Privacy Policy
Last updated: November 6, 2026 · Türkçe (the Turkish version prevails in case of conflict)
Data controller: [Name / Company], [address] · Contact: support@bodyxp.app
1. Data we process and why
| Data | Source | Purpose |
|---|---|---|
| Workouts (type, duration, distance, steps), water and calorie entries | Apple Health, Health Connect, Strava (only with your permission); sessions you start in the app | Calculating XP, levels, quests, boss damage and reminders |
| Name, height, weight, birth year/month, sex; body measurements | You | Daily calorie and water targets; progress charts. Never shared. |
| Character, quests, chests, items | In-game | Running the game |
| Email; Google / Apple / Facebook account identifier | If you sign in | Account and cloud backup |
| Nickname, level, XP, sport scores, character look, (optional) profile photo | Player card | Leaderboards, leagues, bosses; visible to other players. You can hide yourself. |
| Country, city and neighborhood names | GPS (with permission) or manual choice | Placing you on the right board and boss. GPS coordinates are never stored or sent. |
| Friends, feed posts, kudos, duels, guild membership, shared programs | Social features | Interacting with friends. Weight, height and age are never shared. |
| Reports and blocks | Users | Preventing abuse |
| Subscription status | App Store / Google Play via RevenueCat | Unlocking Premium. We never see payment details. |
| Crash reports: error text, app version, OS | On crashes | Fixing bugs. No health data. |
Health and fitness data is special-category personal data processed on the basis of your explicit consent. It is stored only on your device by default and is uploaded only if you sign in and turn on backup. You can withdraw consent at any time.
2. What we never do
- Use health data for advertising, marketing or profiling.
- Sell your data.
- Show ads or use ad trackers.
- Use Apple HealthKit or Google Health Connect data for anything other than the app's features.
3. Service providers
Supabase (accounts, backup, leaderboards, social), RevenueCat (subscriptions, no health data), Apple and Google (distribution, payments, sign-in), Strava (if you connect it), Cloudflare (Strava token server, website). Servers may be located abroad; transfers rely on your consent and the providers' standard contractual commitments.
4. Retention and deletion
Device data stays until you uninstall or reset. Cloud data stays while your account exists. Settings → Delete my account permanently deletes your account and all server data, including your photo. See account deletion. Crash reports are kept for at most 90 days.
5. Your rights
Under KVKK and GDPR you may request access, correction, deletion, a copy of your data, or object to processing, and lodge a complaint with a supervisory authority. Email support@bodyxp.app; we reply within 30 days.
6. Children
BodyXP is not intended for children under 13.
7. Changes
If we update this policy, the date above changes and important changes are announced in the app.