Privacy Policy

1. Camera and pose tracking

Your live camera feed is processed on your device to detect body landmarks and control the game. We do not record, store, or upload camera images or video. The app may save derived workout information, such as tracking quality and movement-driven game results, but not the camera feed itself.

2. Information we collect

• Profile and account data: an internal user identifier, display name, avatar or avatar preset, profile settings, and privacy preferences. The app may create an anonymous account so your data can sync without requiring an email login.
• Workout and game data: session time, active time, distance, pace or speed, estimated calories, score, combo, coins, hits, lives, tracking quality, achievements, Journey progress, weekly goals, and leaderboard results.
• Health data: with your separate permission, the app writes completed workout information to Apple Health or Health Connect. We do not use health data for advertising or tracking.
• Subscription data: product, entitlement, purchase, renewal, and restore status supplied by Apple and RevenueCat. We do not receive your full payment-card details.
• Connected-service data: if you choose Strava sync, we receive authorization tokens and send workout details needed to create the activity.
• Usage and diagnostics: app interactions, device and app version, operating system, coarse technical context, performance data, crash reports, and error diagnostics when production analytics or crash reporting is enabled.
• Support communications: your email address and the contents of messages you send us.

The NYC Journey is virtual. WarmUp Runner does not need GPS location to place you on that route.

3. How we use information

• Run the game, calculate results, save progress, sync workouts, and provide leaderboards.
• Manage subscriptions, restore purchases, and provide customer support.
• Export a workout to a service only when you choose that action.
• Maintain security, prevent abuse, diagnose failures, and improve the Services.
• Comply with legal obligations and enforce our Terms.

We do not sell personal information and do not use personal information for cross-app advertising tracking.

4. When information is shared

We share information only as needed with:

• Apple and Google for app distribution, purchases, and optional health export.
• RevenueCat for subscription entitlement management.
• Supabase for authentication, database, storage, and server functions.
• PostHog for product analytics and Sentry for crash diagnostics, when configured.
• Strava when you connect it and request an activity sync.
• Authorities or other parties when required by law, needed to protect rights and safety, or involved in a business transfer.

Provider policies: Apple, RevenueCat, Supabase, PostHog, Sentry, Strava.

5. Public features

If you participate in the League, your chosen display name, avatar, distance, rank, and earned title may be visible to other players according to your profile privacy setting. Do not use a name or image you do not have permission to share.

6. Retention and security

We keep profile and synced workout data while your account is active or as needed to provide the Services. Support records, security logs, transaction records, and backups may be kept longer where reasonably necessary for support, fraud prevention, legal compliance, or dispute resolution. After a verified deletion request, we delete or de-identify data under our control within 30 days, except information we must retain; residual backup copies may remain for up to 90 days. No system is completely secure, but we use reasonable technical and organizational safeguards.

7. Your choices and rights

You can change camera, photo, notification, and Health permissions in device Settings; choose whether to export workouts; and control League profile visibility in the app. You may request access, correction, export, or deletion of data under our control through our Privacy Choices page. Deleting app data does not cancel an App Store subscription; subscriptions are managed through your Apple account.

8. Children and international use

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided information, contact us. Information may be processed in countries other than your own, subject to appropriate safeguards and applicable law.

9. Changes and contact

We may update this policy and will change the effective date above. For questions or privacy requests, email support@duckproject.app.