Privacy Policy

CardioSurf is a camera-based cardio fitness game. You play workouts by physically moving — jumping, ducking, and stepping side to side — in front of your device's front camera. This Privacy Policy explains what information the app collects, how it is used, and the choices you have.

1. Who we are

This app is "CardioSurf" (the "App"). This policy applies to the CardioSurf mobile application. If you have questions, contact us using the details in the Contact section below.

2. Camera and movement tracking

Gameplay uses your device's front camera to track your body movements. This is how it works:

• Camera frames are analyzed entirely on your device using Apple's on-device Vision body-pose technology.
• The App only derives body-position keypoints (for example, the approximate on-screen position of your shoulders, hips, knees, and ankles) to recognize moves like jump, duck, left, and right.
• Camera video and images are processed in real time and are not recorded, saved to your device, or transmitted off your device. The App does not upload camera frames, photos, or video to us or to any third party.
• The camera runs only while you are on a workout/tracking screen, and stops when you leave it.

On devices or builds where on-device pose tracking is unavailable, the App simply reports tracking as unavailable; it does not send your camera data anywhere as an alternative.

3. Account information

To create and access an account, you can sign in with email and password, Sign in with Apple, or Sign in with Google. Depending on the method you choose, we store:

• Your email address;
• Your display name and/or chosen username;
• A profile photo URL, if provided by your sign-in provider.

Account authentication and this profile data are handled using Firebase Authentication and Cloud Firestore (Google). If you use Sign in with Apple's "Hide My Email" feature, we receive only the relay email Apple provides.

4. Progress and usage data

To save your progress and let you resume across sessions and devices, we store workout progress in Cloud Firestore under your account, including:

• Workout run records (such as completed workouts, scores, and related progress state);
• Your selected class/program and related progression state;
• Basic technical fields tied to those records (timestamps).

This data is associated with your account identifier so it can be synced back to you.

5. Subscriptions and purchases

CardioSurf offers optional paid subscriptions and a one-time lifetime purchase. Purchases are processed by Apple through the App Store, and subscription/entitlement status is managed via RevenueCat. We do not receive or store your full payment card details; those are handled by Apple. RevenueCat associates your purchase/entitlement status with an app user identifier so premium access can be unlocked and restored.

6. Support messages

If you contact us through the in-app Help & Support feature, we store the message you send in Cloud Firestore so we can read and respond. That record may include the message text, the category you selected, your account identifier, email, and display name (when available), your platform (iOS/Android), and the app version.

7. Third-party services

We use a small number of service providers to run core functionality:

• Firebase / Google — authentication, database (Cloud Firestore), and, where applicable, Sign in with Google.
• Apple — Sign in with Apple, App Store purchases, and on-device Vision pose detection.
• RevenueCat — subscription and entitlement management.

These providers process data on our behalf to deliver the App's features. We do not use third-party advertising SDKs, and the App contains no ad or web tracking scripts.

8. How we use information

• To create and secure your account and sign you in;
• To run gameplay and recognize your movements on-device;
• To save and sync your workout progress;
• To provide, restore, and manage subscriptions;
• To respond to your support requests;
• To maintain, troubleshoot, and improve the App.

We do not sell your personal information.

9. Data retention and deletion

We keep account and progress data for as long as your account exists. You can delete your account at any time from within the App (Profile → Delete Account). Deleting your account removes your workout run records, progress state, and profile document, and deletes your authentication record. Support messages you previously submitted and purchase records held by Apple/RevenueCat may be retained as needed for legal, accounting, and fraud-prevention purposes.

10. Children's privacy

CardioSurf is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us so we can remove it.

11. Security

We rely on established providers (Firebase/Google, Apple, RevenueCat) and their security controls, and we restrict access to account data using per-user security rules. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be reflected in the App or on this page.

13. Contact

For privacy questions or requests, email us at support@cardiosurf.com. You can also use the in-app Help & Support feature or reach us through our Support page.