Privacy Policy

Last updated: 9 October 2026

This policy explains what personal data the StrikeLab iPhone app ("StrikeLab", "the app") and the website strikelab-app.com collect, why, who processes it, and what control you have over it.

"We", "us" and "our" mean the developer of StrikeLab, who is the data controller for the data described here. You can reach us at unfold.apps@gmail.com.

By using StrikeLab you agree to the practices described in this policy. If you do not agree, please do not use the app.

1. The short version

• Your camera feed never leaves your iPhone. Movement detection runs on the device. StrikeLab does not record, save or upload video or images from the camera.
• We do not track you across other companies' apps or websites. StrikeLab does not use the advertising identifier (IDFA), shows no third party ads and contains no advertising SDK.
• We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
• An account is required. You sign in with Apple or Google so your progress is saved to your account.
• You can delete your account and its data inside the app at any time (Profile → Settings → Delete Account).

2. Camera, microphone and photos

Camera

StrikeLab needs the front camera to work. While a session is running, camera frames are analysed on your iPhone with Apple's on-device Vision framework to estimate your body pose (the position of joints such as shoulders, elbows and wrists) and the position of your head in the frame, so the app can check your distance and judge punches, slips and rolls.

• Frames are processed in memory and discarded immediately.
• No video or still image from the camera is recorded, written to your photo library, or sent to us or to anyone else.
• Body pose and head position data are used only in the moment to run the session. They are not stored and not uploaded.
• StrikeLab does not perform facial recognition, does not create a face template or any other biometric identifier, and does not use the camera to identify you.

What leaves your device is only the result of a session, for example score, number of punches, duration and, in shadowboxing, summary scores such as speed, technique, guard, footwork and work rate.

You can withdraw camera access at any time in iOS Settings → Privacy & Security → Camera. Camera sessions cannot run without it.

Microphone

The microphone is used only when you choose to record your own pad hit sound in the Locker Room. The recording is a very short clip (under one second after processing). It is saved on your device and uploaded to your private storage folder so it is available on your other devices. The microphone is never active during training sessions or at any other time. You can delete a recording in the app, and you can withdraw microphone access in iOS Settings.

Photos

StrikeLab does not request access to your photo library. When you pick a profile photo or a photo for a custom face sticker, you use Apple's system photo picker, which gives the app only the image you select.

• Custom face stickers: the photo you pick is processed on your device (the subject is detected and cut out from its background). Only the resulting sticker image is uploaded, to your private storage folder. It is not visible to other players.
• Profile photo: the photo you pick is resized and uploaded. Your profile photo is visible to other players on leaderboards (see section 5).

Please only upload photos of yourself or of people who have agreed to it.

3. Data we collect

3.1 Account data

When you sign in with Apple or Google we receive, through Firebase Authentication:

• a unique user ID generated for your account,
• your name, if the provider shares it,
• your email address (with Sign in with Apple this may be Apple's private relay address if you choose "Hide My Email"),
• your Google profile picture address, if you sign in with Google,
• which provider you used.

We never receive your Apple ID or Google password.

3.2 Profile and fitness information you give us

During onboarding and in settings you provide:

• sex, age, height and weight (used to show your weight class and tailor the experience),
• boxing stance and dominant hand,
• experience level, training goals and how many days a week you plan to train,
• how you heard about StrikeLab,
• a display name and, optionally, a profile photo.

We treat sex, age, height and weight as sensitive fitness information. It is used only to personalise the app. It is not used for advertising or marketing, is not sold, and is not sent to our analytics providers.

StrikeLab does not read from or write to Apple Health.

3.3 Training and progress data

• session history: date, combination or mode, duration, score and punch count,
• shadowboxing results: duration and summary scores,
• progress per drill and combination, best scores and times,
• achievements, streaks and your one on one fight record (wins, losses, draws),
• combinations you build in Combo Lab, including the names you give them,
• your app settings (for example difficulty, round length, selected pad, sound and language),
• whether you have started or completed the introductory tryout.

3.4 Content you upload

• your profile photo,
• custom face sticker images,
• custom hit sound recordings.

3.5 Purchase data

StrikeLab Pro subscriptions are sold and billed by Apple. We never see or store your card number, billing address or Apple ID password. Through Apple and our subscription provider RevenueCat we receive:

• which product you bought, purchase and renewal dates, expiry, trial or cancellation status,
• transaction identifiers, the App Store storefront country and the price and currency,
• your StrikeLab user ID, so the subscription can be attached to your account.

3.6 Usage and analytics data

We record how the app is used so we can fix problems and improve it. This includes:

• events such as onboarding pages viewed, sign in attempts and results, sessions started, completed or abandoned, tabs opened, paywall views, plan selection, purchase and restore outcomes (including error codes), achievements unlocked and account deletion,
• a small set of profile properties attached to those events: whether you are a subscriber, stance, experience level, weekly commitment, how you heard about us, and sign in provider,
• technical information collected automatically by the analytics tools: device model, iOS version, app version and build, language, screen size, an app instance identifier and the identifier for vendor (IDFV), session start and duration, first open and app update events, and an approximate location (country, region or city) derived from your IP address.

Analytics events are linked to your StrikeLab user ID. Events that happen before you sign in (the onboarding questions) are recorded under an anonymous identifier and are joined to your account when you sign in. Your name, email address, photos, recordings, age, height, weight and sex are not sent to our analytics tools.

We do not collect precise location, contacts, calendar, health records, browsing history or the advertising identifier.

3.7 Apple Ads attribution

If you installed StrikeLab after tapping an Apple Ads advertisement on the App Store, Apple's AdServices framework provides an attribution token that RevenueCat exchanges with Apple for the campaign, ad group and keyword that led to the install. We use this to measure whether our own App Store advertising works. This does not use the advertising identifier, does not require the App Tracking Transparency prompt, and is not combined with data from other companies' apps or websites.

3.8 Security and diagnostics data

• App integrity:Firebase App Check with Apple's App Attest confirms that requests to our backend come from a genuine copy of the app on a genuine device. This involves a device attestation processed by Apple and Google. It does not identify you personally.
• Purchase diagnostics: the app keeps a short technical log of purchase attempts on your device. It stays on your device and is only sent to us if you choose to share it with support.

3.9 Data stored on your device

The app stores settings, cached copies of your stickers, sounds and profile photo, your in-progress onboarding answers and pending purchase recovery state on your device. This is removed when you delete the app.

3.10 Support messages

If you email us we receive your email address and whatever you include in the message.

3.11 The website

strikelab-app.com is a static marketing site. It sets no advertising or tracking cookies and asks for no personal information. Its host, Vercel, keeps standard server logs (IP address, user agent, requested page) for security and operations.

4. Why we use your data and our legal bases

We do not make decisions about you that produce legal or similarly significant effects by automated means, and we do not use your data to train third party AI models.

5. What other players can see

StrikeLab has leaderboards. If you post a score, other signed in players can see your display name, profile photo and score. Your display name defaults to the name from your Apple or Google account; you can change it, and your profile photo, at any time in your profile. If you prefer not to appear under your real name, choose a different display name.

Nothing else is visible to other players. Your email address, fitness information, session history, custom stickers and recordings are private to your account.

6. Who processes your data

We share personal data only with the service providers that run the app on our behalf, and only as far as each one needs:

Each provider's own privacy policy describes how it handles data: Google · Firebase · Mixpanel · RevenueCat · Apple · Vercel

We may also disclose data where the law requires it, to protect our rights or the safety of users, or to a successor if the app is transferred to another owner, in which case this policy continues to apply to your data until you are told otherwise.

We do not sell personal data, we do not share it with data brokers, and we do not share it with third parties for their own marketing.

7. International transfers

Our providers operate servers in several countries, including the United States and the European Union. Your data may therefore be processed outside your country of residence. Where data is transferred out of the EEA, the UK or Switzerland, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses.

8. How long we keep data

• Account, profile, training data and uploaded content: for as long as your account exists. Deleted when you delete your account.
• Analytics data:kept in a form linked to a random user ID, not your name or email, for as long as needed for the purposes above and in line with each provider's retention settings, and deleted on request.
• Purchase records: kept for as long as needed to provide the subscription and to meet tax, accounting and legal obligations.
• Support emails: up to two years after the conversation ends.
• Server logs and backups held by our providers: removed on their normal schedules, which can take up to 180 days after deletion.

9. Deleting your account and data

You can delete your account inside the app: Profile → Settings → Delete Account. You will be asked to confirm and to sign in again with Apple or Google.

Deletion permanently removes:

• your sign in account (with Sign in with Apple, we also revoke the app's authorisation with Apple),
• your profile, onboarding answers, settings, progress, achievements, fight record and custom combinations,
• your session and shadowboxing history,
• your leaderboard entries,
• your profile photo, custom face stickers and custom hit sound recordings.

Deletion cannot be undone.

Deleting your account does not cancel a StrikeLab Pro subscription. Subscriptions are managed by Apple: cancel in iOS Settings → your name → Subscriptions.

Analytics events and purchase records held by our providers are linked only to a random user ID that no longer corresponds to an account after deletion. If you want those erased as well, or if you cannot access the app, email unfold.apps@gmail.com and we will delete them, except for records we are legally required to keep.

10. Your rights and choices

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy in a portable format,
• correct inaccurate data (most of it can be changed directly in your profile),
• delete your data (see section 9),
• restrict or object to processing, including processing based on legitimate interests such as analytics,
• withdraw consent at any time, without affecting earlier processing,
• complain to your local data protection authority.

To use any of these rights, email unfold.apps@gmail.com from the address linked to your account, or include your in-app display name so we can find the right record. We respond within 30 days and never charge for or penalise a request.

Device permissions: you can turn camera and microphone access on or off at any time in iOS Settings.

California and other US states

In the last 12 months we have collected the categories of personal information described in section 3: identifiers, account information, characteristics you provide (age and sex), commercial information (subscriptions), internet and app activity, approximate location derived from IP address, audio and visual content you upload, and fitness information you provide. We collect them from you and your device for the purposes in section 4 and disclose them to the service providers in section 6. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We use sensitive information only to provide the app. You have the right to know, correct and delete your information and not to be discriminated against for using these rights.

11. Children

StrikeLab is not directed at children under 13, or under the minimum age for consent to data processing in your country where that age is higher (up to 16 in parts of the EEA). We do not knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we will delete it.

12. Security

Data is encrypted in transit with TLS and encrypted at rest by our storage providers. Access rules restrict each account to its own records and files, and App Check blocks requests that do not come from a genuine copy of the app. No system is perfectly secure, so we keep as little personal data as we can, which is one reason the camera feed never leaves your phone.

13. Changes to this policy

If we change how we handle your data we will update this page and the date at the top. If a change is significant we will also tell you in the app before it takes effect.

14. Contact

Questions about this policy or your data: unfold.apps@gmail.com