Privacy Policy
Who is responsible for your data
The data controller for deFITnitive is SOMNI GAME STUDIOS, S.L. (“SOMNI”, “we”, “us”), with Tax ID (CIF) B22550214 and registered address at Calle Rivera Sans, 5, 43890 Vandellòs i l'Hospitalet de l'Infant, Tarragona, Spain. You can reach us for any privacy question at hola@somnigamestudios.com.
What this policy covers
This Privacy Policy explains how we handle personal data when you visit this waitlist landing page, create a deFITnitive account, use the daily missions and leaderboard, and participate in the “deFITnitive Founders Challenge” promotion (the “Promotion”) described in our Official Rules. It also covers the future deFITnitive app, which will reuse the same account and the same data-handling principles described here.
Data we collect
We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Account & identity | Email address, Firebase user ID, whether your email is verified, sign-in method (Google or passwordless email link), username, chosen Blob, language. |
| Gameplay & ranking | Power score, Arcade Ticket balance, leaderboard rank, referral code, who referred you, daily/weekly mission progress and completion timestamps. |
| Consent & preferences | Whether you opted in to the optional daily reminder and to marketing emails, and when. |
| Campaign origin | If you arrived through an ad or campaign link: its tags (utm parameters and the Meta click id), stored on your account to credit that campaign. We keep the utm tags to ourselves. The Meta click id is also sent to Meta with the advertising events described below, but only if you accepted advertising cookies; if you declined, none of it reaches Meta. |
| Technical & anti-fraud signals | Server-side timestamps, request metadata and activity patterns we use to detect multi-accounting, bots and fraudulent referrals (see Official Rules, section 13). We do not publish the exact signals used, to keep them effective. |
| Prize-winner data | For the small number of winners only: identity document, residence, bank account ownership and tax information. |
| Movement data | Derived exercise results only — see “Camera and movement data” below. We never collect the camera image or video itself. |
Camera and movement data
deFITnitive tracks exercises — such as squats, push-ups, jumping jacks, skipping and burpees — using your device's camera and Google's MediaPipe Pose Landmarker (based on BlazePose), running entirely on your own device.
- Your camera image and video are processed locally on your device and are never uploaded, transmitted, or stored by us, in any form.
- We only receive the derived result of that processing: which exercise you did, how many valid repetitions were counted, the session's date, time and duration, and the resulting score. That is what “movement data” means throughout this policy.
- Camera access always requires your device's own browser permission prompt; we do not access your camera without it.
MediaPipe may send Google technical performance and API-usage metrics under Google's own terms and privacy policy; this does not include your camera feed. deFITnitive estimates repetitions and performance for gameplay purposes only. It is not a medical device, does not perform clinical posture analysis, and does not diagnose, treat or prevent any injury or condition.
Why we process your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, the waitlist, missions, the leaderboard, referrals and Arcade Tickets | Performance of the contract formed when you join (Art. 6(1)(b) GDPR) |
| Run the Promotion, validate and pay winners | Performance of the contract formed by the Official Rules, plus legal obligations around prize payouts and taxation |
| Detect fraud, multi-accounting and abuse; keep the ranking fair and the service secure | Our legitimate interest in the integrity and security of the Promotion and the service |
| Send you the account and Promotion emails described below that are not marketing | Performance of the contract / our legitimate interest in keeping you informed about a service and a promotion you actively joined |
| Send you the optional daily reminder, or news and offers about deFITnitive | Your consent, given separately for each, which you can withdraw at any time (see “Emails we send you”) |
| Understand how the site is used, through product analytics that set no cookies and store nothing on your device | Our legitimate interest in improving the service (PostHog, hosted in its EU cloud) |
| Measure the performance and attribution of our Meta ad campaigns, understand whether those ads lead to meaningful use of deFITnitive, and optimize those campaigns | Your consent, given in the cookie banner and withdrawable at any time (see the Cookies Policy) |
| Keep accounting, tax and anti-fraud records for as long as the law requires | Legal obligation |
Emails we send you
We use the email address on your account for two clearly separate kinds of messages.
Account and Promotion emails (not marketing, no opt-in needed). Because you created an account and, while the Promotion is active, are participating in it, we send the emails needed to run that relationship, including: the passwordless sign-in link itself; a welcome/confirmation email when you join; important updates about the Promotion or your account; anti-fraud or security notices if we need to review your account (Official Rules, section 13); and, once the Promotion ends, a result email — a winner-confirmation email to prize winners, and a “you did not win this time” email to everyone else who took part. These are sent regardless of whether you ticked either box below, because they are necessary to run the account and the Promotion you joined, not to promote anything to you.
Optional emails (only if you tick the box, off by default). Two separate, optional checkboxes control everything else:
- Daily reminder — “Send me one daily reminder so I don't miss points or drop in the leaderboard.” Only sent if you check this box when you join, and you can turn it on or off at any time with the reminder toggle on your missions page.
- News and offers — “Send me news and offers about deFITnitive by email.” Only sent if you check this box. Only the email addresses of people who check this box are synced to our email/CRM provider (Brevo) for that purpose; if you never check it, or later withdraw it, your email is never added to — or is removed from — that marketing list.
You can withdraw either optional consent at any time by emailing hola@somnigamestudios.com, and every marketing email includes an unsubscribe link. Withdrawing consent does not affect the lawfulness of anything sent before you withdrew it, and does not stop the non-marketing account/Promotion emails described above.
Who we share data with
We use the following processors, under contracts that require them to protect your data and act only on our instructions:
- Google Firebase (Authentication, Firestore database, Cloud Functions) — hosts your account and gameplay data, in the
europe-west1(Belgium, EU) region. - Brevo SAS — our email/CRM provider, used to deliver the optional marketing emails described above, and only for the accounts that consented to them.
- Google MediaPipe — runs on your own device to power camera-based exercise tracking; see “Camera and movement data” above.
- Google reCAPTCHA (through Firebase App Check) — checks that requests reaching our servers come from a real person and not from a bot; see “Anti-abuse verification (reCAPTCHA)” below.
- PostHog (hosted in its EU cloud): product analytics running in cookieless mode; it stores nothing on your device and we do not use it for advertising.
- Meta Platforms Ireland Limited: only if you accept advertising cookies in the consent banner, it receives events about your use of deFITnitive through the Meta Pixel and the Conversions API so we can measure the performance and attribution of our ad campaigns, understand whether they lead to meaningful use of deFITnitive, and optimize them; your email address and account id are sent only as hashes, and each event also carries technical information about your device and browser, including your IP address, an identifier that keeps the same event from being counted twice, and Meta's own advertising identifiers for your browser and for the ad you clicked; see the Cookies Policy. If you decline, the Meta script never loads and nothing is sent to Meta.
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We only disclose the minimum necessary data to the supplier we buy a prize from, and only to buy and deliver that prize if you win it. The public leaderboard shows the information the app displays for your account, and never your email, real name or any other personal data (Official Rules, section 12).
Anti-abuse verification (reCAPTCHA)
To keep bots, scripted sign-ups and automated attempts to farm Power, Arcade Tickets or referrals out of the Promotion, this site and the Cloud Functions behind it are protected by Google reCAPTCHA v3, wired in through Firebase App Check. reCAPTCHA runs invisibly: there is no puzzle to solve and nothing extra for you to do.
- While it runs, reCAPTCHA collects information about your device and browser — hardware and software characteristics, your IP address, and how you interact with the page — and sends it to Google, which returns a score indicating how likely it is that the request came from a real person.
- The verification result reaches us only as a pass/fail attestation (an App Check token), which we use to allow or block the request. We do not use it to profile you, to target advertising, or for any purpose other than security and abuse prevention.
- reCAPTCHA sets a necessary cookie (
_GRECAPTCHA) for the sole purpose of that risk analysis. - Our legal basis is our legitimate interest in the integrity and security of the Promotion and the service — the same basis as the anti-fraud row in the table above.
Google states that it processes this information only as necessary to provide and maintain reCAPTCHA and to keep its security, threat-detection and abuse-prevention capabilities effective, and not for other purposes such as personalized advertising.
International transfers
Our processors are established in the EU/EEA (Firebase's data for this project is hosted in europe-west1, Belgium; Brevo SAS is a French company; PostHog hosts our analytics in its EU cloud; Meta Platforms Ireland Limited is an Irish company) or provide appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for any transfer outside the EEA.
How long we keep your data
We keep account and gameplay data for as long as your account is active, plus a reasonable period afterward to resolve disputes, prevent fraud and meet legal obligations. Winners' identity, banking and tax documentation is kept for as long as Spanish tax and accounting law requires. If you never consented to marketing emails, your email address is never added to our CRM tool in the first place. If you withdraw marketing consent, we keep a record of that withdrawal so we do not contact you again, and remove you from the active marketing list.
Your rights
Under the GDPR and Spanish data protection law, you can ask us, at any time and free of charge, to: access the data we hold about you; correct it; delete it; restrict or object to its processing; receive a portable copy of it; and withdraw any consent you gave, without affecting past processing. To exercise any of these rights, email hola@somnigamestudios.com from the address linked to your account. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the data protection authority in your own country.
Minors
deFITnitive is open to people aged thirteen (13) or older. If you are below the legal age of majority in your country, a parent, guardian or legal representative must authorize your account and, if you win a prize, must accept and manage it on your behalf. See Eligibility Requirements and Official Rules, section 5.
Security
Your gameplay data is server-authoritative: no Power, ticket, rank or referral value can be created or changed directly from your browser — every change is validated and written by our Cloud Functions, and Firestore denies every direct write from a client. We apply reasonable technical and organizational measures to protect your data, but no system is completely secure, and we cannot guarantee absolute security.
Changes to this policy
We may update this Privacy Policy as the service evolves — for example, when the deFITnitive app launches. The version and effective date are shown at the top of this page. If a change is material, we will highlight it on the site or notify you by email before it takes effect.
Contact
Questions about this policy or your data: hola@somnigamestudios.com.
See also Official Rules, Eligibility and Terms of Service.