This policy explains how personal data is processed when you use the Pandasana mobile application (the "App") and the pandasana.app website. It is drafted to meet the transparency requirements of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the EU GDPR.
Summary (the full policy below governs):
· Your camera is analysed on your device; nothing it sees ever leaves your phone.
· Playing never requires an account. Without one, we hold no data about you at all.
· If you sign in, we store the minimum needed for leaderboards and profiles, and you can delete all of it, in the App, at any time.
· No advertising, no tracking, no sale of data. Ever.
The controller of personal data processed as described in this policy is
Telaris Technology Limited, a company registered in England and Wales
(company number 17254762, registered office Flat 206, 8 Hawthorne Crescent, London SE10 9GQ), trading
as "Pandasana" (referred to as "we", "us",
"our").
Contact: support@pandasana.app.
This policy covers the App and the pandasana.app website. It does not cover the independent processing carried out by Apple or Google as operators of their app stores and payment systems, which is governed by their own privacy policies.
3.1 With your permission, the App uses your device's camera to estimate your body pose during practice so it can score how closely you match each reference pose.
3.2 All camera processing is performed entirely on your device by a machine-learning model embedded in the App. Camera frames and the pose estimates derived from them are processed transiently in memory and are never recorded, stored or transmitted — not to us, and not to any third party. No image, video or biometric data leaves your phone, and none is used to identify you.
3.3 The camera is optional. Every class functions as a guided practice with the camera disabled, and camera permission can be revoked at any time in your device settings.
We process no personal data on our servers. Your plan, streaks, scores, settings and history exist only on your device and are deleted when you delete the App.
An account exists solely to enable leaderboards, public profiles and synchronised scored sessions. If you sign in (with Apple, or by email one-time code) we process:
| Data | Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|---|
| Email address; unique account ID | Account creation, authentication, security | Contract (Art. 6(1)(b)) |
| Username; optional display name; experience level; timezone | Your leaderboard identity and profile | Contract (Art. 6(1)(b)) |
| Scored practice sessions (pose, score, stars, duration, timestamp) | Leaderboards, personal bests, rankings | Contract (Art. 6(1)(b)) |
| Subscription status (Pro yes/no, product, expiry — no payment details) | Delivering paid features across devices | Contract (Art. 6(1)(b)) |
| Security and integrity signals (e.g. request timestamps for rate-limiting and anti-cheat validation) | Preventing fraud and score manipulation | Legitimate interests (Art. 6(1)(f)) — fair leaderboards |
Session scores are game metrics. We do not use them to draw inferences about your health, and we do not process special category data within the meaning of Art. 9 UK GDPR.
Purchases are made through, and processed by, Apple or Google. We never receive your payment details. We use RevenueCat, Inc. to validate subscription receipts; RevenueCat receives your purchase receipt and account identifier for that purpose (legal basis: contract).
We may process crash reports and aggregated, pseudonymised usage events (for example, "a class was completed") to fix defects and improve the Service (legal basis: legitimate interests in maintaining and improving the App). These never include camera data or the content of your practice. You will find the current, accurate declaration of any analytics in the App's App Store privacy label.
If you email us, we process your email address and the content of your message to respond (legal basis: legitimate interests). Support correspondence is retained for up to 24 months.
The pandasana.app website is a static site. It sets no cookies and runs no analytics. It is served by Cloudflare, whose infrastructure logs (IP addresses, request metadata) are processed for security and delivery purposes as described in Cloudflare's own policies.
5.1 If you create an account and post scores, your username, display name, scores, rankings and hold durations are publicly visible on leaderboards and on your profile page within the App.
5.2 You may set your profile to private at any time in the App, which immediately removes you from all public leaderboards and hides your profile.
We share personal data only with the service providers that operate parts of the Service on our behalf, under contracts imposing data-protection obligations:
| Provider | Role | Location of processing |
|---|---|---|
| Supabase, Inc. | Database, authentication and API hosting | United Kingdom / EU (London region) |
| RevenueCat, Inc. | Subscription receipt validation | United States |
| Apple Inc. / Google LLC | App distribution, payment processing, sign-in (Apple) | Per their own policies |
| Cloudflare, Inc. | Website hosting and email routing for support@pandasana.app | Global edge network |
We do not sell personal data, share it with data brokers, or disclose it to third parties for advertising. We may disclose data where required by law or to establish, exercise or defend legal claims.
Account data is stored in the United Kingdom/EU. Where a provider processes data outside the UK/EEA (for example, RevenueCat in the United States), the transfer is safeguarded by recognised mechanisms — an adequacy decision (including the UK–US Data Bridge / EU–US Data Privacy Framework, where the provider is certified) or standard contractual clauses with the UK addendum.
| Data | Retained |
|---|---|
| Account, profile, sessions, subscription status | Until you delete your account (deletion is immediate and permanent), or within 30 days of an emailed deletion request |
| On-device data (plan, streaks, settings) | On your device only, until you erase it in the App or delete the App |
| Support correspondence | Up to 24 months after the matter closes |
| Aggregated statistics that identify no one | May be kept indefinitely |
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS), encrypted credential storage on device, row-level access controls in our database so that each account can only read what it is entitled to, and server-side validation of submitted scores. No system is perfectly secure; we cannot guarantee absolute security, but we review our measures on an ongoing basis.
10.1 Under the UK GDPR (and, where it applies, the EU GDPR) you have the right to:
10.2 To exercise any right, use the in-App controls or email support@pandasana.app. We respond within one month. We do not discriminate against you for exercising your rights.
10.3 You have the right to lodge a complaint with your supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU, the authority of your member state. We would appreciate the chance to address your concern first.
Pandasana can be enjoyed at any age: playing the App requires no account and involves no collection of personal data by us whatsoever. Accounts (used only for public leaderboards and profiles) may not be created by anyone under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us personal data, contact us and we will delete it.
We do not carry out automated decision-making producing legal or similarly significant effects. Automated score validation affects only the acceptance of individual game scores onto leaderboards; you may contact us to contest a rejected score.
We may update this policy from time to time. The current version, with its effective date, is always published at pandasana.app/privacy. We will give notice in the App of material changes before they take effect.
Telaris Technology Limited, trading as Pandasana
Registered in England and Wales, company number 17254762
Registered office: Flat 206, 8 Hawthorne Crescent, London SE10 9GQ
Email: support@pandasana.app