Privacy Policy

This section is a quick overview. It does not replace the full policy below, but it tells you the essentials at a glance.

We built Workout Samurai to be honest by design. Your camera stays private, your progress is tied to an account you control, and you can delete your data whenever you want.

• The camera is used only for on-device push-up counting. Frames and video never leave your phone and are never stored by us.
• You can start playing anonymously. Linking an Apple, Google, or email account is optional and just lets your progress survive reinstalls.
• We store gameplay data (display name, cosmetics, coins/gems, level/XP, season reps, clan membership, training-program state, push-up records) so the game and coaching work.
• Optional self-entered age, sex, and bodyweight (bodyweight is optional) are used only to pace your training program.
• The app is free to play and shows ads. Our advertising partners may collect device and usage identifiers to serve and measure ads, and can show personalized (interest-based) or non-personalized ads.
• We use a set of trusted processors and partners: Firebase/Google (auth, database, backend, abuse protection), PostHog (product analytics), RevenueCat with Apple/Google billing (subscriptions), and third-party advertising partners (ads).
• We do not sell your personal data for money, but we may 'share' limited ad identifiers with advertising partners for interest-based advertising as defined by law. You can opt out and limit personalized ads, and money can never buy rank.
• You can access, correct, export, or delete your data, either in the app or by emailing support@workoutsamurai.com.

The service is operated by Workout Samurai (the "Operator"), the provider of the Workout Samurai mobile app (bundle identifier com.workoutsamurai) for iOS and Android. Our contact address for all privacy matters is support@workoutsamurai.com.

This policy covers personal data we process through the app and its supporting backend services. It does not cover the independent practices of Apple, Google, or other platforms whose own privacy policies govern how they handle your information (for example, when you manage a subscription through your App Store or Google Play account).

For users in the European Economic Area (EEA) and the United Kingdom, Workout Samurai acts as the data controller for the personal data described here. Where required, you may contact us using the details in the Contact section, and we will handle your request under the applicable data-protection laws (including GDPR and UK GDPR). California residents have specific rights described in the CCPA/CPRA section.

We collect only what the game and coaching genuinely need to function, plus limited analytics to improve the product and the data used to show and measure ads. We do not collect raw biometric or health records beyond your push-up counts and any optional self-entered pacing details. The categories below describe what we collect and the reason for each.

• Account and authentication data: When you first open the app, you receive an anonymous, device-scoped account through Firebase Authentication. If you choose to link an Apple, Google, or email sign-in, we receive an authentication identifier (and, for email/Apple/Google linking, associated identifiers such as an email address or a provider user ID). Purpose: to create and secure your account and let your progress survive reinstalls and device changes.
• Profile data: Your chosen display name (moderated and profanity-filtered) and your selected avatar and cosmetic items. Purpose: to represent you in the Dojo, on leaderboards, and within your clan.
• Gameplay and progression data: Coins and gems balances, level and XP, current stage, season reps (verified push-ups), belt rank, push-up personal records, clan membership, and your day-of-training schedule. Purpose: to run the game, track progress, and rank leaderboards fairly.
• Optional pacing data: Self-entered age, sex, and bodyweight (bodyweight is optional). Purpose: to personalize and pace 'The Way' training program. You are not required to provide these to play the free game.
• Push-up counts: The numeric results of your training and ranked sessions. Purpose: to advance progression, validate sessions server-side, and rank seasons. Note: only counts are submitted, never camera imagery.
• Purchase and subscription data: Records of subscription status, entitlements, and transactions for 'The Way,' handled through RevenueCat and Apple/Google billing. Purpose: to unlock coaching features and manage renewals. We never see or store your full payment card details.
• Analytics, device, and usage data: Product-analytics events (such as onboarding-funnel steps and feature usage), along with basic technical information (app version, device/OS type, coarse diagnostic and event data, and a pseudonymous analytics identifier). Purpose: to understand how the app is used and improve it.
• Advertising data: Because the app is ad-supported, our advertising partners and their mobile ad SDKs may collect and process device and usage identifiers, such as a mobile advertising ID, IP address, and coarse device and usage signals. Purpose: to serve ads, cap how often you see the same ad, measure ad performance, and, where permitted, show personalized (interest-based) ads. You can limit personalized ads through your device settings and any in-app controls we provide.
• Notification data: If you opt in, a push token and your preferences for training-day reminders and trial-end reminders. Purpose: to deliver optional local and push notifications you have enabled.

The camera drives the rep counter, and it is where we hold the strictest privacy standard. When you use the rep counter, the app requests camera permission and uses on-device computer-vision pose detection to count your push-ups, provide haptic feedback, and drive sensei coaching cues.

All of this processing happens locally on your phone. The camera feed is analyzed in real time on the device and then discarded. No video, still image, or individual camera frame is ever transmitted off your device, uploaded to our servers or any third party, or stored by us. The only thing that leaves the device from a session is the resulting rep count (plus related gameplay metadata such as session validity), which is submitted so your progress and ranking can be recorded and validated.

Camera access is optional. If you deny or revoke the camera permission, the app still works: you can continue by manually claiming reps. You can change the camera permission at any time in your device settings.

We use the information described above for the following purposes, and no more:

• To provide the core service: run the Dojo, count and record reps, advance belts and stages, and manage coins, gems, cosmetics, and clans.
• To operate 'The Way' coaching: build and adapt your personalized program (First Form, Second Form, Master's Path), apply the ACSM '2-for-2' progression rule, schedule recovery and re-tests, and deliver form, tempo, and depth coaching.
• To keep ranking honest: validate every ranked session on the server, reject physically impossible input, and flag suspicious sessions for human review so rank stays earned.
• To manage subscriptions: unlock 'The Way,' recognize your entitlements across devices, and handle renewals, trials, and cancellations through the app stores.
• To improve the product: analyze aggregated and pseudonymous usage patterns (for example, onboarding funnels and feature adoption) to make the app better.
• To show and measure advertising: display ads in the app, including through third-party advertising partners, limit how often the same ad appears, and measure ad performance, using ad identifiers as described in this policy.
• To communicate with you: send the optional notifications you have enabled and respond to your support and privacy requests.
• To keep the service safe and lawful: protect against abuse, fraud, and cheating, secure the API, and comply with legal obligations.

If you are in the EEA or the UK, we process your personal data on the following legal bases, depending on the context:

• Performance of a contract (Art. 6(1)(b)): to create and maintain your account, run the game and progression, deliver 'The Way' if you subscribe, and process purchases. In short, to provide the service you have asked for.
• Legitimate interests (Art. 6(1)(f)): to secure the service, prevent cheating, fraud, and abuse (including server-side validation and Firebase App Check), maintain rank integrity, understand product usage through pseudonymous analytics, and support the free app through advertising, including non-personalized ads and frequency capping. We balance these interests against your rights and offer opt-outs where appropriate.
• Consent (Art. 6(1)(a)): for camera access (granted through your device permission), for push notifications, for personalized (interest-based) advertising where required by law, and, where required by law, for non-essential analytics. You may withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws, respond to lawful requests, and keep records we are required to keep.
• We do not use your data for automated decision-making that produces legal or similarly significant effects. Where our advertising partners use identifiers to deliver personalized (interest-based) ads, we rely on your consent where the law requires it, and you can opt out or limit personalized advertising as described in this policy.

We rely on a set of carefully chosen service providers and partners that process data on our behalf or in connection with the app, each under its own security and privacy commitments. The core service providers listed below process data only to perform services for us and are not permitted to use it for their own advertising. Our advertising partners are listed separately, because they may use the ad identifiers they collect under their own privacy policies. Each provider and its purpose is listed below.

• Firebase / Google (Authentication, Cloud Firestore, Cloud Functions, App Check): identity and anonymous/linked accounts, the database that stores your gameplay and profile data, the backend logic that validates sessions and enforces server authority, and abuse protection for our API.
• PostHog (product analytics): event-based analytics such as onboarding funnels and feature usage, used to improve the app. Analytics are hosted in a US cloud region by default and can be limited or opted out where required by law.
• RevenueCat (subscription management): manages your subscription state and entitlements for 'The Way' on top of the app stores' billing systems.
• Apple App Store and Google Play (billing): process your payments and manage subscription lifecycle (renewals, trials, cancellations). Payment is handled entirely by the platform; the app never receives your full card details.
• Advertising partners and ad networks (including the mobile ad SDKs integrated into the app): serve, cap, and measure the ads shown in the app and, where permitted, deliver personalized (interest-based) ads. These partners may collect and process device and usage identifiers, such as a mobile advertising ID, IP address, and coarse device and usage signals. They may act as independent controllers or as separate third parties rather than as our processors, and their handling of that data is governed by their own privacy policies.
• We may add or change processors and partners as the product evolves; when we do, we will hold them to comparable protections and update this policy as needed.

We do not sell your personal data for money. The app does show ads, and when we or our advertising partners use ad identifiers to deliver personalized (interest-based) ads, that activity may be treated as a 'sale' or a 'share' for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA) as amended by the CPRA, and under similar laws. To the extent it is, you have the right to opt out, as explained in this section.

Apart from advertising, we disclose personal data only to the service providers listed above, strictly so they can perform services for us (such as hosting, authentication, analytics, and payment processing) under contractual restrictions. Those service-provider disclosures are not sales or shares. The limited identifiers made available to our advertising partners for interest-based advertising are the disclosures that may qualify as a 'sale' or 'share.'

California residents have the right to know the categories and specific pieces of personal information we collect, to request deletion or correction, to opt out of the sale or sharing of personal information, and to not be discriminated against for exercising these rights. To opt out of interest-based advertising, you can use your device settings (on iOS, App Tracking Transparency or 'Limit Ad Tracking'; on Android, the ads settings or 'Reset advertising ID'), any in-app advertising controls we provide, and the opt-out tools offered by our advertising partners. Where required by law, we honor recognized opt-out preference signals, such as the Global Privacy Control, as requests to opt out of sale and sharing. To exercise any right, contact us at support@workoutsamurai.com.

We keep personal data only for as long as it is needed for the purposes described in this policy, and then delete or anonymize it.

In practice, this means we retain your account, profile, and gameplay/progression data for as long as your account exists, so your progress persists. When you delete your account, we delete or anonymize the associated personal data from our systems, subject to the exceptions below.

Analytics events are retained on a rolling basis in pseudonymous form to help us understand product trends over time. Purchase and subscription records may be retained by the app stores and by RevenueCat under their own policies and for as long as required for tax, accounting, and dispute-resolution purposes. Advertising partners retain the ad identifiers and related data they collect under their own retention policies. Sessions flagged for anti-cheat review may be retained for the time needed to complete that review and protect rank integrity. Because camera frames are never stored, there is nothing camera-related to retain or delete.

We take reasonable and appropriate technical and organizational measures to protect your data. Our backend follows a server-authority model: the client submits intent, and Firebase Cloud Functions validate it on the server. Ranked sessions require an online, server-issued session, so there is no offline ranked play, and physically impossible input is rejected.

Firebase App Check helps protect our API from abuse by attesting that requests come from genuine, untampered instances of the app. Access to backend data is governed by security rules, and communications with our services use encryption in transit.

No system can be guaranteed to be perfectly secure, but we design the app to minimize what we collect, keep camera processing on your device, and limit access to your data. If we ever become aware of a breach that affects your personal data, we will notify you and the relevant authorities as required by law.

We operate globally, and our service providers may process data in countries other than the one where you live, including the United States. For example, product analytics are hosted in a US cloud region by default.

When we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or transfers to providers covered by an adequacy mechanism. Where we rely on your consent for a specific transfer, we will make that clear at the point of collection.

By using the app, you understand that your information may be processed in these locations. If you would like more detail about the safeguards we use, contact us at support@workoutsamurai.com.

Depending on where you live, you have rights over your personal data. We honor these rights for all users where we reasonably can, regardless of region.

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate or incomplete data (you can also update much of your profile and pacing data directly in the app).
• Deletion: request that we delete your account and associated personal data.
• Portability: request a copy of certain data in a structured, commonly used, machine-readable format.
• Opt-out: opt out of non-essential analytics where the law provides this right, and opt out of the sale or sharing of your personal data for interest-based advertising, including through your device settings and any in-app controls we provide.
• Restriction and objection: where applicable under GDPR/UK GDPR, ask us to restrict or object to certain processing based on our legitimate interests.
• Withdraw consent: turn off camera access or notifications at any time in your device settings, limit personalized advertising through your device and in-app settings, and withdraw any other consent you have given.
• To exercise any of these rights, email support@workoutsamurai.com. We may need to verify your identity before acting, and we will respond within the timeframes required by applicable law. You will not be discriminated against for exercising your rights. You also have the right to lodge a complaint with your local data-protection authority.

You can delete your account and personal data at any time. Deletion is available in-app and on request by emailing support@workoutsamurai.com from, or referencing, the account you want removed.

When you delete your account, we remove or anonymize your profile, gameplay, progression, and pacing data from our active systems. Some records may persist for a limited time as described in the Data Retention section, for example purchase records held by the app stores and RevenueCat, and any sessions under anti-cheat review. Because the app never stores camera frames, there is no camera imagery to delete.

If your account is anonymous and you uninstall the app without linking it to Apple, Google, or email, you may permanently lose access to that progress, because it is device-scoped. To preserve progress, link your account before reinstalling.

Workout Samurai is intended for a general audience of teens and adults who train. It is not directed to children under 13 (in line with the US Children's Online Privacy Protection Act), or under 16 in regions where that is the applicable minimum age. Because the app displays advertising, we do not knowingly allow personalized (interest-based) advertising to be served to users we know to be below the applicable age.

We do not knowingly collect personal data from children below the applicable age. If you are a parent or guardian and believe a child has provided us with personal data, contact us at support@workoutsamurai.com and we will take steps to delete it. If we learn that we have collected such data without appropriate consent, we will delete it promptly.

Workout Samurai provides fitness training content built on established strength methodology, including the 'hundred push-ups' style progression and the ACSM '2-for-2' progression rule, with deliberate recovery and periodic re-tests. This content is for general fitness and informational purposes and is not medical advice.

We make no medical claims and do not guarantee specific results. Exercise carries inherent risks. Consult a physician or qualified healthcare professional before beginning any new exercise program, especially if you have a medical condition, are pregnant, or have any concern about your ability to train safely. Stop and seek medical attention if you experience pain, dizziness, or other warning signs. You train at your own discretion and responsibility.

We may update this Privacy Policy as the product evolves or as the law requires. When we make material changes, we will update the 'last updated' date above and, where appropriate, provide additional notice in the app. Your continued use of Workout Samurai after an update means you accept the revised policy.

If you have any question, request, or concern about this policy or your personal data, including exercising your rights or deleting your account, contact us at support@workoutsamurai.com. As a pre-launch product, we welcome your questions early. Hold us to the standards written here.