Privacy policy

SWADE SAS, represented by Romain Cheiko, 200 rue de la Croix Nivert, 75015 Paris, France, is the controller of your data. We have no data protection officer: for anything about your data, write to [email protected].

The camera, the pose tracking and the counting of your moves all run on your phone. No image, no video, not a single frame ever leaves it: not to us, not to anyone. We keep no photo, no body measurement, no skeleton. Only the outcome of a game travels: a score, your jumps and your squats.

You can play without an account. Then what you answer when you set up (why you play, your level, your days, what to go easy on) and what you play (your sessions, their scores and dates, your streak, your reminder time, your language) stay in the app’s own storage on your phone. Your phone’s backup (iCloud or Google) covers them like your other apps. None of it is sent to us.

Your reminders are set on the phone itself: we don’t send them, and they carry nothing about you.

An account keeps your progress safe and brings it to another phone. Creating one is up to you. When you do, here’s what we keep:

• Who you are: the first name and email address you give us, both needed to create it, and, with email, your password, stored only in a form that can’t be read back. With Apple or Google: the name, the email address and the ID that Apple or Google gives us. Never your profile picture or your contacts.
• Your plan: your answers from the setup, your days, your level, your reminder time, your language, and your time zone, so your days count where you live.
• Your progress: each session (the game, the date, how long it lasted, the score, your jumps and squats), your XP and your streak. What you played before signing up comes along once, so your streak survives it.
• Your sign-ins: when you signed in, the IP address and the type of device, to keep your account safe.

Why we may: it’s our contract with you. You asked for an account, and this is what it’s made of. Your sign-ins rest on our legitimate interest in protecting your account.

When you set up, the app asks if there’s anything to go easy on: your knees, your back, or nothing. “Nothing” costs you nothing: every move stays in. Pick knees or back, and jumps come out of your sessions. That’s all we use it for.

This answer is health data, which the GDPR protects more (article 9). Without an account, it stays on your phone. Answering is optional: “Nothing” is picked for you, and the answer is only used to take jumps out. With an account, it’s saved with your account when you pick knees or back, and that choice is your consent. You can take it back at any time, for free and without losing anything else: pick “Nothing to avoid” in Settings › Health, and your account forgets it as soon as your phone is online.

The App Store or Google Play sells Premium and takes your payment: we never see your card. RevenueCat runs the purchases for us. It gets an anonymous purchase ID, drawn and kept on your phone, your App Store or Google Play receipts, and what comes with every request of the app: platform, system and app versions, store country, IP address. Never your name, your email, your moves or an advertising ID.

Why we may: it’s our contract with you, to sell you Premium, switch it on and restore it. Checking at launch whether you hold Premium, even if you never bought it, rests on our legitimate interest in unlocking what you paid for and nothing else.

Out of energy? You can watch a short video for one more, if you want to. You choose it on the energy sheet; there’s never an ad during a session, and none with Premium. Google shows these videos, through AdMob, and nothing goes to Google until you tap one.

If you’re in the European Economic Area, the UK or Switzerland, Google first asks for your consent, in a standard IAB TCF form. Say no, and you can usually still watch: Google then shows non-personalised or limited ads. You can change your choice at any time in Settings › Support › Privacy choices.

Once you’ve tapped a video, Google’s ads SDK collects your IP address (which gives a rough location), crash and performance data, a device identifier (on Android, your advertising ID), the ads you see and how you interact with them. None of it is linked to your SWADE account. On iPhone, the app never asks to track you, so your advertising identifier isn’t shared. Your moves and your camera never reach Google.

Why we may: personalised ads rest on your consent, which Google’s form asks for. Non-personalised and limited ads rest on our legitimate interest, and Google’s, in paying for the energy you asked for with an ad instead of money; the form lets you object to it, and storing anything on your phone for them still needs your consent. Google uses this data under its own privacy policy; how Google uses data from apps that use its services.

Each request of the app to our servers names its version, its build and your platform. When it checks for an update, it also sends a random ID drawn when you installed it, the versions it runs and, after a crash, the last error message. Our server logs keep the IP address and the address asked for, never your name, your email or your moves.

Why we may: our legitimate interest in keeping the app running and secure.

We never sell your data. Only these companies handle it, each for its own job:

• Hetzner Online GmbH, in Germany, hosts our servers and our database.
• RevenueCat, Inc., in the United States, runs the purchases of Premium.
• Cloudflare, Inc., in the United States, hosts this website and keeps its access logs.
• Google, through AdMob, shows the reward video you choose to watch.
• Apple and Google sign you in, if you choose them, and sell Premium in their stores, under their own privacy policies.

Our servers are in the EU. RevenueCat, Cloudflare and Google may handle your data in the United States, and each states its safeguard:

• RevenueCat: the European Commission’s standard contractual clauses, in its data processing addendum.
• Cloudflare: its certification under the EU-U.S. Data Privacy Framework, with the standard contractual clauses as a backup, on its GDPR page.
• Google: its certification under the EU-U.S. Data Privacy Framework and its UK Extension and under the Swiss-U.S. Data Privacy Framework, and the standard contractual clauses where required, on its page on data transfer frameworks.

Want a copy of these safeguards? Write to [email protected].

Your account and everything it holds, as long as you keep it. Delete it, and it’s erased from our database right away: really erased, not hidden. A copy stays in our backups until they rotate. Our server logs, and our host’s for this site, are kept only as long as running and securing the service needs; we’re setting a cap, and this page will state it. RevenueCat keeps the receipts as long as we work with it: refunds and restoring Premium need them.

You can ask to see your data, correct it, delete it or take it with you. You can object to what we do on our legitimate interest, ask us to limit what we do, and withdraw your health consent or your ads consent at any time.

• Your answers and your plan, you change yourself in the app’s Settings.
• Settings › Account and data › Export my data hands you everything our servers hold, in one file.
• To delete your account, in the app or by email: here’s how.
• For everything else, write to [email protected]. A request sent to [email protected] counts just the same.

We answer within one month. Not happy with our answer? You can complain to the CNIL, the French data protection authority, or to the one where you live.

SWADE is for players aged 15 and up, as our terms of use say. The app doesn’t ask your age. Under 18? You can refuse personalised ads in Google’s form and still watch a video for energy.

No cookies, no audience measurement, no form, nothing loaded from another site. Only the access logs of our host, Cloudflare: the IP address, the page asked for, the browser. Why we may: our host’s and our legitimate interest in serving and securing it.

The date at the top says when we last changed it. Before the app does anything new with your data, this page says so first, and if it needs your consent, the app asks for it.

Anything about your data: write to [email protected] and a human answers.