PRIVACY POLICY

Last updated: 31 March 2026

Welcome to hypd (the "App"), a product of idefk ltd. ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use hypd.

1. INFORMATION WE COLLECT

Account Information – Phone number, first name, and last name.

Contacts (optional) – If you grant access, we may access your device contacts to suggest friends within the App.

Device Permissions – Camera and photo-library access (optional) so you can take or upload pictures, e.g., for a profile photo or workout verification.

Health & Fitness Data – When you participate in fitness challenges, we collect the following health- and fitness-related data:

• Workout verification photos – Images you submit to verify that you have completed a workout.

• Workout activity logs – Records of whether you completed a workout on a given day, your workout streaks, and your overall consistency within a challenge.

• Challenge participation data – Which challenges you have joined, the stake amount, challenge duration, your performance relative to other participants, and challenge outcomes (including winnings or losses from the shared pot).

This data is required to operate the core challenge feature and is not optional while participating in a challenge.

Automatically Collected Data – Device model, operating-system version, unique device identifiers, app-usage logs, and crash reports.

Data We Do Not Collect – We do not collect precise location data, detailed health or medical records (such as heart rate, calories, sleep, or biometric data), or any information from users under 18.

2. HOW WE USE YOUR INFORMATION

• To create and manage your account and authenticate you via phone number (Firebase Authentication).

• To operate the fitness-challenge shared pot feature, including verifying workout completion, tracking challenge progress, calculating consistency scores, and determining challenge outcomes.

• To process and analyse workout verification photos solely for the purpose of confirming workout completion. These photos are not used for any other purpose.

• To send push notifications (e.g., progress updates, challenge reminders) through Firebase Cloud Messaging.

• To monitor, maintain, and improve app stability and performance through aggregated analytics.

• To comply with legal obligations and enforce our Terms of Use.

• To suggest friends by matching your contacts (if you choose to grant permission).

We do not use your data for targeted advertising, profiling, or sale to third parties. We do not use your health and fitness data for advertising, marketing, or any purpose unrelated to providing the challenge feature.

3. LEGAL BASIS FOR PROCESSING (EU/UK USERS)

• Performance of a contract – Providing the service you requested, including processing health and fitness data necessary to operate the challenge feature.

• Legitimate interests – Keeping the App secure and improving it.

• Consent – For optional features such as notifications, camera access, and contacts access.

4. SHARING & DISCLOSURE

We do not sell, rent, or share your personal data — including health and fitness data — with advertisers, data brokers, or other third parties for marketing purposes.

Limited challenge data shared with other participants: Other users in the same challenge can see your challenge participation status (e.g., whether you completed a workout on a given day and your consistency score). They cannot see your verification photos or any other personal data beyond your name and challenge progress.

We share information only:

• With service providers who perform services on our behalf (e.g., Google Firebase for authentication, cloud storage, and messaging) under strict data-processing agreements. These providers do not have independent rights to use your data.

• When required by law or to protect rights and safety.

5. DATA RETENTION

• Account data is retained while your account is active.

• Workout verification photos are retained for the duration of the challenge plus 7 days, after which they are permanently deleted.

• Challenge participation data (workout logs, consistency scores, outcomes) is retained while your account is active and deleted when you delete your account.

• After you delete your account, we erase or anonymise personal data within 15 days.

• Backup copies may persist for a maximum of 30 days before being purged.

6. SECURITY

We use industry-standard safeguards, including encryption in transit (HTTPS/TLS), least-privilege access controls, and regular security reviews of Firebase configurations. Workout verification photos are stored securely and accessible only to authorised systems. No method of transmission or storage is 100 percent secure, but we work to protect your information.

7. INTERNATIONAL TRANSFERS

Firebase servers may be located outside your country. Where required, we rely on safeguards such as Standard Contractual Clauses.

8. YOUR RIGHTS

Depending on your location, you may have the right to access, correct, delete, or restrict the processing of your personal data, including your health and fitness data. To exercise these rights, contact us at tadhg@idefk.org.

9. CHILDREN'S PRIVACY

hypd is intended only for users aged 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided personal data, please contact us so we can delete it.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Any changes will be posted in-app and on our website with an updated "Last updated" date. Continued use of hypd after changes take effect constitutes acceptance of the revised policy.

11. CONTACT US

For questions about this Privacy Policy or our data practices, email tadhg@idefk.org.

© 2025 idefk ltd. All rights reserved.