Your movement.Not your footage.

PumpDuel uses your account, derived workout results, and the choices you make to run fitness challenges, private workouts, groups, rankings, and memberships. Camera frames, audio, and raw pose landmarks are not sent to PumpDuel during normal counting. Approximate location is optional. We do not sell personal information or use third-party advertising trackers.

Account and profile

A PumpDuel account identifier, the Firebase authentication subject linked to it, account dates, an optional handle, and profile settings. Production authentication currently uses Sign in with Apple through Firebase Authentication. Apple may provide a relay email depending on your Apple settings.

Workouts and competition

Disciplines, challenge and group participation, attempt state, derived rep events, accepted scores, results, ratings, ranks, streaks, records, and operational audit or idempotency records needed to keep competition fair and reliable.

Profile pictures

A photo you deliberately choose, upload metadata such as dimensions and checksum, generated size variants, consent version, and moderation state. An approved picture can appear anywhere your public profile or competition entry appears.

Approximate Arena

If you grant location permission, the app requests a low-accuracy location fix and resolves it on the iPhone to a supported regional Arena. PumpDuel stores the Arena name or identifier, not the location fix used to select it.

Device permissions and preferences

Camera, location, photo-library, and notification permission state; selected disciplines; map visibility; sharing and reminder choices; and app state needed to resume onboarding or a pending membership activation.

Website and support

Privacy-limited challenge landing records described below, ordinary server security logs, and the contents and addressing information of messages you choose to send us.

Membership

A provider customer identifier, product and store, entitlement state, purchase and expiry times, renewal state, and events such as trial, renewal, cancellation, billing issue, refund, or transfer. These records are associated with your PumpDuel account after sign-in.

PumpDuel uses Apple's camera and on-device pose processing to decide whether movement meets the rules and to count reps. During normal play, frames are processed in volatile device memory. We do not record or upload camera video, audio, or raw pose landmarks, and rivals do not receive a video feed.

When you take an official attempt, the app can send derived competitive data such as accepted-rep events and the final score. If you deliberately enable a Share Replay, its video remains in the app's private storage or in Photos when you choose to save or share it. PumpDuel does not upload Share Replays as judging evidence.

Depending on where you live, data-protection law may require a legal basis. We use information to:

Provide the service

Create and secure accounts, count and verify results, operate challenges and groups, show stats, restore progress, provide memberships, and respond to support requests. This is generally necessary to perform our contract with you.

Protect players and PumpDuel

Prevent abuse, enforce limits, investigate failures, moderate public pictures, keep audit records, and secure the service. We generally rely on legitimate interests and legal obligations.

Improve the product

Understand privacy-limited challenge visits and aggregated product performance, diagnose faults, and plan improvements. We rely on legitimate interests where permitted and respect the objection control below.

Respect your choices

Use location, notifications, Photos, public-profile features, and Share Replay only after your relevant choice or device permission. You can change these choices in the app or iOS Settings.

Meet legal duties

Keep records needed for accounting, tax, disputes, law-enforcement requests, and the establishment or defence of legal claims.

We do not use camera footage, health data, or other information for targeted advertising, and we do not make decisions with legal or similarly significant effects using automated profiling.

PumpDuel is competitive, so some information becomes visible when you choose public or link-shared features. This may include your handle or a privacy-safe fallback label, approved profile picture, score, rank, challenge, group role, and approximate Arena. A handle is not required for private training or private stats, but it can be required before publishing or joining a public competition.

A link-only challenge page can be opened by anyone who receives its hard-to-guess link. We ask search engines not to index those pages, but that does not make a forwarded link private. We never display your precise or current location to other players.

We share only what is needed with providers operating on our behalf or as independent payment or platform providers:

Apple

For Sign in with Apple, App Store purchases, device permissions, Photos, notifications, and other iOS services.

Google Firebase

For authentication and App Check. Firebase Authentication may process authentication data in the United States.

RevenueCat

For in-app membership status, purchase restoration, entitlement reconciliation, and billing events.

Hosting and storage providers

For the website, application API, PostgreSQL database, logs, and profile-picture object storage.

If web membership purchasing is offered and you use it, RevenueCat's hosted flow and its connected payment provider collect your billing email and payment details, create a temporary anonymous provider identity, and issue a one-time redemption link. RevenueCat may email that link to you. PumpDuel does not receive your full card number or store the redemption link on its website servers. After you sign in to the app, the link connects the purchase to your backend-issued PumpDuel account identifier and the backend independently reconciles membership status with RevenueCat.

Read the providers' own notices: Apple, Firebase, and RevenueCat.

We may also disclose information when reasonably necessary to comply with law, protect people or the service, investigate fraud or abuse, or complete a merger, financing, reorganisation, or sale subject to appropriate protections.

The public website currently uses limited first-party analytics on shared challenge and creator-invite pages. For challenge landings, the browser creates a random identifier for that challenge and UTC day. An older dated identifier is removed the next time a challenge page opens. The backend stores the identifier, challenge, observed date, first and last observation, and a likely-bot flag.

These pages also record limited interactions such as opening the app or App Store, copying a code, and selecting a leaderboard or invite action. The browser creates a random identifier for the current tab session. Each event contains that identifier, a random event identifier, the interaction name and time, and the relevant challenge code or internal creator-invite identifier. An incoming network address may be transformed into a keyed hash for rate limiting before either analytics request is forwarded; PumpDuel does not persist the raw address or full user-agent in the analytics tables.

We do not use advertising pixels, cross-site trackers, session replay, camera data, precise location, billing details, redemption links, or Firebase identifiers for this website analytics. The analytics-objection cookie below is a necessary preference cookie and lasts for one year.

Your right to object: you can turn this limited analytics processing off above or email [email protected]. We also honour Global Privacy Control and the browser Do Not Track signal for both analytics endpoints. Turning analytics off removes PumpDuel challenge-landing and interaction-session identifiers already held in this browser and stops future optional analytics requests from it; it does not delete aggregated or previously collected server records.

A future RevenueCat web checkout may use storage that is necessary to display plans, complete a purchase, prevent duplicate transactions, and recover the immediate checkout state. We will update this section before that checkout launches if its tested behaviour adds any non-essential technology.

We keep personal information only while it serves the purposes above, then delete or de-identify it unless law, safety, accounting, fraud prevention, a dispute, or a legal claim requires longer retention.

Account and gameplay

Generally for the life of the account and a limited deletion or dispute period. Some competition records may be de-identified rather than removed where needed to preserve other players’ results.

Challenge analytics

Raw share and challenge-landing records are scheduled for no more than 13 months. Aggregates may remain when they can no longer identify a person.

Membership records

For the membership lifecycle and longer where required for tax, accounting, refunds, chargebacks, fraud prevention, or legal claims.

Profile pictures

While selected and for short processing, replacement, moderation, recovery, or evidence periods. Removing a picture takes it out of active publication; backup and cache copies may expire later.

Browser preference

The analytics-objection cookie lasts one year unless you remove it sooner. Dated challenge identifiers are cleared on a later challenge visit. Interaction identifiers last for the current tab session. Both are removed when you object or clear site data.

Support and security

For as long as needed to answer the request, protect the service, document action taken, and meet legal requirements.

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal information; object to certain processing; withdraw consent; and complain to your local data-protection authority. These rights can have legal exceptions.

You can change camera, location, Photos, and notification access in iOS Settings; choose private visibility in PumpDuel; remove a profile picture in the app; clear this site's browser data; or use the analytics objection above. To make a data request or object for your account, email [email protected]. We may ask for enough information to verify the account and protect it from unauthorised requests.

We use safeguards designed to protect information, including encrypted transport, authenticated API access, provider credential separation, access controls, bounded public data projections, and measures against duplicate or forged purchase and competition events. No internet service can guarantee absolute security.

PumpDuel and its providers may process information outside your country. In particular, Firebase Authentication and RevenueCat process information in the United States. Where required, we rely on provider agreements and lawful transfer safeguards.

PumpDuel does not currently ask for a date of birth and does not knowingly collect personal information from children who are not legally able to use the service. Unknown-age accounts use conservative defaults, but those defaults are not an age verification system. If you believe a child has provided information improperly, contact us so we can investigate and take appropriate action.

The controller is 10Q Solutions Ltd (company number 15681198), Suite A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. Questions, objections, complaints, or requests can be sent to [email protected].

10Q Solutions Ltd has not appointed a representative in the European Union under Article 27 of the GDPR. People in the European Economic Area may contact the controller directly using the details above.

We may update this policy as PumpDuel changes. We will post the new version here, change the effective date, and provide additional notice when required by law.