Dopamining – Privacy Policy

1.2 Challenge, Workout, and Game Data

We store what you do in the Service:

• Your challenge, your daily goal, and the workouts you finish: workout type, reps or hold time, steps or distance, and start and end times.
• Your streak, Lives, Road progress, fights, Mine rolls, Dopamons, badges, and DPM balance.
• The duels, invites, and group races you take part in.
• Feedback that you send from Settings, with your app version, system version, and phone model.

1.3 Steps, Runs, and Health Data

Step and run challenges use your phone's sensors and health data. Each one needs your permission. You can turn it off at any time in your phone's settings.

• Step counter: the app reads your phone's step counter to count your steps during the day.
• Health Connect (Android): if you allow it, the app reads your step count for the current day. It reads only steps, only from local midnight until now, and never writes to Health Connect.
• Apple Health (iPhone): if you allow it, the app reads your step count, walking and running distance, and running workouts. It never writes to Apple Health.
• Location: when you start a run on your phone, the app uses GPS to measure the distance. On Android, a notification shows while it measures. The location points stay on your phone. We store only the distance.
• We store your daily step total and your run distance in your account, so that the day counts as done.
• We use step, distance, and health data only to count your workouts. We never use it for ads, never sell it, and never share it with third parties.

1.4 Device Information and App Usage

To send notifications, protect the Service, and improve it, we collect:

• A push notification token from Firebase Cloud Messaging and, on iPhone, Live Activity tokens.
• A random install ID that the app makes, with your platform and app version.
• App Check results that confirm a request comes from our real app or website: Google Play Integrity on Android, Apple App Attest on iPhone, and reCAPTCHA Enterprise on the website.
• Usage events, for example when the subscription screen opens, when a challenge starts or ends, or when you send an invite. Each event holds your account ID, platform, and app version.

1.5 Subscriptions and Billing

You subscribe on dopamining.org, where Stripe handles the payment. You type your card details on Stripe's page, not in the app. We do not store your card number. We store your subscription status, its end date, and your Stripe customer and subscription IDs. Stripe processes payment data under its own privacy policy: https://stripe.com/privacy

1.6 Website

On dopamining.org, Google Analytics for Firebase counts visits and page views. It uses cookies and similar browser storage. Your browser also stores your sign-in on your device.

2.2 Google MediaPipe (Android)

On Android, pose detection uses Google's MediaPipe Tasks library. Your camera images stay on your phone. MediaPipe sends Google metrics about how the library performs and how it is used. Google uses them to measure, fix, and improve MediaPipe. Google's notice: https://developers.google.com/edge/mediapipe/solutions/tasks. On iPhone, pose detection uses Apple's Vision framework and models on the phone, and sends nothing.

2.3 Future Anti-Cheating Verification (Not Yet Implemented)

We reserve the right to introduce optional, temporary verification checks to maintain challenge integrity. If implemented:

• The app may request one or more test images or short verification samples.
• These may be temporarily uploaded for the sole purpose of detecting cheating.
• All uploaded verification data will be deleted promptly after review.

4.2 Service Providers

These companies process data for us, under our instructions, to run the Service:

• Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check, and Analytics on the website): sign-in, data storage, servers, and notifications
• Stripe: subscriptions and payments on dopamining.org
• Apple and Google: Sign in with Apple, Sign in with Google, and push notification delivery

4.3 Google MediaPipe

Google also receives the MediaPipe metrics from the Android app (see 2.2) and uses them to improve MediaPipe.

4.4 Legal Requests

We share data with legal authorities only when the law requires it.

7.1 What We Delete

Deletion cannot be undone. We delete:

• Your account: email address, player name, account number, and settings
• Your challenge, workouts, steps, distances, streak, Lives, game progress, DPM balance, and notices
• Your player card, your name reservation, and your invite code
• Your devices, push tokens, and install IDs
• Your usage events and the feedback messages you sent
• Your duels that have no result yet, with their invite codes
• Your place in an active group race
• Your sign-in record. If you used Sign in with Apple on iPhone, we also ask Apple to remove the app's access.
• Your subscription, which we cancel

7.2 What We Keep

Some records stay after deletion:

• Duels you finished against another player, so that their result stays. Your side shows as "Deleted player", without your avatar or rep times. Your score stays.
• Group race standings, with your player name, avatar, and score.
• Invites you already sent, with your player name, in the other players' inboxes.
• Billing records of your payments, with us and at Stripe, as the law requires.
• Server logs, which can hold your account ID. They are deleted after 30 days.
• Our database's recovery copy, which expires after 1 hour.