Privacy Policy

Effective date: August 22, 2026

1. Who is responsible

CheckMotion is responsible for the processing described in this policy. For privacy questions or requests, contact info@checkmotion.app.

2. Information we process

Account and sign-in information

When you continue with Google or sign in with Apple, we receive the provider account identifier and the profile details you authorize, normally your name, email address, email-verification status, and optional profile image. Apple may provide a private relay address instead of your personal address. We do not receive your Google or Apple password.

Session and security information

We use strictly necessary cookies to provide a temporary guest recording, remember that a browser used its one-time guest allowance, and keep account users signed in. We may process session identifiers, timestamps, IP address, user-agent information, security events, and diagnostic logs to operate and protect the service.

Videos and analysis results

We process videos you choose to upload, derived pose/keypoint information, detected activity, performance scores, metrics, reports, file name, job identifiers, and processing status. Videos can contain identifiable people and surroundings, so upload only material you are entitled to use.

Subscription and billing information

RevenueCat provides subscription-entitlement status, product, store, purchase, renewal, expiration, and customer identifiers used to unlock Premium. The App Store, Google Play, Stripe, Paddle, or another configured payment provider processes payment details under its own policy. CheckMotion does not receive or store complete payment-card details.

3. How we use information

• Authenticate you and maintain your account and sessions.
• Run pose detection and AI-assisted movement analysis.
• Keep each analysis associated with and accessible only to its owner.
• Apply free or paid analysis entitlements and prevent duplicate use.
• Maintain reliability, prevent abuse, investigate errors, and secure the service.
• Meet legal obligations and respond to valid privacy requests.

4. Legal bases

Where the GDPR applies, we process account, video, and result data as necessary to provide the service you request and perform our agreement with you. Security, fraud prevention, and service diagnostics are based on our legitimate interests in operating a safe and reliable service. We rely on consent where applicable law requires it, and on legal obligations when records must be retained or disclosed.

5. Service providers and disclosures

We use Google and Apple for authentication; RevenueCat for subscription entitlement and purchase coordination; the applicable app store or configured web payment provider for billing; hosting, database, and object-storage providers for application data; and configured AI providers for sport detection, movement evaluation, and report generation. These providers process information under their own terms or our service-provider arrangements. We do not sell personal information or use uploaded videos for advertising.

We may disclose information when required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards.

6. Storage and retention

Account records, saved source videos, and completed results are kept while your account is active unless you delete a recording or a shorter operational retention period applies. Database account sessions expire after no more than seven days without refresh. OAuth credentials needed to maintain or revoke a connected provider are encrypted at rest. After account deletion, only the encrypted credentials required for a failed provider-revocation attempt are retained until that cleanup succeeds.

A guest video and result are accessible only during the temporary browser session and are scheduled for deletion no later than 24 hours after the guest session is created. This short backend buffer lets processing and a sign-in callback finish; it is not a saved recording. Deleting a saved recording or your account removes associated website records and triggers deletion of retained analysis uploads; failed external deletion attempts are retried. Limited backup, security, or legally required records may remain for the period necessary before being securely removed or anonymized.

To prevent repeated use of a one-time allowance, we retain the account identifier while an account remains active and a one-way keyed hash derived from a random guest-browser identifier for up to 12 months. The guest hash is not used to recreate your profile. Failed external cleanup operations are recorded without your name or email and retried until completed.

7. Apple private email relay

If you choose Hide My Email, Apple supplies a relay address that forwards messages to you. Delivery is controlled by Apple and can be disabled in your Apple account. We treat relay addresses like other account email addresses and do not attempt to discover the underlying address.

8. Cookies and local device storage

Sign-in and guest-access cookies are HTTP-only, meaning browser scripts cannot read them. The guest-access cookie ends with the browser session; a separate opaque allowance cookie can remain for up to 12 months. For signed-in users, the browser may also keep a local playback cache of the selected video in IndexedDB. Guest videos are not written to that persistent browser cache. Server ownership checks still protect stored account videos. Account deletion attempts to remove local copies on the current device; browser settings can remove any remaining site data. We do not place advertising cookies through this feature.

9. International transfers

Some providers may process information outside your country. Where required, we use recognized transfer mechanisms and contractual or technical safeguards appropriate to the service and destination.

10. Your choices and rights

Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete personal information, and to complain to a data-protection authority. You can delete the account from My account. We may need to verify a request and may retain information where law requires it.

You can revoke CheckMotion access in Google or Apple settings. Revoking a provider does not by itself delete CheckMotion data; use account deletion or contact us for that.

11. Children and recordings of others

CheckMotion is not intended for children under 16 to create an account without authorization from a parent or guardian. Do not upload a video of another person unless you have permission and a lawful basis to do so, especially when the person is a minor.

12. Security

We use access controls, encrypted transport, encrypted provider tokens, private object storage, server-side authorization, and monitoring intended to protect information. No system can guarantee absolute security; contact us promptly if you believe an account or video has been accessed improperly.

13. Changes and contact

We may update this policy as the service changes. Material changes will be presented through the website or account where appropriate, with a revised effective date. Questions and privacy requests can be sent to info@checkmotion.app.