=tiktok) so we know which channels work. - Abuse prevention: to stop automated sign-ups we keep a one-way hash of your IP address for up to 24 hours. It is not stored with your email.
- Hosting logs: our hosting provider may process standard request logs (IP address, user agent, time) for security and reliability.
- No cookies or trackers are set by this website. Fonts are loaded from Google Fonts, which receives your IP address when your browser fetches them. [REVIEW: self-host fonts to avoid this transfer if preferred]
We use your email only to tell you when the App launches and for a small number of closely related product updates. Every email has an unsubscribe link.
5. Why we use data & legal bases (EU/EEA/UK)
- Providing the game and online features (leaderboards, daily challenge, challenge links): performance of our contract with you (Art. 6(1)(b) GDPR).
- Purchases and restoring them: contract (Art. 6(1)(b)) and legal obligations such as tax and accounting (Art. 6(1)(c)).
- Product analytics: your consent (Art. 6(1)(a)). You can withdraw it at any time in Settings; this does not affect earlier processing.
- Waitlist emails: your consent (Art. 6(1)(a)).
- Fair play, fraud and abuse prevention, security: our legitimate interest in keeping leaderboards fair and services safe (Art. 6(1)(f)).
- Camera access on your device: requested with your permission through iOS/Android. Under EU ePrivacy rules, accessing the camera is necessary to provide the feature you ask for.
6. Service providers
We use the following providers to run the service. They process data on our behalf under data-processing terms, or as independent controllers where noted.
| Provider | Purpose | Data |
|---|---|---|
| Supabase Inc. | Database, anonymous identity, leaderboard, waitlist | Anonymous ID, nickname, scores, waitlist emails |
| RevenueCat Inc. | Purchase verification and entitlements | Anonymous app-user ID, purchase records |
| Apple Inc. / Google LLC | App distribution and payments (independent controllers) | Governed by their own privacy policies |
| PostHog Inc. (EU cloud) | Opt-in product analytics | Event data listed above |
| [HOSTING PROVIDER] | Website hosting | Request logs |
| [EMAIL PROVIDER] | Sending the launch email | Waitlist email addresses |
We do not sell personal data and do not share it for cross-context behavioural advertising.
7. International transfers
Some providers are based in, or may access data from, the United States. Where data leaves the EU/EEA/UK, we rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses. [REVIEW: select the Supabase region (prefer EU) and confirm each provider's transfer mechanism]
8. How long we keep data
- On-device data: until you delete it in Settings or uninstall the App.
- Anonymous player ID, nickname and leaderboard scores: until you delete them in the App (Settings → Delete my data), or after 24 months of inactivity. [REVIEW: schedule this inactivity clean-up job in Supabase before launch, or remove this promise]
- Analytics events: up to 12 months.
- Waitlist emails: until you unsubscribe or ask us to delete them, and in any case no more than 6 months after launch unless you also sign up for ongoing updates.
- Purchase records: as long as required by tax and accounting law.
9. Your rights & choices
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent at any time. Email . Because we deliberately don't ask who you are, we may need your anonymous player ID (shown in the App's Settings) to find your data. You can also complain to your local data-protection authority.
In the App you can at any time: turn analytics off, change or remove your nickname, delete your online data, and revoke camera access in your device settings.
10. Deleting your data
- In the App: Settings → Delete my data removes your anonymous player ID, nickname and leaderboard entries from our backend and clears local progress.
- Waitlist: use the unsubscribe link in any email, or email us to delete your address.
- Subscriptions are managed and cancelled through your Apple or Google account; deleting your data does not cancel a subscription.
11. Children
MoveCombo is not directed at children under 13, and in the EU/EEA it is intended for users aged 16 or older (or the age of digital consent in your country). We don't knowingly collect personal data from children below these ages; if you believe a child has given us data, contact us and we'll delete it. [REVIEW: align with the age rating you select in App Store Connect and Google Play]
12. Security
Data is encrypted in transit. Our database uses row-level security so each player can only change their own data, and leaderboard submissions are checked on the server. No system is perfectly secure, but we keep what we hold to a minimum.
13. US state privacy notices
Residents of California and other US states with privacy laws have the right to know, access, correct and delete personal data, and to opt out of sale or sharing. We don't sell or share personal data for targeted advertising. Washington and Nevada consumer-health-data laws: the App does not collect consumer health data; exercise counts remain on your device unless you choose to submit a score. [REVIEW with counsel]
14. Changes & contact
If we change this policy we'll update the date above, and for significant changes we'll tell you in the App before they apply. Questions: · , .