Draft — not yet reviewed. Still to confirm: the controller’s name and address, the order-processing agreement with the email provider and the minimum age for the whole app.
Privacy policy
This is a translation. The German version (Datenschutzerklärung) is the binding one. · 2026-11-05
1. Who is responsible
The controller for the processing described here is:
- [NAME]
- [ADDRESS]
- Email: privacy@fightgame.ai
For any question about your data or to exercise your rights, write to privacy@fightgame.ai.
2. What this policy covers
fightgame.ai is a scouting and camp-preparation app for combat-sport fighters and coaches: fighter and opponent profiles, a scouting questionnaire, food tracking and training tracking with training plans. This policy covers the whole app. Below we list each kind of data, why we process it, the legal basis under the GDPR, who else receives it and how long we keep it.
3. Your account
To create and use an account we process your email address, your password (stored only as a hash by our authentication service, Supabase Auth), the times you sign up and sign in, and your sign-in session. We send you emails needed for the account, such as the sign-up confirmation and password reset, through IONOS SE, Germany, from the address noreply@fightgame.ai.
Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).
For each sign-in session, Supabase Auth stores the IP address and the browser identifier (user agent) it was started from, until you sign out or your account is deleted. Supabase keeps its platform logs for 7 days. Legal basis: our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).
4. Fighter profiles, opponents and the scouting questionnaire
Your own fighter profile can hold your name, a bio, weight class, height, reach, stance and fight record. You can also create profiles for opponents and answer the scouting questionnaire about yourself or an opponent (tendencies such as stance, preferred strikes or footwork).
Opponent profiles contain data about other people, entered by you. They are limited to sporting, publicly known information (such as fight record, weight class, stance and fighting style); please enter no private or health details. The opponent form says so.
Legal basis: for your own data, performance of the contract (Art. 6(1)(b) GDPR). For data about opponents, our and your legitimate interest in preparing for a fight, limited to sporting and public information (Art. 6(1)(f) GDPR).
5. Food tracking
When you use the food log we store what you log (date, meal, food, quantity, nutrients and an optional note), foods you create yourself, and diet plan texts for your camp phase.
If you scan a barcode, the camera image is processed only on your device; only the decoded barcode number is sent to our server. To find a product, our server asks Open Food Facts for that barcode or search term. Open Food Facts receives the barcode or search term from our server, not your name, account or IP address. Products found are stored in our shared food catalogue.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
6. Training data
When you use training tracking we store your training sessions and sets (exercises, loads, repetitions, durations, rounds, effort ratings and optional notes), benchmark results, exercises you create yourself, your training setup (sport, level, available days and session length, fixed club sessions, camp phase, fight date, goals, equipment and movements you exclude), your focus areas, your training plans and their versions, your confirmation that you are 18 or older, and your AI consent with its version and date. For AI plans we also log the number of tokens used and an estimated cost, never the content.
Training data can reveal information about your fitness and, in some cases, your health. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, because it may be health data, your explicit consent to storing it (Art. 9(2)(a) GDPR). You give this consent in your training setup (consent text version training-data@1); it is separate from the AI consent in section 7. Without it, no training data is saved.
You can withdraw this consent at any time in your training setup. Withdrawing it deletes your training data: sessions and sets, benchmark results, your training setup, focus areas, plans, the exercises you created, and your 18+ and AI consents.
We keep the records of your 18+ confirmation, your consent to storing training data and your AI consent (each with its date and version) as proof of consent for as long as your account exists, and delete them with it. Legal basis: Art. 6(1)(c) GDPR together with Art. 7(1) GDPR.
7. AI training planner
AI training plans are optional and only used with your consent (consent text version training-ai@2, in your training setup), given after your consent to storing training data (section 6) and your 18+ confirmation. When you ask for an AI plan, we send a pseudonymised summary of your training to Anthropic, which processes it on our behalf to generate the plan.
Sent:
- your sport
- level
- availability
- camp phase
- weeks to your fight
- equipment
- the movements you excluded
- your focus-area codes
- rounded weekly training totals
Never sent:
- your name
- account or profile IDs
- fight date
- free-text notes
- body weight
- anything about injuries or health
Anthropic may process the summary outside the EU (in the US or globally); there is no option to process it in the EU. This transfer is covered by the EU Standard Contractual Clauses in Anthropic’s Data Processing Addendum. Anthropic deletes API inputs and outputs within 30 days and does not use them to train its models. Anthropic’s subprocessors: https://www.anthropic.com/subprocessors.
You can withdraw your consent at any time in your training setup. Plans are then built by fixed rules only (the standard plan), and nothing is sent to Anthropic.
Legal basis: your consent (Art. 6(1)(a) GDPR) and, as far as the summary may concern health, your explicit consent (Art. 9(2)(a) GDPR).
8. Hosting, security and rate limiting
The app is hosted by Vercel (Vercel Inc., USA). Your requests first reach Vercel’s global network, which serves them from a location near you; the app’s server functions run in Vercel’s Dublin region (dub1, Ireland). Vercel processes the technical data of your requests (such as IP address, time and requested page) and keeps request logs for 1 day.
To protect the app from abuse we limit how many requests can be made in a short time. For this, only your IP address and, when you are signed in, your account ID are used as keys in Upstash (Upstash Inc., USA), a Redis service whose databases are in the EU (AWS eu-west-1, Ireland), with no copies in other regions. Only counters are stored under these keys, and they expire after their time window (60 seconds for most limits, 10 minutes for AI plan requests).
Legal basis: our legitimate interest in running the app securely and preventing abuse (Art. 6(1)(f) GDPR).
9. Usage statistics
We use Vercel Web Analytics to see how the app is used. It works without cookies and shows us aggregated page views, not individual users.
Legal basis: our legitimate interest in understanding how the app is used and improving it (Art. 6(1)(f) GDPR).
10. Processors and other recipients
These services process data on our behalf, or receive data as described:
| Service | What for | Where |
|---|---|---|
| Supabase | Database and authentication (all app data, your account) | Database in the EU (AWS eu-west-1, Ireland). Data processing agreement through Supabase’s terms; transfers to subprocessors outside the EU under the EU Standard Contractual Clauses. Subprocessors: https://supabase.com/legal/customer-resources/subprocessor-list |
| Vercel | Hosting, request logs, Web Analytics | Vercel Inc., USA. Server functions in the EU (dub1, Dublin, Ireland); requests are first received by Vercel’s global network near you. Transfers outside the EU under the EU Standard Contractual Clauses (2021). |
| Upstash | Rate limiting | Upstash Inc., USA. Databases in the EU (AWS eu-west-1, Ireland), no copies in other regions. Under Upstash’s data processing agreement, transfers outside the EU rely on the EU-US Data Privacy Framework, or on the EU Standard Contractual Clauses (2021) where the framework does not apply. |
| IONOS | Sending account emails (sign-up confirmation, password reset) | IONOS SE, Germany. Processing in Germany; no transfer outside the EU. [TO CONFIRM: IONOS order-processing agreement (AVV) in place for this contract.] |
| Anthropic | AI training plans, only with your consent (section 7) | Outside the EU (US or global), under the EU Standard Contractual Clauses |
| Open Food Facts | Product lookups by barcode or search term (not a processor; receives no personal data from us) | — |
We have a data processing agreement (Art. 28 GDPR) with each of these processors through its terms.
12. How long we keep data, and deletion
We keep your data for as long as you have an account. When your account is deleted, everything linked to it is deleted with it: your fighter and opponent profiles, questionnaire answers, food logs, your own foods and diet plans, your own exercises, all training data and plans, your consent records and the AI usage log.
The app has no delete or export button yet. To delete your account or get a copy of your data, write to privacy@fightgame.ai; we answer within one month (Art. 12(3) GDPR). Deleting your account removes all your data. Supabase makes daily backups and keeps them for 7 days (no point-in-time recovery), so deleted data is gone from the backups within 7 days.
Rate-limit counters expire after their time window (section 8). Anthropic deletes AI plan requests within 30 days (section 7). Hosting logs are kept as described in section 8.
13. Age
Training tracking and AI training plans are for adults only: you confirm that you are 18 or older in your training setup before you can give AI consent. [TO CONFIRM: minimum age for the rest of the app.]
14. Your rights
Under the GDPR you have the right to:
- access your data (Art. 15)
- have it corrected (Art. 16)
- have it deleted (Art. 17)
- restrict its processing (Art. 18)
- receive it in a portable format (Art. 20)
- object to processing based on legitimate interests (Art. 21)
- withdraw a consent at any time, with effect for the future (Art. 7(3)); for AI plans, in your training setup
- complain to a supervisory authority (Art. 77); ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
To exercise your rights, write to privacy@fightgame.ai. We answer within one month (Art. 12(3) GDPR).
15. Changes
We update this policy when the app changes. Version privacy@1, last updated 2026-11-05.