Privacy Policy

Effective date: September 2, 2026

1. Who is responsible

CheckMotion is responsible for the processing described in this policy. For privacy questions or requests, contact info@checkmotion.app.

2. Information we process

Account and sign-in information

When you continue with Google or sign in with Apple, we receive the provider account identifier and the profile details you authorize, normally your name, email address, email-verification status, and optional profile image. Apple may provide a private relay address instead of your personal address. We do not receive your Google or Apple password.

Session and security information

We use strictly necessary cookies to provide a temporary guest recording, remember that a browser used its one-time guest allowance, and keep account users signed in. We may process session identifiers, timestamps, IP address, user-agent information, security events, and diagnostic logs to operate and protect the service.

API credentials

If you create an API key, we store its name, account owner, public prefix, keyed cryptographic hash, creation and last-use timestamps, and call count. The complete secret is shown only when the key is created and is not stored by CheckMotion. Requests made with the key can be associated with your account for access control, usage measurement, abuse prevention, and security.

Videos and analysis results

We process videos you choose to upload, derived pose/keypoint information, detected activity, performance scores, metrics, reports, file name, job identifiers, and processing status. Videos can contain identifiable people and surroundings, so upload only material you are entitled to use.

Subscription and billing information

RevenueCat provides subscription-entitlement status, product, store, purchase, renewal, expiration, and customer identifiers used to unlock Premium. The App Store, Google Play, Stripe, Paddle, or another configured payment provider processes payment details under its own policy. CheckMotion does not receive or store complete payment-card details.

Optional usage analytics

If you allow analytics, Google Firebase Analytics processes information about visits and feature interactions, including page paths, device and browser characteristics, approximate region, timestamps, and an analytics identifier. We do not send uploaded videos, analysis content, names, or email addresses to Firebase Analytics.

3. How we use information

• Authenticate you and maintain your account and sessions.
• Run pose detection and AI-assisted movement analysis.
• Keep each analysis associated with and accessible only to its owner.
• Create, authenticate, measure, and revoke API access you request.
• Apply free or paid analysis entitlements and prevent duplicate use.
• Maintain reliability, prevent abuse, investigate errors, and secure the service.
• Measure visits and feature usage when you consent to optional analytics.
• Meet legal obligations and respond to valid privacy requests.

4. Legal bases

Where the GDPR applies, we process account, video, and result data as necessary to provide the service you request and perform our agreement with you. Security, fraud prevention, and service diagnostics are based on our legitimate interests in operating a safe and reliable service. We rely on consent where applicable law requires it, and on legal obligations when records must be retained or disclosed.

Optional usage analytics are based on your consent under Article 6(1)(a) GDPR. Access to or storage of analytics information on your device is also subject to your consent under Section 165(3) of the Austrian Telecommunications Act 2021 where that law applies. You can withdraw consent at any time through “Cookie settings” without affecting the lawfulness of processing that occurred before withdrawal.

5. Service providers and disclosures

We use Google and Apple for authentication; Google Firebase for optional usage analytics; RevenueCat for subscription entitlement and purchase coordination; the applicable app store or configured web payment provider for billing; hosting, database, and object-storage providers for application data; and configured AI providers for sport detection, movement evaluation, and report generation. These providers process information under their own terms or our service-provider arrangements. We do not sell personal information or use uploaded videos for advertising.

Google Analytics for Firebase is provided by Google. For customer data processed on our behalf, Google generally acts as a processor under its applicable data-processing terms. More information is available in Google’s Firebase privacy and security information and advertising and measurement data-processing terms.

We may disclose information when required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards.

6. Storage and retention

Account records, saved source videos, completed results, and API-key metadata are kept while your account is active unless you delete them or a shorter operational retention period applies. Revoking an API key deletes its stored hash and metadata; account deletion revokes all account-owned API keys. Database account sessions expire after no more than seven days without refresh. OAuth credentials needed to maintain or revoke a connected provider are encrypted at rest. After account deletion, only the encrypted credentials required for a failed provider-revocation attempt are retained until that cleanup succeeds.

A guest video and result are accessible only during the temporary browser session and are scheduled for deletion no later than 24 hours after the guest session is created. This short backend buffer lets processing and a sign-in callback finish; it is not a saved recording. Deleting a saved recording or your account removes associated website records and triggers deletion of retained analysis uploads; failed external deletion attempts are retried. Limited backup, security, or legally required records may remain for the period necessary before being securely removed or anonymized.

To prevent repeated use of a one-time allowance, we retain the account identifier while an account remains active and a one-way keyed hash derived from a random guest-browser identifier for up to 12 months. The guest hash is not used to recreate your profile. Failed external cleanup operations are recorded without your name or email and retried until completed.

The current Google Analytics property settings retain user-linked website event data for two months and user data for up to 14 months. The user-data period can restart when new activity occurs. Standard aggregated reports may remain available for longer because the user-level retention controls do not apply to most aggregated reporting.

7. Apple private email relay

If you choose Hide My Email, Apple supplies a relay address that forwards messages to you. Delivery is controlled by Apple and can be disabled in your Apple account. We treat relay addresses like other account email addresses and do not attempt to discover the underlying address.

8. Cookies and local device storage

Sign-in and guest-access cookies are HTTP-only, meaning browser scripts cannot read them. The guest-access cookie ends with the browser session; a separate opaque allowance cookie can remain for up to 12 months. For signed-in users, the browser may also keep a local playback cache of the selected video in IndexedDB. Guest videos are not written to that persistent browser cache. Server ownership checks still protect stored account videos. Account deletion attempts to remove local copies on the current device; browser settings can remove any remaining site data. We do not place advertising cookies through this feature.

Firebase Analytics remains disabled unless you select “Accept cookies.” If enabled, Google Analytics 4 may set the first-party cookies _ga to distinguish visitors and _ga_<container-id> to retain session state. Google documents a default lifetime of up to two years, subject to browser limits. Analytics and advertising consent signals are denied by default, and advertising storage, advertising user data, and ad personalization remain denied even when you allow usage analytics.

Your analytics choice and its date are stored locally for up to six months so the site can remember it. You can reopen “Cookie settings” at any time. Withdrawing consent stops Analytics collection and removes accessible Analytics cookies from this site. Declining analytics does not affect access to CheckMotion.

9. International transfers

Some providers may process information outside your country. Where required, we use recognized transfer mechanisms and contractual or technical safeguards appropriate to the service and destination.

Google operates global infrastructure and may process Firebase and Analytics information outside the EEA, including in the United States. Depending on the transfer, Google states that it relies on the EU-U.S. Data Privacy Framework and, where appropriate, Standard Contractual Clauses. Information about these safeguards is available in Google’s international data-transfer documentation.

10. Your choices and rights

Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete personal information, and to complain to a data-protection authority. You can delete the account from My account. We may need to verify a request and may retain information where law requires it.

You can revoke CheckMotion access in Google or Apple settings. Revoking a provider does not by itself delete CheckMotion data; use account deletion or contact us for that.

11. Children and recordings of others

CheckMotion is not intended for children under 16 to create an account without authorization from a parent or guardian. Do not upload a video of another person unless you have permission and a lawful basis to do so, especially when the person is a minor.

12. Security

We use access controls, encrypted transport, encrypted provider tokens, private object storage, server-side authorization, and monitoring intended to protect information. No system can guarantee absolute security; contact us promptly if you believe an account or video has been accessed improperly.

13. Changes and contact

We may update this policy as the service changes. Material changes will be presented through the website or account where appropriate, with a revised effective date. Questions and privacy requests can be sent to info@checkmotion.app.