Privacy policy

Who is responsible

ViralHit can be reached at hello@viralhit.app. Any request about your data goes to that address and is answered within one month.

What we collect

• Your email address: it is used to send your six-digit sign-in code. There is no password.
• Your nickname and avatar: what your opponents and viewers see.
• Your date of birth: it is used to apply age rules. It is stored separately from your profile, never shown to anyone, and never included in an export.
• Your country: it sets the rules that apply to your account.
• Your scores, duels, Volts and relationships (friends, invitations, blocks).
• The device label used to open a session, so you can recognise and close a session.

The camera

Your movements are analysed on your phone. The image does not leave the device: only body points, with no pixel and no face, are used to count your reps.

A low-resolution technical video may be kept for up to 24 hours to verify a score, and only if you accepted it. If you decline, you still play: your duels are friendly and unranked.

Reporting someone, and writing to us

A report opens a case in our database, with a reference the app gives you. What you write stays there: the email that alerts the team carries only that reference and the reason, never your comment and never anyone’s identifier.

The case is erased thirty days after it is opened. It outlives the deletion of the account that opened it, because it also concerns someone else: what disappears then is the identity of the person who reported, not the case.

A message sent from "Write to us" opens no case and is recorded nowhere. It goes to the team by email with your nickname, your account address for the reply, and the app version.

For how long

• Technical verification video: 24 hours at most.
• Shareable clip: 7 days.
• Report evidence: 30 days after the case is opened, then erased automatically, unless the law requires otherwise.
• Results and Volts: until you delete your account.
• Sign-in code: 10 minutes. It is stored as a hash, never in clear text.

On what legal basis

Providing the service, that is opening your session and keeping your scores, duels and relationships: performance of our contract, article 6(1)(b).

Verifying a score with a technical video, sending you notifications, receiving news: your consent, article 6(1)(a). Each is given separately, and withdrawn as easily as it is given, from Settings.

Applying age rules and preventing abuse: legal obligation and legitimate interest, articles 6(1)(c) and 6(1)(f).

Who else has access

The providers below act on our behalf and on our instructions. They are listed because they actually receive something, not because they appear in a contract.

• Resend, to deliver emails: your sign-in code, and the message you send us from "Write to us". Receives your email address. Hosted in the European Union.
• Netlify, to host the website and the challenge pages. Receives your browser IP address, as any host does. US company: transfers covered by standard contractual clauses.
• Supabase, for the database. Holds your account, your scores and your relationships. Hosted in the European Union.
• Railway, to host the game server, which receives what the app sends it. US company: transfers covered by standard contractual clauses.
• Expo, to deliver notifications once you have accepted them. Receives your phone token and the notification text. US company: transfers covered by standard contractual clauses.
• Google, for the pose detection model your phone downloads before your first duel. Receives your phone IP address at that moment, and nothing else: counting happens on your side.
• LiveKit, for streaming the live session between players and their viewers. Your video is only sent if **both players** have agreed to be seen, and either can withdraw. Receives your image and your phone IP address during the duel, for as long as it takes to pass it on, and does not record it. US company: transfers covered by standard contractual clauses.
• jsDelivr, for the counting engine your phone downloads the same way, on the same terms.

What we do not do

Your data is not sold, rented, or used for targeted advertising. The website sets no tracker and loads no font or script from anywhere else: that is why there is no banner to accept.

No automated decision is made about you within the meaning of article 22.

Your rights

You can view and export your data from Settings, "My data" (GDPR art. 15 and 20). Your exact date of birth is not included: it lives in a separate space, and an export must not become a back door.

You can delete your account from the same page. Deletion revokes every session and erases your profile.

For anything else, write to hello@viralhit.app. You may also contact your data protection authority.

Age

ViralHit is open from age 16. Under 18, the account is private: no public search, no random contact.