Privacy Policy

1. Who is responsible

ShadowJab is made by Data Dolphin ("we", "us"). We are the controller responsible for the personal data described in this policy:

Write to us there about anything in this policy, including to use your rights (section 12).

2. The camera and pose tracking

To score your boxing, ShadowJab has to see you. When you play, the picture from your camera is passed, one frame at a time, to a pose-detection model that runs on your own device: Google ML Kit in the apps, and Google MediaPipe in the browser game. The model reports where 33 points of your body are, such as your wrists, shoulders and hips and the position of your head. The game turns those points into punches, slips and ducks, and the frame is then discarded.

• Video and photos are never recorded or saved.
• Camera frames and the detected body positions never leave your device. They are not sent to us, to Google or to anyone else.
• They are not used to identify you. ShadowJab does no face recognition and creates no biometric template.
• The microphone is never used.

You decide whether ShadowJab may use the camera, and you can take that permission back at any time: in your browser's site settings, or on your phone (on iPhone, Settings › ShadowJab › Camera; on Android, Settings › Apps › ShadowJab › Permissions). Without the camera, rounds cannot be played.

Legal basis: this happens only on your device, to provide the game you chose to play (Art. 6(1)(b) GDPR). We never receive camera data.

3. The website and browser game

Visiting the website

Like every website, this one receives some technical information from your browser whenever it loads a page: your IP address, the date and time, the page or file requested, the page you came from, and your browser and operating system. Our hosting provider records this in server logs. They are used only to deliver the website and keep it secure, for example to spot and fend off attacks, and never to build profiles. They are deleted after 30 days at most, unless a specific entry is needed to investigate a security incident.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working and secure website.

No cookies or ads

The website sets no cookies and uses no ads, tracking pixels, social media plugins or externally loaded fonts. Everything it needs, including the pose-detection software and model used by the browser game, is served from our own server.

Visit statistics

To see how many people visit, which pages they read and how quickly the pages load, we use Cloudflare Web Analytics, a service of Cloudflare, Inc. (USA). When a page loads, a small script from Cloudflare reports:

• the address of the page, without any query string, and the page you came from;
• your browser, operating system and type of device, and your country, which Cloudflare works out from your IP address;
• how long the page took to load and how smoothly it ran.

According to Cloudflare, the script sets no cookies, stores nothing in your browser and does not fingerprint you, and Cloudflare does not use the data to follow anyone across websites. We see only totals, never individual visitors. Cloudflare keeps the full reports for seven days and after that only a sample of around 10%, and we can look back six months. Cloudflare processes this data on our behalf. You can block the script with any content blocker; the website works exactly the same without it, and treats every visit the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how the website is used and keeping it fast. You can object at any time (section 12).

The browser game

The browser game uses your camera as described in section 2. Between visits, it remembers two things in your browser's local storage:

• your five best rounds: the score, rank, hits, best streak, how long the round lasted and when you played it;
• your answer to "How much boxing have you done?", which sets how fast a round speeds up.

This stays in your browser, is never sent to us or anyone else, and is used only to show your best rounds and remember your answer. To delete it, clear this site's data in your browser's settings.

Your browser only lets the game connect to our own server and to the visit statistics above (a Content Security Policy). This matters because the pose-detection library the game uses, Google MediaPipe, contains a function that sends usage statistics to Google. That function is blocked, so nothing reaches Google.

Legal basis: storing your rounds and your answer on your own device is strictly necessary for the features you are using (Art. 6(1)(b) GDPR, and the exemption for strictly necessary storage in the EU ePrivacy rules). We never receive this data.

Links to the app stores

The App Store and Google Play buttons are plain links. Nothing is sent to Apple or Google until you click one, and from then on their privacy policies apply.

4. The apps: what stays on your phone

The apps work without an account. The following is stored only on your phone, in the app's own private storage, and is never sent to us:

• your answers to the setup questions, such as how much you have boxed and how many days a week you want to train;
• your scores, round statistics and best rounds in each mode;
• the days on which you trained, for your streak and weekly goal;
• your settings, such as sound, vibration, round length and which moves are switched on;
• how many free rounds you have left and when they refill, and whether you have ShadowJab Pro;
• whether the app has already asked you for a rating.

You can delete your scores and history, or start again from scratch, in the app's settings, and uninstalling the app deletes all of it. If you back up your phone, for example to iCloud or Google, your phone may include this data in the backup. That backup is held by Apple or Google in your account, and we have no access to it.

Legal basis: Art. 6(1)(b) GDPR, to provide the app's features. We never receive this data.

5. The apps: ads

The apps are free to download, and the free version is paid for by ads, for example a short video you can choose to watch in return for an extra round. ShadowJab Pro has no ads, and the website and the browser game never show any.

Ads are delivered by our ad partner, Google AdMob. To choose and show ads, measure them and prevent ad fraud, Google's advertising software in the app collects:

• your device's advertising ID (on iPhone, only if you allow tracking, see below);
• your IP address, from which your approximate location, such as your country or city, is worked out;
• information about your device and the app, such as the model, operating system, language, and the app's name and version;
• information about the ads: which ads you saw, whether you tapped one or finished watching a reward video, and technical data about how they loaded.

Non-personalised ads are chosen from the context, such as the app you are using and your approximate location. The data above is then used only for things like limiting how often you see the same ad, counting views and detecting fraud. Personalised ads are also chosen using your advertising ID and what Google knows about your interests from other apps and websites.

Your choices

• In the EEA, the UK and Switzerland, the app asks for your consent before ads are personalised or information on your phone is used for advertising. If you say no, you see non-personalised or limited ads. You can change your choice at any time in the app, under Settings › Privacy choices.
• On iPhone, the app asks for permission to track you (App Tracking Transparency) before your advertising ID can be used. If you decline, the app cannot read it. You can change this at any time in Settings › Privacy & Security › Tracking.
• On Android, you can delete or reset your advertising ID in your phone's settings, under Settings › Privacy › Ads or Settings › Google › Ads, depending on the phone.
• In US states with privacy laws, such as California, using data for personalised ads can count as "selling" or "sharing" personal information, or as "targeted advertising". You can opt out in the app under Settings › Privacy choices, or with the tracking and ads settings on your phone described above.
• ShadowJab Pro switches ads off completely.

Google uses the data it receives as an independent controller under its own privacy policy. See how Google uses information from apps that use its services, and manage the ads Google shows you in My Ad Center.

Legal basis: your consent, for personalised ads and wherever else the law requires consent to store or read information on your phone (Art. 6(1)(a) GDPR); otherwise our legitimate interest in paying for the free version with ads and protecting it from fraud (Art. 6(1)(f) GDPR). You can withdraw consent at any time, with effect for the future.

6. The apps: purchases and subscriptions

You can buy ShadowJab Pro, a subscription that may start with a free trial, and other in-app purchases. They are bought through the App Store or Google Play, and Apple or Google handles the payment. We never receive your payment details, and a purchase does not tell us your name or email address.

To show offers, unlock what you bought and keep it working, the apps use a subscription service, Superwall. It receives:

• a random ID created for your copy of the app, and the identifier your phone gives to all apps from the same developer;
• device and app information: model, operating system, language, region and currency settings, time zone, network type, app version, and when the app was installed;
• your approximate location (country, region and city), worked out from your IP address;
• your subscription status and the purchase details from Apple or Google, such as the product, price, dates, whether it is a trial, and the transaction ID;
• how you used the purchase screens: which offers you saw, how often and when, and whether you started a trial or a purchase.

This is used to provide what you paid for, to restore it on a new phone that uses the same Apple ID or Google account, to handle renewals, cancellations and refunds, to prevent fraud, and to see, in aggregate, which offers work. It is not used for advertising. Superwall processes it on our behalf and on our instructions.

Apple and Google also send us sales reports and, for individual orders, limited details such as an order number, the product, the price, the date and the country. We use these for our accounts and to help with support and refunds.

Legal basis: Art. 6(1)(b) GDPR, to provide what you buy; Art. 6(1)(f) GDPR, our legitimate interest in preventing fraud and improving our offers; Art. 6(1)(c) GDPR, for records the law requires us to keep.

7. The apps: technical data

Google ML Kit

The apps detect your pose with Google ML Kit, which runs on your phone. ML Kit never sends camera images or body positions to Google. As part of its normal operation, though, it does send Google technical information about how it runs: your phone's make and model, its operating system version and machine-learning hardware, the app's name and version, identifiers for the app installation that are not meant to identify you, performance figures such as how long a detection took, settings such as the image format and resolution, and error codes. On Android it also uses Google's Firebase services to fetch its configuration. Google uses this, as an independent controller, to maintain and improve ML Kit and to detect misuse. We do not receive it.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in reliable pose detection that runs on your phone instead of sending your video to a server.

Statistics and crash reports from Apple and Google

If you have agreed in your phone's settings to share analytics with app developers, Apple and Google give us crash reports and usage statistics, such as the number of installs, sessions and crashes, mostly in aggregate. You can switch this off on iPhone under Settings › Privacy & Security › Analytics & Improvements, and on Android in your Google usage and diagnostics settings.

Ratings

The apps may ask you to rate them using Apple's or Google's own rating window. The stores do not tell us whether the window appeared, or whether or how you rated.

Permissions and internet use

The apps ask for permission to use the camera and, on iPhone, for permission to track for ads (section 5). They never ask for your location, contacts, photos or microphone. They use the internet only for ads, purchases and the technical data described in this section. Rounds themselves work offline.

8. When you contact us

If you email us, we use your email address, your message and anything you choose to include to reply and to deal with your request. We keep the conversation until the matter is settled and then for up to two years in case you come back to it, unless the law requires us to keep it longer.

Legal basis: Art. 6(1)(b) GDPR where your message is about a purchase or using ShadowJab; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering you.

9. Who receives data

Data goes only to the following, for the purposes described above:

Our hosting provider

Hosts this website and its server logs, on our behalf.

Cloudflare Web Analytics

Visit statistics for the website (section 3), on our behalf. Cloudflare, Inc., USA. Privacy policy

Google AdMob

Ads in the free version of the apps (section 5), as an independent controller. Google Ireland Limited if you are in the EEA or Switzerland, otherwise Google LLC, USA. Privacy policy

Google ML Kit and Firebase

Technical data from the apps' pose detection (section 7), as an independent controller. Privacy policy

Superwall

Purchase screens and subscription status in the apps (section 6), on our behalf. Nest 22, Inc., trading as Superwall, USA. Privacy policy

Apple and Google as app stores

Distribute the apps, take payments, manage subscriptions and provide statistics and crash reports (sections 6 and 7), as independent controllers. Apple privacy policy, Google privacy policy

Our email provider

Stores the emails you send us, on our behalf.

Authorities and advisers

Only where the law requires it, or where it is needed to establish, exercise or defend legal claims.

We do not sell your personal data for money. Under some US state laws, though, letting our ad partner use data for personalised ads can count as a "sale" or "sharing"; section 5 explains how to opt out.

10. Transfers outside Europe

Some of the recipients above are based in, or use servers in, countries outside the European Economic Area and the UK, in particular the USA. For transfers to the USA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses approved by the Commission (Art. 46(2)(c) GDPR). The equivalent UK and Swiss arrangements apply to transfers from those countries. You can ask us for a copy of the safeguards we rely on.

11. How long data is kept

12. Your rights and choices

Depending on where you live, you have rights over your personal data. Where the GDPR or the UK GDPR applies to you, you can:

• get a copy of the personal data we hold about you (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• have its use restricted (Art. 18);
• receive it in a portable, machine-readable format (Art. 20);
• withdraw any consent you have given, at any time, without affecting what happened before (Art. 7(3));
• complain to a data protection supervisory authority, in particular where you live or work (Art. 77).

If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, you may have the right to know what personal information is collected about you and how it is used, to access, correct and delete it, and to opt out of targeted advertising and the "sale" or "sharing" of personal information (section 5 explains how). The categories involved are identifiers such as IP address, advertising ID and app installation IDs; purchase information; interactions with ads, purchase screens and the pages of this website; approximate location worked out from IP address; and the emails you send us. We collect no sensitive personal information. We will not treat you differently for using your rights, and if we turn down a request, you can appeal by replying to our answer.

How to use your rights

Email support@datadolphin.net. Because ShadowJab has no accounts and keeps your game data on your device, we hold very little about you, and we usually cannot tell which data is yours without your help: for a purchase, please include the order number from your App Store or Google Play receipt. Data that only exists on your device is entirely in your hands, and you can delete it in the app or your browser at any time. For data Google holds, you can also use Google's own tools, such as My Ad Center.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

13. Children

ShadowJab is not directed at children under 13, and we do not knowingly collect personal data from them. In the EEA and the UK, consent to personalised ads from anyone under 16, or the lower age set by their country's law, has to be given or approved by a parent; until then, they should decline personalised ads in the consent screen. If you think a child has given us personal data, email us and we will delete it.

14. Security

The website is served only over an encrypted connection (HTTPS), and the apps' partners receive data over encrypted connections. What the apps store on your phone sits in the app's private storage, protected by your phone's own security, so a screen lock helps. No system is perfectly secure, but because almost everything stays on your device, there is very little data about you anywhere else to protect.

15. Changes to this policy

We will update this policy when ShadowJab changes, for example when we add a feature or a partner, and the date at the top shows when it last changed. If a change materially affects how your data is used, we will tell you in the app or on the website before it takes effect, and ask for your consent where it is needed.

16. Contact

For questions about this policy or your data, email support@datadolphin.net. Our postal address is in section 1.