Your movement.Not your footage.

PumpDuel uses your account, derived workout results, and the choices you make to run fitness challenges, private workouts, groups, rankings, and memberships. Camera frames, audio, and raw pose landmarks are not sent to PumpDuel during normal counting. Approximate location is optional. We do not sell personal information or use third-party advertising trackers.

Account and profile

A PumpDuel account identifier, the Firebase authentication subject linked to it, account dates, an optional handle, and profile settings. PumpDuel supports signing in with Apple or Google through Firebase Authentication. Apple may provide a relay email depending on your Apple settings.

Workouts and competition

Exercises, challenge and group participation, counted reps, scores, results, ratings, ranks, streaks, and the records needed to prevent duplicates and keep competitions fair.

Profile pictures

A photo you choose, the details needed to store and display it, your consent, and whether it can appear publicly. We send the selected photo to OpenAI to check for sexual content before publication. A published picture can appear anywhere your public profile or competition entry appears.

Approximate Arena

If you grant location permission, the app requests a low-accuracy location fix and resolves it on the iPhone to a supported regional Arena. PumpDuel stores the Arena name or identifier, not the location fix used to select it.

Device permissions and preferences

Camera, location, photo-library, and notification permission state; selected disciplines; map visibility; sharing and reminder choices; and app state needed to resume onboarding or a pending membership activation.

Website and support

Limited records of challenge-page visits, security records, and the contents and addressing information of messages you choose to send us.

Trial requests

If you request the trial offer by email, we store the address, when it was submitted, where the request came from, and the delivery receipt. We use this request to send the offer, not ongoing product marketing. Entering an email does not start a trial or subscription.

Membership

The details needed to manage your membership, including the product, store, access status, purchase and expiry times, renewals, cancellations, billing issues, refunds, and transfers. These records are associated with your PumpDuel account after sign-in.

PumpDuel uses Apple's camera and on-device pose processing to decide whether movement meets the rules and to count reps. During normal play, frames are processed in volatile device memory. We do not record or upload camera video, audio, or raw pose landmarks, and rivals do not receive a video feed.

When you take a competitive attempt, the app can send derived data such as counted-rep events and the final score.

Depending on where you live, data-protection law may require a legal basis. We use information to:

Provide the service

Create and secure accounts, count results, operate challenges and groups, show stats, restore progress, provide memberships, and respond to support requests. This is generally necessary to perform our contract with you.

Protect players and PumpDuel

Prevent abuse, enforce limits, investigate failures, remove reported public pictures when needed, and secure the service. We generally rely on legitimate interests and legal obligations.

Improve the product

Understand privacy-limited challenge visits and aggregated product performance, diagnose faults, and plan improvements. We rely on legitimate interests where permitted and respect the objection control below.

Respect your choices

Use location, notifications, Photos, and public-profile features only after your relevant choice or device permission. You can change these choices in the app or iOS Settings.

Continue a requested trial

Send the membership checkout link you deliberately request. We do not use this request to enrol you in ongoing product marketing.

Meet legal duties

Keep records needed for accounting, tax, disputes, law-enforcement requests, and the establishment or defence of legal claims.

We do not use camera footage, health data, or other information for targeted advertising, and we do not make decisions with legal or similarly significant effects using automated profiling.

PumpDuel is competitive, so some information becomes visible when you choose public or link-shared features. This may include your handle or display name, visible profile picture, score, rank, challenge, group role, and approximate area. A handle is not required for private workouts or private stats, but it can be required before publishing or joining a public competition.

A link-only challenge page can be opened by anyone who receives its hard-to-guess link. We ask search engines not to index those pages, but that does not make a forwarded link private. We never display your precise or current location to other players.

We share only what is needed with providers operating on our behalf or as independent payment or platform providers:

Apple

For Sign in with Apple, App Store purchases, device permissions, Photos, notifications, and other iOS services.

Google Firebase

For Google sign-in, authentication, and App Check. Firebase Authentication may process authentication data in the United States.

RevenueCat

For in-app membership status, purchase restoration, entitlement reconciliation, and billing events.

Resend

For delivering the trial-offer email you request.

Hosting and storage providers

For the website, application API, PostgreSQL database, logs, and profile-picture object storage.

If web membership purchasing is offered and you use it, RevenueCat's hosted flow and its connected payment provider collect your billing email and payment details. Before that flow opens, Firebase authenticates your chosen sign-in and PumpDuel checks the resulting account for existing access. RevenueCat connects your web purchase to your PumpDuel account immediately. PumpDuel does not receive your full card number.

Read the providers' own notices: Apple, Firebase, RevenueCat, OpenAI, and Resend.

We may also disclose information when reasonably necessary to comply with law, protect people or the service, investigate fraud or abuse, or complete a merger, financing, reorganisation, or sale subject to appropriate protections.

The public website currently uses limited first-party analytics on shared challenge and creator-invite pages. For challenge landings, the browser creates a random identifier for that challenge and UTC day. An older dated identifier is removed the next time a challenge page opens. The backend stores the identifier, challenge, observed date, first and last observation, and a likely-bot flag.

These pages also record limited interactions such as opening the app or App Store, copying a code, and selecting a leaderboard or invite action. The browser creates a random identifier for the current tab session. Each event contains that identifier, a random event identifier, the interaction name and time, and the relevant challenge code or internal creator-invite identifier. An incoming network address may be transformed into a keyed hash for rate limiting before either analytics request is forwarded; PumpDuel does not persist the raw address or full user-agent in the analytics tables.

We do not use advertising pixels, cross-site trackers, session replay, camera data, precise location, billing details, sign-in details or Firebase identifiers for this website analytics. The analytics-objection cookie below is a necessary preference cookie and lasts for one year.

Your right to object: you can turn this limited analytics processing off above or email [email protected]. We also honour Global Privacy Control and the browser Do Not Track signal for both analytics endpoints. Turning analytics off removes PumpDuel challenge-landing and interaction-session identifiers already held in this browser and stops future optional analytics requests from it; it does not delete aggregated or previously collected server records.

A future RevenueCat web checkout may use storage that is necessary to display plans, complete a purchase, prevent duplicate transactions, and recover the immediate checkout state. We will update this section before that checkout launches if its tested behaviour adds any non-essential technology.

We keep personal information only while it serves the purposes above, then delete or de-identify it unless law, safety, accounting, fraud prevention, a dispute, or a legal claim requires longer retention.

Account and gameplay

Generally for the life of the account and a limited deletion or dispute period. Some competition records may be de-identified rather than removed where needed to preserve other players’ results.

Challenge analytics

Raw share and challenge-landing records are scheduled for no more than 13 months. Aggregates may remain when they can no longer identify a person.

Membership records

For the membership lifecycle and longer where required for tax, accounting, refunds, chargebacks, fraud prevention, or legal claims.

Trial requests

Until you ask us to delete the request or the address and delivery receipt are no longer needed for the trial funnel. Marketing consent remains separate, and a minimal suppression record may be retained when necessary to honour an unsubscribe request.

Profile pictures

While selected and for short periods needed to publish, replace, remove, recover, or investigate a picture. Removing a picture takes it out of public view; backup and cache copies may expire later.

Browser preference

The analytics-objection cookie lasts one year unless you remove it sooner. Dated challenge identifiers are cleared on a later challenge visit. Interaction identifiers last for the current tab session. Both are removed when you object or clear site data.

Support and security

For as long as needed to answer the request, protect the service, document action taken, and meet legal requirements.

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal information; object to certain processing; withdraw consent; and complain to your local data-protection authority. These rights can have legal exceptions.

You can change camera, location, Photos, and notification access in iOS Settings; choose private visibility in PumpDuel; remove a profile picture in the app; clear this site's browser data; unsubscribe from any product email; or use the analytics objection above. To make a data request or object for your account, email [email protected]. We may ask for enough information to verify the account and protect it from unauthorised requests.

We use safeguards designed to protect information, including encrypted transport, authenticated API access, provider credential separation, access controls, bounded public data projections, and measures against duplicate or forged purchase and competition events. No internet service can guarantee absolute security.

PumpDuel and its providers may process information outside your country. In particular, Firebase Authentication and RevenueCat process information in the United States. Where required, we rely on provider agreements and lawful transfer safeguards.

PumpDuel does not currently ask for a date of birth and does not knowingly collect personal information from children who are not legally able to use the service. Unknown-age accounts use conservative defaults, but those defaults are not an age verification system. If you believe a child has provided information improperly, contact us so we can investigate and take appropriate action.

The controller is 10Q Solutions Ltd (company number 15681198), Suite A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. Questions, objections, complaints, or requests can be sent to [email protected].

10Q Solutions Ltd has not appointed a representative in the European Union under Article 27 of the GDPR. People in the European Economic Area may contact the controller directly using the details above.

We may update this policy as PumpDuel changes. We will post the new version here, change the effective date, and provide additional notice when required by law.