Privacy Policy

01Who We Are

Stryv is operated by KURD CORP LTD, a company registered in England and Wales ("Stryv", "we", "us" or "our"). We are the data controller responsible for your personal data collected through the Stryv mobile application, the stryv-app.com website, browser-based battles and related services (together, the "Service").

We respect your privacy and are committed to protecting your personal data. This policy explains what we collect, how we use it, who we share it with, how long we keep it, and the rights you have. Please read it carefully before using the Service.

Contact for all privacy matters: stryvcontact@gmail.com

02Camera & Movement Data — Zero Storage

In browser battles, the pose-detection model is downloaded to and runs inside your browser; the model provider serves the model file but does not receive your video. You can read more on our AI & Security page.

Where live video is shared between users, you are responsible for what you transmit. If a session is reported for misuse, we may review it and temporarily retain material reasonably necessary for moderation, safety and legal compliance (see Section 07).

Camera access is only requested when you start a camera-based feature, and you can revoke it at any time in your device or browser settings.

03Information We Collect

We may collect and process the following categories of personal data:

• Identity Data: name, username or similar identifier, and date of birth where required.
• Contact Data: email address.
• Technical Data: IP address, login data, browser and device type, operating system, time zone, and similar technology identifiers.
• Usage Data: how you use the Service — features used, screens viewed, session information and crash logs.
• Fitness & Performance Data: workouts, rep counts, battle results, ranks, streaks, goals and progress recorded through the Service.
• Transaction Data: subscription status and purchase history (payment card details are handled by our payment processors, not stored by us).
• Marketing & Communications Data: your preferences for receiving communications from us.

HealthKit and Google Fit

With your explicit consent, the app may integrate with Apple HealthKit (iOS) and Google Fit (Android) to read and write workout and health data (such as workouts, step counts and heart rate) in order to provide and personalise the Service. You can revoke this access at any time in your device settings, and we will stop accessing that data. Data accessed through these integrations is also subject to Apple's and Google's own policies. We never use health data for advertising.

Data Minimisation

We collect only the data reasonably required to provide the Service. We regularly review what we collect, and we delete or anonymise data that is no longer needed for its stated purpose.

04How We Use Your Information & Lawful Bases

We use your personal data only where the law allows us to — most commonly:

• Contract: to register your account, provide the Service, run battles and rankings, and process your subscription.
• Legitimate interests: to secure and improve the Service, prevent cheating, fraud and abuse, provide support, and understand how the Service is used — where your rights do not override those interests.
• Legal obligation: to comply with applicable law and enforce our terms.
• Consent: for marketing communications, HealthKit/Google Fit integration and any other processing where we ask for it. You can withdraw consent at any time.

AI Processing

AI features (movement analysis, rep verification, workout generation) process your data to deliver the feature you requested. Camera input is processed on-device as described in Section 02. AI-generated content is informational only and is not medical advice. We do not use your personal data to train third-party AI models.

05Who We Share Data With

We do not sell your personal information. We share personal data only with:

• Service providers (processors): vendors who process data on our behalf under contract — currently including Google Firebase (authentication, database, hosting, analytics and crash reporting), RevenueCat (subscription management), Stripe (web payments), Apple and Google Play (in-app purchases and distribution), and EmailJS (transactional email for promotions).
• Legal requirements & safety: where required by law, regulation, legal process or governmental request, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of any person, or to report suspected criminal activity to law enforcement or other competent authorities.
• Business transfers: in connection with a merger, acquisition, reorganisation or sale of assets — in which case this policy will continue to apply to your data.
• With your consent: in any other case, we will ask first.

Each provider processes data under its own privacy policy and our instructions: Google, RevenueCat, Stripe.

06International Transfers

We are based in the United Kingdom. Some of our service providers store or process data in other countries, including the United States. Where personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards — such as adequacy decisions or standard contractual clauses — to protect it.

07Data Retention

We keep personal data only as long as necessary for the purposes it was collected for, including legal, accounting and reporting requirements. In summary:

• Camera video (ordinary AI analysis): never retained — it is never stored in the first place.
• Reported / moderation material: content and related data retained following a report (which may include session metadata, account information and, where available, temporary copies or records relating to a reported live session) are kept only as long as reasonably necessary for moderation, safety, fraud prevention, dispute handling and legal compliance, then deleted or anonymised.
• Account and fitness data: kept while your account is active, and deleted from our active systems within 30 days of account deletion (subject to any moderation or legal retention above).
• Transaction records: kept as required for tax and accounting law.
• Anonymised, aggregated data that can no longer identify you may be retained for analytics and research.

08Data Security

We implement appropriate technical and organisational measures designed to protect your personal data, including encrypted transport (HTTPS), managed cloud infrastructure that encrypts data at rest by default, authentication-gated database rules, and restricted access controls. Our security approach is described in more detail on our AI & Security page.

No method of transmission or storage is 100% secure; while we work to protect your personal data, we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will act in accordance with applicable breach-notification laws.

09Cookies & Similar Technologies

We use cookies and similar technologies to operate and improve the Service:

• Essential: required for the Service to function (for example, authentication).
• Analytics/Performance: help us understand how the Service is used so we can improve it.
• Functionality: remember your preferences.

We do not currently use third-party advertising networks or behavioural advertising tracking. We will never use health or fitness data for advertising. You can control cookies through your browser settings; blocking essential cookies may prevent parts of the Service from working.

10Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. Users under 18 require parental or guardian consent, as set out in our Terms of Service. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it.

11Your Legal Rights

Under the UK GDPR (and, where applicable, the EU GDPR), you have the right to:

• Access — request copies of your personal data;
• Rectification — request correction of inaccurate or incomplete data;
• Erasure — request deletion of your personal data in certain circumstances ("right to be forgotten");
• Restriction — request that we restrict processing of your data;
• Portability — request transfer of your data to you or a third party in a machine-readable format;
• Object — object to processing based on legitimate interests or for direct marketing;
• Withdraw consent — at any time, where processing is based on consent.

To exercise any right, email stryvcontact@gmail.com. We may need to verify your identity, and we will respond within the timeframes required by law (normally one month).

California Residents

If you are a California resident, the CCPA/CPRA gives you additional rights, including the right to know what personal information we collect, the right to delete it, the right to opt out of "sale" or "sharing" of personal information (we do not sell personal information), the right to limit use of sensitive personal information, and the right to non-discrimination for exercising your rights.

Complaints

You have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) — ico.org.uk. EU/EEA users can find their authority via the EDPB, and California residents can contact the CPPA. We would appreciate the chance to resolve your concern first — please contact us before going to a regulator.

12Account Deletion & Data Erasure

You can delete your account and request erasure of your personal data at any time:

• Use the account deletion feature in the app settings; or
• Email stryvcontact@gmail.com with the subject "Data Deletion Request".

When you delete your account:

• Your account is permanently deactivated;
• Your personal data is deleted from our active systems within 30 days;
• Active subscriptions are cancelled (access may continue until the end of the paid period; manage app-store billing through the relevant store);
• We may retain limited information where required for legal, regulatory, security or accounting purposes, and anonymised aggregated data that cannot identify you;
• There is no stored camera footage to delete — it never exists.

We will confirm your deletion request and may need to verify your identity before processing it.

13Marketing & Opt-Outs

We only send marketing where you have opted in, and every marketing email includes an unsubscribe link. You can also opt out of marketing, push notifications and analytics at any time through the app or device settings, or by contacting us. Opt-out requests are processed promptly, and in any event within 30 days.

14Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date. For material changes we will provide more prominent notice — and, where required by law, seek your consent. Please review this page periodically.

15Contact Us

For any questions about this Privacy Policy or how we handle your data:
KURD CORP LTD — trading as Stryv
Email: stryvcontact@gmail.com