Zywo is a fitness role-playing game: your real physical activity is what levels up your in-game creature. That means the app necessarily handles health and fitness data, which we treat as sensitive. This policy explains exactly what we collect, why, who it goes to, and how you get it deleted.
The short version. We read your step and workout data to calculate experience points. Camera workouts are analysed entirely on your device and no video or image ever leaves your phone. We do not sell your data, and we never use health data for advertising.
1. Who is responsible for your data
The data controllers are Marko Andrijević and Marko Raković, independent developers based in the Republic of Serbia.
For any privacy question or request: zywo.app@gmail.com.
2. What we collect
2.1 Account data
- Account identifier. Every player gets a unique ID. You can play with an anonymous account and never give us an email address.
- Email address — only if you choose to sign in with Apple or Google, so your progress survives a lost or replaced phone. Sign in with Apple's private relay addresses are supported and we never attempt to unmask them.
- Display name and friend code that you choose, visible to other players you battle.
2.2 Health and fitness data
With your explicit permission, we read the following from Apple HealthKit (iOS) or Health Connect (Android):
| Data | Why we need it |
|---|---|
| Steps | Converted into experience points. This is the app's core progression mechanic. |
| Distance | Bonus experience for walking, running and cycling. |
| Active energy burned | Distinguishes real training from incidental movement and caps implausible rewards. |
| Exercise sessions (type and duration) | Determines which activity bonus applies. |
If you decline this permission, the app still works. It falls back to the device step counter, or to manual entry.
We only transmit the daily totals needed to calculate experience points. Your detailed health record history stays on your device. We do not read heart rate, sleep, body measurements, medical records or any other health category.
2.3 Camera
The app can count push-ups, squats and sit-ups using your camera. This matters, so we will be precise about it:
- Video frames are analysed on your device by an on-device model.
- No image, frame or video is saved to storage, uploaded, or transmitted anywhere.
- The only thing that leaves your phone is a number — for example, "23 push-ups".
- Camera workouts work with no internet connection at all.
You can use every other part of the app without granting camera access.
2.4 Gameplay data
Your creature's level, experience, elements, spells, battle results, ranking, streaks and personal bests. Battle records include the opponent's public profile, because a battle involves two people.
2.5 Device and diagnostic data
Device model, operating system version and app version. We use this to detect compatibility problems — for example, manufacturers whose battery optimisation silently kills step tracking — and to diagnose crashes.
2.6 Purchases
Subscription status and purchase history, processed through RevenueCat. Payment is handled entirely by Apple or Google. We never receive or store your card details.
2.7 Advertising
The app will offer optional rewarded video ads through Google AdMob. Watching them is always voluntary; nothing in the game requires an ad. AdMob may use your device advertising identifier. On iOS this only happens if you allow tracking when prompted.
2.8 Notifications
If you enable notifications, we store a push token so we can tell you that a streak is at risk or an opponent has taken their turn. You can turn this off in your system settings at any time.
3. What we do not do
- We do not sell your personal data. To anyone. Ever.
- We do not use health or fitness data for advertising, ad targeting or profiling.
- We do not share health data with third parties.
- We do not collect your location.
- We do not access your contacts, photo library, messages or files.
- We do not upload camera footage.
4. Legal basis (EEA and UK users)
| Purpose | Basis |
|---|---|
| Running your account and the game | Performance of a contract |
| Reading health and fitness data | Explicit consent (Art. 9(2)(a) GDPR) |
| Camera access for rep counting | Explicit consent |
| Crash diagnostics and abuse prevention | Legitimate interest |
| Rewarded advertising | Consent |
You can withdraw any consent at any time in your device's system settings.
5. Who processes data on our behalf
| Provider | Purpose | Receives health data? |
|---|---|---|
| Supabase | Account storage, game database, backend logic | Daily activity totals only |
| Apple / Google | Optional sign-in, payment processing, app distribution | No |
| RevenueCat | Subscription status | No |
| Google AdMob | Rewarded video advertising | No |
| OneSignal | Push notification delivery | No |
These providers act as processors under contract and may not use your data for their own purposes, except where their own policies govern advertising identifiers as described above.
6. Other players
Players you battle can see your display name, creature, level and rank. They cannot see your email address, your health data, or any activity detail. Your friend code is only shared when you choose to share it.
7. How long we keep data
- Account and gameplay data: for as long as your account exists.
- Activity totals: retained as long as your account exists, because progress history, personal bests and trends are features you use.
- After deletion: removed from live systems within 30 days, and from backups within 90 days.
- Inactive accounts: deleted after 24 months of no sign-in.
8. Your rights and how to delete your data
You have the right to access, correct, export, restrict, object to, or delete your data.
To delete everything:
- In the app: Profile → Settings → Delete account. This permanently erases your account, creature, activity history and battle records.
- By email: write to zywo.app@gmail.com from the address on your account, or include your friend code. We respond within 30 days.
Deletion is permanent and cannot be undone. Revoking health permissions in your system settings stops all further reading immediately, but does not delete data already stored — for that, use one of the two routes above.
If you are in the EEA or UK and are unhappy with our response, you may complain to your national data protection authority.
9. Children
Zywo is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
10. International transfers
Our providers may process data outside your country, including in the United States. Where that happens for EEA or UK users, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
11. Security
All traffic between the app and our servers is encrypted with TLS. Database access is restricted by row-level security so that an account can only ever read its own records, and every change to game state is validated server-side. No system is perfectly secure, but health data is held to the strictest controls we operate.
12. Changes to this policy
We update this policy when the app changes. The effective date at the top always reflects the current version, and we will notify you in the app before any material change takes effect.
13. Contact
Marko Andrijević & Marko Raković
zywo.app@gmail.com
