Privacy Policy - DuoLeveling

1. Controller

Serhat Altin
General-Woyna-Straße 17
13403 Berlin
Germany
Email: hello@serhataltin.com

This policy explains how the app "Duo Leveling" (iOS and Android, hereinafter "DuoLeveling" or "the app") processes personal data, in accordance with the EU General Data Protection Regulation (GDPR). On Google Play the developer is listed as "Serhot".

2. Data we process

• Account data: When you sign up with email and password or sign in with Google or Apple, Firebase Authentication processes your email address, your name (if provided by Google or Apple) and a user ID.
• Game and profile data: Username, friend code, profile photo, chosen character class, level, experience points, stats, equipment, titles, quests and quest completions, workout plans, story progress and the feedback you give on quests.
• Fitness profile (optional): Information you enter yourself to get personalised quests, such as fitness goals, fitness level, preferred workout types and days, available equipment and time per workout, and optionally age, height, weight, gender, health conditions and injuries. You can leave the optional fields empty.
• Health data: With your permission the app reads your step count and total calories burned from Apple Health (iOS) or Health Connect (Android). See section 4.
• Photos: A profile photo and optional progress snapshot photos that you take with the camera or pick from your gallery. Only the photos you choose are uploaded.
• Social features: Friends, guilds, guild invitations and join requests, challenges, community workout plans you publish, ratings, reviews and content reports.
• Purchase data: Subscription and purchase status via RevenueCat. Payment details are processed exclusively by Apple or Google and are not visible to us.
• Technical and usage data: Push notification token, crash reports (with your user ID, level and character class), app performance data, usage events (e.g. sign up, quest completed, purchase started) and interactions with community content.
• Advertising data: If you do not have a premium subscription, the app shows ads via Google AdMob (see section 6).

3. Purposes and legal bases

• Providing the app, your account, game progress, sync across devices, social features and purchases: performance of the contract (Art. 6(1)(b) GDPR).
• Health data and the optional health conditions and injuries in your fitness profile: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), given by granting the health permission or by entering the information. You can withdraw it at any time.
• Crash reports, performance monitoring, usage statistics and protection against misuse: our legitimate interest in a stable, secure and improving app (Art. 6(1)(f) GDPR).
• Ads for users without a subscription: our legitimate interest in financing the free version (Art. 6(1)(f) GDPR) and, where required, your consent (Art. 6(1)(a) GDPR).
• Push notifications: your consent via the system permission (Art. 6(1)(a) GDPR).

4. Health data (Apple Health and Health Connect)

The app only reads two data types: steps and total calories burned. It does not write any data to Apple Health or Health Connect. On Android the app also asks for the activity recognition permission needed for step counting.

These values are used to track quest progress and to count your contribution to World Boss events, guild goals and friend challenges. Step totals are stored with your account and are visible to the guild members and friends you play with.

Health data is not used for advertising, is not sold, is not shared with advertising networks or data brokers and is not sent to the AI service. You can revoke access at any time in the Health app (iOS) or in Health Connect (Android).

5. AI generated content (OpenAI)

Stories, weekly quests, equipment and spells are generated with the OpenAI API. For this, the app sends the following to OpenAI: your character name, character class, story progress, quest feedback and the fitness profile data relevant for training (goals, fitness level, preferred workout types and days, available equipment and, if you entered them, health conditions and injuries). Your email address, photos and Apple Health or Health Connect data are not sent. According to OpenAI, data sent via the API is not used to train their models and is deleted after at most 30 days.

6. Service providers (processors)

Google Firebase

We use Firebase by Google (Google Ireland Ltd. / Google LLC) for Authentication, Cloud Firestore and Realtime Database (database), Cloud Storage (photos), Cloud Functions (backend logic), Cloud Messaging (push notifications), Crashlytics (crash reports), Performance Monitoring and Google Analytics for Firebase (usage statistics). More information: Firebase Privacy

Supabase

Supabase Inc. hosts the database for social features (friends, guilds, challenges, community plans, reviews, in-app notifications). More information: Supabase Privacy Policy

OpenAI

OpenAI, L.L.C. generates AI content (see section 5). More information: OpenAI Privacy Policy

RevenueCat

RevenueCat Inc. manages subscriptions and in-app purchases and receives an app user ID and purchase data. More information: RevenueCat Privacy Policy

Google AdMob

For users without a subscription, Google AdMob shows banner and interstitial ads. Google processes device information, IP address and, on Android, the advertising ID to deliver ads, limit their frequency and measure them. On iOS the app does not request permission to track you (App Tracking Transparency), so the iOS advertising identifier is not accessed. You can reset or limit the advertising ID in your device settings. More information: How Google uses data in ads

Apple / Google Sign-In

If you sign in with Apple or Google, their sign-in services pass your name and email address to Firebase Authentication. Their policies also apply: Apple, Google.

7. International data transfers

Some providers process data in the USA or other countries outside the EU. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers are based on that adequacy decision; otherwise they are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Device permissions

• Health / activity recognition: to read steps and calories (section 4).
• Camera and photos: for your profile photo and progress snapshots.
• Notifications: for quest reminders, guild and friend activity.

All permissions are optional and can be revoked in your device settings. The app remains usable without them, with the related features unavailable. Some game data is also stored locally on your device (local database) for offline use.

9. Retention and account deletion

We store your data as long as your account exists. You can delete your account at any time in the app under Settings → Delete account or by email. Your account and the associated data are then deleted within 30 days. Details on what is deleted and what is retained: Delete your DuoLeveling account. Crash reports are deleted automatically by Firebase Crashlytics after 90 days.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure of your data (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent at any time with effect for the future (Art. 7(3))
• lodge a complaint with a data protection supervisory authority (Art. 77)

To exercise these rights, contact hello@serhataltin.com.

11. Children

DuoLeveling is not directed at children. It is intended for users aged 16 and over. We do not knowingly process data of children under 16; if you believe a child has created an account, please contact us and we will delete it.

12. Security

All data is transmitted encrypted via HTTPS/TLS. Database security rules restrict access to your data to your account and, for social features, to the players you interact with.

13. Changes

We may update this policy from time to time. Changes are published on this page; for significant changes we will inform you in the app.