Privacy policy.

This Privacy Policy explains how Point Zero GmbH processes personal data when you use the Streakletics mobile app (the “App”). It applies only to the App. The Streakletics website is covered by a separate Website Privacy Policy.

1. Controller and contact details

The controller responsible for processing your personal data is:

Point Zero GmbH
Speditionstr. 15A
40221 Düsseldorf
Germany

Phone: +49 162 7555786
Privacy and general enquiries: info@pointzero.tech
App support: support@pointzero.tech

Further company information is available in our Legal Notice.

We have not appointed a data protection officer.

2. How we obtain and use personal data

We obtain personal data:

• directly from you, for example when you enter profile information, record a training session, send feedback or contact us;
• automatically from the App and your device, for example an internal user identifier, technical diagnostics and product-usage events;
• from service providers you choose to use, such as Google Sign-In, an app store or a payment platform; and
• by deriving limited status information from your activity, such as streaks, records, badges or Pro entitlement status.

We process personal data only for the purposes described below. Depending on the processing operation, the legal basis is:

• Article 6(1)(b) GDPR, where processing is necessary to provide the App or perform a contract with you;
• Article 6(1)(a) GDPR, where we ask for your consent, for example for push notifications or certain advertising-related processing;
• Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation; or
• Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests, particularly App security, abuse prevention, troubleshooting, product improvement and the establishment, exercise or defence of legal claims, provided that your interests and fundamental rights do not override those interests.

3. Guest use, anonymous accounts and registration

You can begin using the App without completing a conventional registration form. This guest mode is not technically accountless: when you continue through the initial onboarding, Firebase Authentication creates an anonymous account and assigns a persistent internal user identifier (UID). A corresponding user record is created so that the App can save your progress and provide its functions.

You may later register or upgrade the same account using an email address and password. This links the login credentials to the existing account so that your saved progress can be retained. We process the UID, authentication status, email address and authentication information required for this purpose. Passwords are handled by Firebase Authentication; we do not store a readable copy of your password.

You may also choose Google Sign-In. In that case, Google authenticates you and may provide us with information associated with your Google account, such as an account identifier, email address, display name and profile image, depending on your Google account and the permissions shown during sign-in. Google processes data for its own authentication service under the Google Privacy Policy.

The legal basis for anonymous account creation, registration, login and account linking is Article 6(1)(b) GDPR. Security and abuse-prevention measures are additionally based on Article 6(1)(f) GDPR.

4. Training data, progress and local App settings

To provide the core Streakletics functions, we process information such as:

• completed training sessions, including date and time;
• exercise type, training level or day, repetitions, sets, rest periods and duration;
• for push-up sessions, the time of each repetition, measured from the start of the session;
• totals, personal records, streaks, streak freezes, badges and progress;
• selected training, coach, display and language preferences; and
• account and entitlement status, such as guest status and whether Pro features are available.

This information is used to run training sessions, save and display your progress, calculate statistics and achievements, synchronise data and restore your account. The legal basis is Article 6(1)(b) GDPR. Processing required to detect errors, manipulation or misuse is based on Article 6(1)(f) GDPR.

We use the timing of individual push-up repetitions to check whether push-up sessions are plausible, and to develop and validate these checks (see Section 17). We do not use it to draw conclusions about your health or fitness. It is not sent to analytics or advertising services and is not publicly visible. Only for the daily fair-play check described in Section 17 does a numeric summary leave our Google Cloud systems, without your name, user ID or any other direct identifier; the individual times never do. The timing is deleted when you delete the training session or your account (see Section 14).

Some settings and cached App state are stored locally on your device, for example the selected language, training preferences, guest status and a locally cached Pro status. This local storage is used to provide the functions and settings you request and to avoid unnecessary server requests. To the extent Section 25 TDDDG applies, this storage is used for functions expressly requested by you and is based on Section 25(2) no. 2 TDDDG.

The App does not request access to Apple Health, HealthKit, Google Fit or comparable health databases. It does not ask you to provide diagnoses or medical records. Training and performance information is not used to diagnose medical conditions.

5. Profile and leaderboard visibility

The App creates a community profile record linked to your UID. Depending on the information available and the functions you use, this record may contain:

• display name;
• profile image;
• motto;
• training totals, streaks and personal records;
• badges; and
• Pro status.

These fields may be displayed in leaderboards and profile views to other authenticated Streakletics users. “Authenticated users” includes users with a registered account and users who are signed in through the App with an anonymous Firebase account. The profile records are not available through Firestore to persons without an authenticated Streakletics session, but they are visible within the Streakletics community and should not be treated as private information.

We calculate the leaderboard totals and records on our servers from your saved training sessions (see Section 8.2). Sessions that do not pass our plausibility check are not counted there (see Section 17). If authorised personnel identify manipulation, they may also decide that an account’s sessions from a certain period are not counted on the leaderboard.

A community profile is currently created as part of onboarding and the App does not currently provide a separate profile-visibility switch. Do not enter a display name, motto or upload an image that you do not want other Streakletics users to see.

Processing required to provide community profiles and leaderboards is based on Article 6(1)(b) GDPR. Measures used to maintain leaderboard integrity, prevent abuse and enforce our rules are based on Article 6(1)(f) GDPR.

6. Profile images, sharing, reviews and device permissions

If you choose a profile image, the App requests access to the photo you select from your device’s photo library. The selected image and related file metadata, such as file size and upload time, are uploaded to Firebase Storage. The legal basis is Article 6(1)(b) GDPR. You can replace or remove the image in the App.

The current App does not request camera or microphone permission. It may request photo-library access when you select a profile image or choose an available action to save App-generated content. It requests notification permission only if notifications are offered or enabled.

If you use the sharing feature, the App creates shareable content and opens the operating system’s share sheet. Data is sent to another service only after you select that service. The selected recipient or platform processes the shared content under its own terms and privacy policy. Section 9 describes how we recognise whether a shared link led to an installation.

If you choose to rate the App, you are redirected to the relevant app-store review interface. Any rating or review is processed by the app-store operator under its own privacy terms.

7. Feedback, reports and blocking

If you submit in-App feedback, we process the content of your message, your UID, the time of submission and technical or account context needed to understand and respond to it. Please do not include unnecessary sensitive personal data in free-text fields.

If you report or block another user, we process the identifiers of the users involved, the report category or reason, any information you submit, timestamps and moderation status. We use this information to review reports, protect users, prevent abuse and enforce our Terms of Service.

Feedback connected to the provision of or support for the App is processed under Article 6(1)(b) GDPR. General product feedback and moderation, reporting and blocking are processed under Article 6(1)(f) GDPR, based on our legitimate interests in improving the App, maintaining a safe community and defending against abuse or legal claims.

8. Firebase and Google Cloud services

We use Firebase and Google Cloud services supplied under our business account by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, and other Google affiliates and subprocessors may also process data when providing these services.

We have entered into Google’s applicable data processing terms. Further information is available in Google’s Firebase Privacy and Security information, Cloud Data Processing Addendum and Privacy Policy.

8.1 Firebase Authentication, Cloud Firestore and Firebase Storage

Firebase Authentication manages anonymous accounts, registered accounts and sign-in. Cloud Firestore stores account, profile, training, progress, feedback and moderation-related data. Firebase Storage stores uploaded profile images. These services process the relevant content together with technical identifiers, timestamps, request metadata and connection information needed to provide and secure the services.

Our primary Cloud Firestore database is located in europe-west3 (Frankfurt, Germany). Other Firebase components may use different locations as described below or in Google’s service documentation.

The legal basis for providing these functions is Article 6(1)(b) GDPR. Security, fraud prevention and service integrity are based on Article 6(1)(f) GDPR.

8.2 Cloud Functions

We use Google Cloud Functions to perform backend operations, including push notifications, account deletion and the leaderboard. For the leaderboard, the functions calculate your public totals and records from your saved training sessions, run the plausibility checks described in Section 17 and store which sessions were counted and the results of those checks.

The custom functions run partly in the EU (europe-west3, Frankfurt, Germany) and partly in the United States (us-central1). Updating leaderboard values when a training session or profile changes, handling new push notifications and the daily check of Android push tokens (Section 8.4) run in Frankfurt. Registering push tokens, sending scheduled push notifications, the regular reconciliation and clean-up of leaderboard data, which also processes training sessions and profile data, and clean-up steps after an account deletion run in the United States. The Firebase account-deletion extension is configured in europe-west3.

The functions process only the information required for the relevant operation, such as UIDs, push tokens, device type, training sessions and values calculated from them, and records that must be located or deleted. The legal bases correspond to the underlying function: Article 6(1)(b) GDPR for providing requested App functions, including the leaderboard, and Article 6(1)(f) GDPR for secure and reliable operation, leaderboard integrity and product analytics (Section 8.4).

8.3 Firebase Crashlytics

In production releases, we use Firebase Crashlytics to detect, analyse and fix crashes. Crashlytics may process:

• crash reports and stack traces;
• the time and technical circumstances of a crash;
• App version;
• device model, operating-system version, locale and orientation;
• Firebase and Crashlytics installation identifiers; and
• your UID, where available in a production session.

We do not intentionally include your name, email address or raw content from free-text fields in Crashlytics reports. Crash reporting is not enabled for our debug, profile or test builds. Google states that Crashlytics retains crash stack traces and associated identifiers for 90 days before beginning removal from live and backup systems.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is maintaining a secure, stable and reliable App and identifying errors that would otherwise be difficult to reproduce.

8.4 Firebase Cloud Messaging

If you enable push notifications, we use Firebase Cloud Messaging (FCM) to deliver notifications such as training reminders. For this purpose, we process a device-specific push token, device type and technical delivery information. Notification content is transmitted as necessary for delivery.

The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by disabling notifications in the App, where available, or in your device settings. Disabling notifications does not affect the lawfulness of processing before withdrawal.

About once a day, our servers send a technical push message without any visible content to the push token of Android devices on which notifications are enabled. The message is not displayed. To receive it, Android may briefly start the App’s process in the background, where the push library discards it; no App screen opens and the App records no use. If Firebase Cloud Messaging reports that a token is no longer registered, we delete it; this is part of delivering the notifications you enabled.

Separately, for product analytics, we then record a pseudonymous event in Mixpanel (“push token no longer registered”) under your Firebase UID, together with technical context: how long ago the App last registered the token, the token’s age, how many other push tokens are stored for your account and how this token relates to them. A token can stop being registered because the App was uninstalled, its data was cleared, after a logout or for technical reasons, so we treat this only as an indication; it never tells us why. iOS devices are not checked. The event is based on Article 6(1)(f) GDPR, as described in Section 9. Our legitimate interest is learning which App experiences precede people stopping to use the App, so that we can improve it. If you object (Section 9), we stop recording the event for you and only delete invalid tokens. Until Mixpanel has received it, the event is kept on our servers for at most five days.

8.5 Firebase App Check

Firebase App Check helps protect our backend against unauthorised clients, automated access and manipulation. The production App uses Google Play Integrity on Android and Apple App Attest on iOS. These services process app, installation, device-integrity and security-token information needed to assess whether requests originate from a genuine App installation. The checks are not used by us to determine your creditworthiness or make decisions with legal or similarly significant effects.

Processing is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in securing the App, user accounts and backend systems.

8.6 Technical logs

Google Cloud and Firebase generate technical logs when the App communicates with the backend. Depending on the service and request, these logs may include IP address, time, requested resource, response or error information, device or client information, security signals and a UID or other technical identifier.

We use these logs for security, troubleshooting, abuse prevention and reliable operation under Article 6(1)(f) GDPR. Our Google Cloud Logging configuration retains ordinary _Default log-bucket data for 30 days. The _Required bucket, which primarily contains mandatory audit logs, is retained for 400 days. Individual Firebase services may have their own documented retention periods.

8.7 Services not used

The App version covered by this Privacy Policy does not use Google Analytics for Firebase or Firebase Performance Monitoring.

9. Mixpanel product analytics

We use Mixpanel in production releases to understand how the App’s functions are used, identify failed or confusing flows, assess feature adoption and prioritise product improvements. The service is provided by Mixpanel, Inc., Pier 1, Bay 2, The Embarcadero, San Francisco, California 94111, USA.

Mixpanel starts automatically when the production App is used. Depending on your activity, the following information is processed:

• a Mixpanel-generated pseudonymous identifier and, after account identification, your Firebase UID as the Mixpanel distinct_id;
• whether the account is a guest account and whether Pro features are active;
• selected language;
• product-usage events relating to training flows, streaks, paywalls, prompts, sharing and moderation functions;
• an event recorded by our servers when the push token of your Android device is reported as no longer registered (Section 8.4);
• if you take out a Pro subscription, events about that subscription that RevenueCat sends to Mixpanel on our behalf (see below);
• on iOS, whether an Apple Ads advertisement led to the installation of the App and, if so, the identifiers of the campaign, ad group and search term, whether the ad was tapped or only viewed and whether it was a re-download (see below);
• on Android, the route by which the App was installed (for example a link shared in the App, a Google Ads advertisement, our website or the App’s page on Google Play), together with selected campaign details from the link and the number of days between tapping the link and the installation (see below);
• limited contextual values such as the current streak;
• structured technical result, error-code or error-category information; and
• SDK and connection information that may include timestamps, App version, operating system, device type, time zone, IP address and coarse location derived from the network connection.

The UID is a persistent pseudonymous identifier, not anonymous data. We do not send your display name, email address, phone number, profile-image URL or raw error messages to Mixpanel, and the App sends Mixpanel no separate RevenueCat identifiers; what RevenueCat itself sends is described below. We do not use Mixpanel Session Replay, advertising profiling or heatmaps, and Mixpanel data is not shared with AdMob for advertising purposes. Mixpanel is disabled in debug, profile and test builds.

The Mixpanel SDK may store technical information on your device to maintain its identifier, settings and a local event queue before transmission. For the processing of personal data through Mixpanel under the GDPR, we rely on Article 6(1)(f) GDPR rather than consent. Our legitimate interests are understanding whether core product flows work as intended, improving usability, detecting recurring technical failures and directing development resources toward features that users actually use. In balancing these interests, we take into account the pseudonymous identifier, the exclusion of direct contact and profile information, the restriction to production builds, the use of an EU data region and the absence of advertising use or session recording.

Where an iOS installation came from (Apple Ads). After installation the App asks Apple once, through Apple’s AdServices interface, whether an Apple Ads advertisement led to the installation. For this your device generates a token that the App sends to Apple. Apple replies whether an ad can be attributed and, if so, names among other things the campaign, ad group, search term, the type of attribution and whether it was a re-download. According to Apple, this reply contains no information that identifies you or your device and is not tracking within the meaning of App Tracking Transparency, so the App does not ask for tracking permission and does not read the advertising identifier (IDFA). Of this reply we keep only the details named above on your device and send them to Mixpanel with the usage events; whether Apple attributed the installation to an ad is also recorded on your Mixpanel user profile. At Mixpanel, like all usage events, this information is linked to your pseudonymous identifier (Firebase UID), so it is not anonymous. We use it only to measure whether our own ads reach people who actually use the App, and we do not pass it to Apple, AdMob or any other ad network. Under the GDPR, the legal basis for this processing is Article 6(1)(f) GDPR; our legitimate interest is limiting advertising spend to ads that work. If you turn usage analytics off, this information no longer reaches Mixpanel from then on.

Where an Android installation came from (Google Play). After installation the App asks Google Play once, through its Install Referrer interface, which link it was installed from. Google Play returns the referrer that the link to the store page carried, and the times at which the link was tapped and the installation began. The App stores this referrer on your device and derives from it whether the installation came from a link shared in the App, a Google Ads advertisement, our website, the App’s page on Google Play or another link. We send this origin to Mixpanel with the usage events and with your Mixpanel user profile. In separate installation events we also send campaign details from the link, but only known values from a fixed list (for example those of our own links, our website and Google Ads), with a placeholder for any other value; the names of recognised link parameters, for example that a Google Ads click identifier was present; how many other, unrecognised parameters the link carried; and the number of days between the tap and the installation. We do not send the value of such a click identifier or any other content of the referrer to Mixpanel, and we pass none of this to Google Ads or any other ad network.

If the installation came from a link that another person shared in the App, the referrer contains their share code. If you then complete the first onboarding on this device with a new account, including as a guest (Section 3), we store this code once in your user record in Firebase (Section 8), to measure how many new users find the App through shared links. This does not happen for an existing account, for your own code, or if more than 30 days have passed since the read. Other users cannot see your user record, and the App currently shows the person who shared the link nothing about it. The share code itself is not sent to Mixpanel. It remains stored until you delete your account (Section 14). Likewise, a link you share contains your share code; if someone installs the App through it, your code is stored with their account in this way.

Under the GDPR, the legal basis for both is Article 6(1)(f) GDPR. Our legitimate interest is understanding how people find the App, limiting advertising spend to channels that work and evaluating the sharing feature. If you turn usage analytics off, this information no longer reaches Mixpanel from then on; this does not undo a referrer read that has already happened or information already sent (for deletion at Mixpanel, see below). The setting does not apply to storing the share code in your user record; you can object to that by contacting us at the details in Section 1.

You can turn Mixpanel product analytics off at any time in the App under Settings > Help & App > Usage analytics. From then on, the App records no further usage events or profile properties for Mixpanel; events it recorded before may still be transmitted. As soon as the setting reaches our servers, they also no longer record the push-token event described in Section 8.4 for your account. The setting is saved on your device and with your account; on your other devices signed in to the same account, it takes effect shortly after the App next starts there with an internet connection, or after you sign in there. If you turn it back on, analytics resumes from that moment. Crash reports (Section 8.3) are not affected, and neither are the subscription events that RevenueCat sends to Mixpanel (see below).

Independently of this setting, you have the right to object to this processing on grounds relating to your particular situation under Article 21 GDPR. You may submit an objection to info@pointzero.tech. We will assess and handle it in accordance with Article 21 GDPR.

If you take out a Pro subscription, RevenueCat (Section 11) also sends events about it to our Mixpanel project on our behalf, directly from its servers: for example when a trial period starts, when the subscription renews, is cancelled or expires, or when a payment fails. These events are sent under your Firebase UID and contain information about the subscription: the product, the offering and entitlement it belongs to, any offer code, the app store, price and currency, the type of period (for example a trial period) with its start and end and, after a failed payment, the end of the grace period, the reason for a cancellation or expiry, the time of the event and whether it was a test purchase. They also contain the app store’s order and transaction numbers, the identifiers of your RevenueCat customer record (your Firebase UID and an automatically assigned RevenueCat identifier linked to it) and the customer attributes stored there, which currently hold only the Mixpanel identifier set by the App, your Firebase UID. RevenueCat sends such an event whenever the app store reports a change to the subscription. That can still happen after the subscription has ended, for example when a refund is processed, and after you have deleted your Streakletics account, because deleting the account does not cancel the subscription (Section 11). On the basis of Article 6(1)(f) GDPR, we use these events to understand how trial periods, subscriptions and cancellations develop. That is our legitimate interest here, in addition to those described above.

The setting in the App does not cover these events, because RevenueCat offers no way to exclude individual users from this transmission. You can object to it by email as described above. If we accept your objection, we stop the transmission of your subscription events to Mixpanel and request the deletion of the data Mixpanel already stores under your UID, including earlier subscription events. Mixpanel may take several weeks to complete a deletion.

Our Mixpanel project uses the EU data-residency endpoint, and project data is stored in Mixpanel’s Netherlands data centre. Our configured retention period for event data is two years. Mixpanel user-profile data may be retained for the duration of the active Mixpanel subscription unless it is deleted earlier. Mixpanel data is not yet automatically erased when a Streakletics account is deleted, and deleting the account in the App does not by itself stop the subscription events described above. You may request the deletion of your Mixpanel data from us using the contact details above. If we accept your request and a subscription can still produce subscription events for your former account, we first stop their transmission to Mixpanel and only then request the deletion.

We have entered into a data processing agreement with Mixpanel. Further information is available in Mixpanel’s Privacy Policy, GDPR information and Data Processing Addendum.

10. Advertising through Google AdMob

The free version of the App may display advertisements through Google AdMob. AdMob is provided by Google and may process:

• IP address and network-derived approximate location;
• device and App information, including operating system, App version and language;
• a mobile advertising identifier or comparable identifier where available and permitted;
• ad impressions, interactions and technical delivery information; and
• information required for frequency control, aggregated reporting, security and fraud prevention.

The Android release includes the advertising-ID permission required by the AdMob SDK. Apple’s SKAdNetwork may provide aggregated advertising-attribution information.

AdMob is configured to serve only non-personalised ads to all users. The App does not request App Tracking Transparency permission and does not access the advertising identifier (IDFA); Google’s Publisher First-Party ID is disabled. Non-personalised ads may still use a device-local identifier for frequency capping and aggregated reporting, but are not used for cross-app or cross-site tracking. Google’s User Messaging Platform (UMP) continues to provide the required advertising disclosures and privacy choices.

You can revisit available advertising privacy choices through the App’s privacy or ad-consent settings. Device-level advertising controls may also be available in your operating-system settings.

Where processing or access to device information requires consent, the legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG. Processing strictly necessary for secure, restricted ad delivery and fraud prevention may be based on Article 6(1)(f) GDPR and, where applicable, Section 25(2) TDDDG. Our legitimate interests are financing the free version of the App and protecting advertising systems against misuse, subject to your rights and the restrictions described above.

Further information is available in Google’s information about privacy and messaging for AdMob and the Google Privacy Policy.

11. Subscriptions, app stores and RevenueCat

Paid Pro subscriptions and in-app purchases are processed by the app store through which you obtained the App. The store operator processes payment credentials and payment transactions under its own terms. We do not receive your complete credit-card or bank-account details.

We use RevenueCat to manage products, purchases, subscriptions and entitlements. RevenueCat is provided by RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, Florida 33511, USA. RevenueCat may process:

• your Firebase UID as the RevenueCat App User ID;
• product, offering and entitlement identifiers;
• subscription and purchase status, purchase dates, renewals, cancellations and expiration;
• app-store receipt or purchase-token information;
• platform, device type, operating system and App version; and
• technical status and error information required to validate and restore entitlements.

Processing is necessary to perform the subscription contract and provide Pro features under Article 6(1)(b) GDPR. Fraud prevention, entitlement troubleshooting and reconciliation are based on Article 6(1)(f) GDPR.

On our behalf, RevenueCat also sends events about your subscription to our Mixpanel project. Section 9 describes what they contain, why we use them and how you can object; the usage-analytics setting in the App does not cover them.

On iOS the RevenueCat SDK also sends the Apple Ads token described in Section 9 to RevenueCat, which uses it on our behalf to retrieve the attribution to an Apple Ads campaign from Apple and stores it, for example with the campaign, ad group, search term, ad and country, with your customer record, which is kept under your Firebase UID, so that we can attribute purchases to a campaign. The in-app usage-analytics setting does not apply to this; you can object by contacting us at the details above.

RevenueCat stores customer data using Amazon Web Services in the United States. We have entered into a data processing agreement with RevenueCat. Further information is available in RevenueCat’s Privacy Policy and Data Processing Addendum.

Deleting your Streakletics account does not automatically cancel an active subscription. You must cancel it separately through the relevant app-store subscription settings. RevenueCat records are not yet automatically deleted when you delete your Streakletics account and may remain where required to administer purchases, restore entitlements, prevent fraud or comply with legal retention obligations. You may ask us to assess deletion or restriction using the contact details in Section 1; deletion may be limited where records remain necessary for an active subscription or a legal obligation.

For further information about the app stores, see the Google Privacy Policy and Apple Privacy Policy.

12. Contact by email and Google Workspace

If you contact us by email, we process your email address, message, attachments and related communication metadata to handle your request and any follow-up questions. Support requests connected to your use of the App are processed under Article 6(1)(b) GDPR. General enquiries are processed under Article 6(1)(f) GDPR, based on our legitimate interest in responding to communications. Legal or compliance correspondence may also be processed under Article 6(1)(c) GDPR.

We use Google Workspace as our email provider. Google Cloud EMEA Limited and affiliated Google entities process email data on our behalf under Google’s applicable data processing terms. Emails are retained for as long as necessary to resolve the matter and afterwards only where required for documentation, legal claims or statutory retention obligations.

13. Recipients and international data transfers

Depending on the functions you use, personal data may be disclosed to:

• Google Cloud EMEA Limited, Google LLC and Google subprocessors for Firebase, Google Cloud, Google Workspace, Google Sign-In and AdMob;
• Mixpanel, Inc. for product analytics;
• RevenueCat, Inc. for subscription and entitlement management;
• Anthropic Ireland, Limited (Dublin, Ireland) as our processor for the daily fair-play check of unusual push-up sessions by an AI model (Section 17); it receives only the numeric summary described there, without your name, user ID or any other direct identifier, and processes it in the United States;
• Linear Orbit, Inc. for our internal task management, where we keep the daily report of that check; it contains totals and, for individual sessions, a random reference that only our own systems can link to the session, which check marked the session and the model’s assessment with its reasoning, never your name or user ID;
• Apple, Google and the relevant app-store or payment platform for distribution, purchases, reviews, platform services and attributing installations to Apple Ads advertisements;
• recipients or services you deliberately select through the operating-system share sheet; and
• professional advisers, authorities, courts or other parties where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.

Within Point Zero GmbH, access is limited to persons who need the data for the purposes described in this Privacy Policy.

Some providers process data outside the European Economic Area, particularly in the United States. This applies in particular to some of our custom Google Cloud Functions (see Section 8.2), RevenueCat, Anthropic and possible access by US-based provider entities or subprocessors. Where required, transfers are protected by an applicable adequacy decision, including the EU-US Data Privacy Framework for participating recipients, and/or the European Commission’s Standard Contractual Clauses together with supplementary safeguards. Data-processing agreements under Article 28 GDPR are in place where the provider acts as our processor.

The selection of an EU region for Firestore or Mixpanel reduces international storage transfers for those services but does not necessarily exclude all remote access, support processing or processing by subprocessors outside the EEA.

14. Retention and account deletion

We retain personal data only for as long as necessary for the stated purpose, unless legal obligations or legitimate legal interests require a longer period. The principal periods and criteria are:

Commercial and tax records may have to be retained for six, eight or ten years, depending on the document and the applicable statutory rule. Data required for legal claims may be retained until the relevant limitation period has expired.

You can delete your account in the App under Settings > Account settings > Delete Account. If you cannot access the App, you can use our account-deletion page or contact us.

The automated Firebase deletion process is configured to remove the authentication account, the main user record and its subcollections, training sessions covered by the recursive user-path deletion, the associated community profile, stored profile images, linked feedback records and a stored objection to usage analytics. Leaderboard evidence, check results, integrity notes and manual review assessments are then deleted by an automatic clean-up process; the periods and exceptions are listed in the table above. Deletion may take a reasonable period to propagate through live systems and provider backups.

Account deletion does not automatically remove the separate Mixpanel and RevenueCat records described above, app-store transaction records or moderation reports that must be retained. Contact us if you want your request to include data held through these providers. We will assess the request under Article 17 GDPR and coordinate deletion or restriction where legally and technically applicable.

Uninstalling the App does not by itself delete your server-side account or cancel a subscription.

15. Your data-protection rights

Subject to the statutory requirements, you have the right to:

• obtain access to your personal data under Article 15 GDPR;
• request correction of inaccurate data under Article 16 GDPR;
• request erasure under Article 17 GDPR;
• request restriction of processing under Article 18 GDPR;
• receive data you provided in a portable format under Article 20 GDPR; and
• lodge a complaint with a data-protection supervisory authority under Article 77 GDPR.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future under Article 7(3) GDPR. Withdrawal does not affect processing that took place lawfully before withdrawal.

Right to object under Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

To exercise your rights, contact info@pointzero.tech. We may need information reasonably necessary to verify your identity and locate your records, such as the email address connected to a registered account or your App UID.

You may complain to any competent supervisory authority. The authority responsible for Point Zero GmbH is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2–4
40213 Düsseldorf
Germany

Email: poststelle@ldi.nrw.de
Complaint information

16. Required and optional data

There is generally no statutory obligation to provide personal data to use the App. However, the anonymous UID and the training and technical data required for the requested functions are necessary to provide the App. If this processing is not possible, some or all core functions cannot be provided.

Registration, Google Sign-In, profile text, a profile image, push notifications, feedback, sharing and a paid subscription are optional. Choosing not to provide the relevant data means only that the corresponding optional function may not be available.

17. Automated decisions and personalisation

The App may use training progress, streak status, feature interactions and entitlement status to determine when to display contextual prompts, achievements or subscription offers. This does not produce legal effects or similarly significantly affect you. We do not carry out solely automated decision-making within the meaning of Article 22 GDPR.

To keep the leaderboard fair, the App and our servers automatically check whether a training session is plausible, for example by comparing its duration with its repetitions. A session that does not pass this check is not counted in your public leaderboard values; it stays in your history, statistics and streak.

We first trial new checks, for example based on the timing of individual push-up repetitions, without them affecting leaderboard values or your account; for this, we store their results on our servers. Authorised personnel may review individual training sessions and record their assessment in order to develop and validate these checks.

Fair-play check. Push-up sessions that our automated checks mark as unusual are also reviewed once a day by an AI model (Claude, from Anthropic). For this, we send the figures described below through Anthropic’s application programming interface (API), and Anthropic processes them as our processor. The model receives only a numeric summary: which check marked the session, how the time between your counted repetitions is distributed and how the session is structured, the number of repetitions and the session’s length, each only as a range, the training mode, whether a plan target was exceeded, and three coarse figures from your earlier sessions. It never receives your name, user ID, email address, photo, device, the date of the workout or anything you wrote. Each session is sent on its own and without any identifier. Only our own systems can link the answer back to your session. This limits what Anthropic can learn about you, but for us the information remains personal data: we store the result with the training session, and it is deleted with the session or with your account. Anthropic processes the figures in the United States, does not use them to train its models, and deletes them after 30 days at the latest, unless its automated safety systems flag a request (then up to two years) or the law requires longer retention. We keep the daily report of the check in Linear (see Section 13).

We are currently trialling the fair-play check: its results change nothing, including whether a session counts on the leaderboard. Only once we switch it on after the trial can it decide whether a session counts on the public leaderboard. The check never changes your training sessions, history, statistics or streak in the App. If you think a session was wrongly left off the leaderboard, write to support@pointzero.tech and a person will review the decision. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a fair leaderboard. We will never judge how fit you are. We are just making sure everything is fair.

The automated checks used for leaderboard scoring, including the fair-play check once it is switched on, only affect whether a training session is counted on the public leaderboard. This does not produce legal effects concerning you or similarly significantly affect you. Decisions to restrict your account under Section 11 of the Terms of Service are taken by authorised personnel, not by an automated process.

Mixpanel product analytics and RevenueCat entitlement information are not used by us to determine creditworthiness, insurance eligibility, employment eligibility or comparable matters.

18. Children

Streakletics is a general fitness and habit-building App and is not specifically directed at children under 13. We do not ask for a date of birth and do not operate age verification, so we may not know a user’s age. Advertising requests are currently subject to the restrictive configuration described in Section 10.

If you are a parent or guardian and believe that a minor has provided personal data unlawfully or that data should be deleted, please contact us using the details in Section 1.

19. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental loss, unlawful use and unauthorised access. These include access controls, encrypted transmission, authenticated database access, App Check, data minimisation and restricted internal access. No method of electronic transmission or storage can guarantee absolute security.

20. Changes to this Privacy Policy

We may update this Privacy Policy when the App, service providers, legal requirements or processing activities change. The current version will be made available in the App or on the Streakletics website. If a change requires your consent, we will request it separately rather than treating continued use of the App as consent.

Please also review our Terms of Service.