Privacy & Data Processing Policy

1. Who we are (Data Controller)

Cardio Critters (“the App”, “we”) is a running game with a virtual pet, developed and operated by Santiago Moreno Benavides, a natural person and independent developer residing in Colombia, acting as the Data Controller of the personal data.

• Privacy / Habeas Data email: [email protected]
• Contact person for data matters: Santiago Moreno Benavides (the developer). Because the service is operated by a natural person, no formal DPO is appointed: the Controller is directly the point of contact.
• Website: https://cardiocritters.com
• Official channel for privacy and Habeas Data rights: the email address above.

This policy explains what personal data we collect, for what purpose, with whom we share it, how long we keep it, and what rights you have over it. It applies to the iOS app (and future Android versions), the public landing page, and the admin backoffice.

2. Guiding principle

We designed Cardio Critters around the principle of data minimization: we collect strictly what is needed for the game to work and for your virtual pet to respond to your physical activity. In particular:

• Your GPS route never leaves your phone. We use location only, and in real time on the device, to compute the distance and pace of your run. We do not send or store the coordinates, the route, or the map of your run on our servers — we only keep aggregated metrics (total distance, duration, pace, estimated calories).
• We do not use third-party advertising or analytics SDKs (no trackers, no advertising identifiers, no profiling for marketing purposes).
• We do not sell your personal data to anyone.
• We do not process payments within the app: the game economy (“energy”) is virtual and earned by running; there are no real-money purchases or card data.

3. Data we collect

3.1. Account and identity data

Managed through our authentication provider Clerk (see §6):

• Email address (required to create the account).
• Password — managed and stored by Clerk in encrypted form; we never see or store your password.
• Display name.
• Phone number — only if you enable two-factor authentication (2FA) via SMS.
• Authentication metadata (session state, email verification, MFA factors).

Internally, our backend only stores an internal identifier (usr_…) and the Clerk reference; the rest of the identity lives in Clerk.

3.2. Profile and preference data

• Selected avatar, short bio (optional).
• Language (locale) and time zone (timezone) — the latter is needed to correctly compute streaks and the pet's daily decay.
• App settings: notifications on/off, reminder time, units (metric/imperial).

3.3. Physical activity data (sensitive data)

We treat the following as sensitive health/fitness data:

• For each run: distance, duration, pace, estimated calories, date and time.
• Derived/cumulative data: total kilometers, number of runs, energy generated, streaks, best distance.
• Precise location (GPS): location permission is requested (including in the background so tracking isn't interrupted while you run) and is processed exclusively on your device to measure the run. We do not transmit or retain the trace or the coordinates.

3.4. Game and progress data

• Pet(s), their states (hunger, mood, health), level and XP.
• Inventory, buffs, missions, achievements, energy wallet.

3.5. Technical and notification data

• Push notification token (Firebase Cloud Messaging registration token) and the device platform (iOS/Android, for delivery/observability purposes only).
• “Last active” marker (last_active_at).
• Minimal server logs: as a matter of policy, our logs and our event log do not contain identifiable personal data — only the internal identifier usr_…, the action, and the latency. The IP address is transiently processed by the edge infrastructure (Cloudflare) to deliver and protect the service from abuse; we do not store it in our game database.

3.6. Data we do NOT collect

• GPS coordinates / routes / maps of your runs (they never leave the device).
• Card or payment data (there are no real-money purchases).
• Heart rate or other HealthKit/wearable data (not implemented in this version).
• Advertising identifiers (IDFA, AAID) or data for advertising or profiling.

4. Purposes of processing

We use your data to:

1. Provide the core service: create and maintain your account, compute the energy/XP from your runs, keep your virtual pet alive, and sync your progress across sessions and devices.
2. Game functionality: streaks, missions, achievements, virtual shop, inventory, and in-game notifications.
3. Notifications: run reminders, pet status alerts, ready missions, and rewards (you can turn them off).
4. Security and abuse prevention: authentication, fraud/idempotency control, integrity of the game economy.
5. Support and operational communication with you.
6. Compliance with legal obligations and handling of rights requests.
7. Product improvement based on aggregated, non-identifiable data (we do not use individual analytics with trackers).

We do not process your data for targeted advertising, nor do we transfer it to third parties for commercial purposes.

5. Legal basis for processing (GDPR / equivalent laws)

6. Who we share data with (Processors / third parties)

We share data only with providers acting as Data Processors under contract, and only as needed to operate:

We may also disclose data when required by law, a court order, or a competent authority, or to protect the rights, safety, and integrity of the service.

7. International transfers

Your data may be processed outside your country (mainly in the USA and across our providers' global edge network). When this happens, we rely on valid transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs), adequacy decisions, and/or your informed consent. For users in Colombia, transfers are carried out in accordance with Law 1581 of 2012 and its implementing decrees.

8. Data retention

• We keep your data while your account is active.
• When you request deletion, we first apply a soft delete (the account is marked as deleted and becomes inaccessible) and then a permanent purge of the data we are not required to keep for legal or security reasons.
• System event logs (without PII) and aggregated data may be kept for a limited time for auditing, security, and statistics.

9. Security

We apply reasonable technical and organizational measures: encryption in transit (HTTPS/TLS), delegated token-based authentication (JWT), managed storage on edge infrastructure, least-privilege access for administrative access (super_admin role), and a strict zero-PII policy in logs and notifications. No system is 100% infallible; in the event of a security breach affecting your data, we will notify the competent authority and the affected users within the applicable legal timeframes.

10. Your rights

Depending on your jurisdiction, you have the right to:

• Access your data and obtain a copy.
• Rectify / update inaccurate data.
• Erase / delete your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Portability of your data.
• Withdraw consent at any time (without affecting the lawfulness of prior processing).
• Lodge a complaint with the competent supervisory authority.

How to exercise them: write to [email protected] stating your request and a means to verify your identity. We will respond within the legal timeframes (see Part II for Colombia's timeframes; generally up to 30 days under GDPR/equivalents).

11. Minors

The content of Cardio Critters is suitable for all audiences (it contains no inappropriate material). However, the App is not designed for or directed at children: because it requires creating an account and processes physical activity (sensitive) data, the following rules apply:

• We do not knowingly collect personal data from children under 13 (in line with COPPA). The App is not oriented toward that group.
• Minors (ages 13 to 17) may only use the App and create an account with the involvement and authorization of a parent or legal guardian, especially for consent to the processing of physical activity data.
• If we detect an account belonging to a child under 13, or to a teenager without valid authorization from their legal guardian, we will delete it. If you are a parent or guardian and believe a minor has provided us data, write to the email above and we will proceed with its deletion.

12. Changes to this policy

We may update this policy. We will publish the current version at https://cardiocritters.com/legal/privacy with its “Last updated” date. If the changes are substantial, we will notify you by reasonable means (in-app notification or email) and, where the law requires, we will request your consent again.

13. Contact

Santiago Moreno Benavides — independent developer and Data Controller · [email protected] · https://cardiocritters.com

1. Data Controller

• Controller: Santiago Moreno Benavides (natural person — independent developer)
• Country: Colombia
• Email (electronic contact address and official Habeas Data channel): [email protected]
• Website: https://cardiocritters.com
• Handling of requests, inquiries, and complaints: directly by the Controller, via the email indicated.

Note: as this is a natural person, an electronic address (email) is designated as the means of contact, as permitted by the Habeas Data regime; no physical address is published.

2. Definitions (art. 3, Law 1581)

Data Subject: the natural person whose personal data is being processed (the user). Sensitive data: data affecting privacy or whose misuse may lead to discrimination (here, the physical activity and health data). Processing: any operation on personal data (collection, storage, use, circulation, deletion). Processor: the party that processes data on behalf of the Controller (see Part I §6).

3. Data processed

Those described in Part I §3: identification and contact data (email, name, optional phone), profile and preference data, sensitive physical activity data, game/progress data, and technical device data. We reiterate that GPS geolocation is not stored on servers; it is only processed on the device.

4. Purposes

Those described in Part I §4. The processing of sensitive data (physical activity/health) is carried out with the Data Subject's prior, express, and informed authorization and is optional: the Data Subject is not required to authorize the processing of sensitive data, although without it the core game function (measuring runs and keeping the pet alive) cannot operate.

5. Rights of the Data Subject (art. 8, Law 1581)

1. Know, update, and rectify their data.
2. Request proof of the authorization granted.
3. Be informed about the use given to their data.
4. File complaints with the Superintendence of Industry and Commerce (SIC) for violations.
5. Revoke the authorization and/or request deletion of the data where applicable.
6. Access their personal data free of charge.

6. Procedure for inquiries and complaints

• Channel: [email protected] (official Habeas Data channel).
• Inquiries: handled within a maximum of ten (10) business days; if not possible, the Data Subject is informed and it is handled within the following five (5) business days.
• Complaints: maximum term of fifteen (15) business days from the day after receipt; if not possible, the subject is informed and it is resolved within the following eight (8) business days. Incomplete complaints may be returned for correction within the five (5) days following receipt.

7. Authorization

The Controller obtains the Data Subject's authorization at the time of registration through express acceptance. The authorization is recorded with date/time and the version of the accepted document, as proof that it was granted.

8. Security measures and Processors

See Part I §6 and §9. Processors handle data under contract and in accordance with this policy.

9. Validity of the policy and databases

This policy is in force as of June 25, 2026. Data is retained while the account is active and for the applicable legal timeframes (see Part I §8). Any substantial change will be communicated through the channels indicated.

1. Acceptance of these Terms

These Terms of Service (“Terms”) govern your use of Cardio Critters (“the App”, “the Service”). By creating an account or using the App you accept them in full. If you do not agree, do not use the Service.

This Part III is in force as of August 31, 2026. Parts I and II above govern how we handle your personal data and form part of your agreement with us.

2. Who can use Cardio Critters

You must be old enough to hold an account under the rules described in Part I §11. If you are a minor in your country of residence, you may only use the Service with the consent and supervision of a parent or legal guardian, who accepts these Terms on your behalf.

You must also be legally able to enter into a binding agreement and not be barred from doing so under applicable law.

3. Your account

• You may sign up with an email address and password, or with a third-party identity provider (such as Google or Apple). Authentication is handled by our identity provider, as described in Part I §6.
• You are responsible for keeping your credentials secure and for all activity carried out through your account.
• The information you provide must be accurate. Impersonating another person is not permitted.
• One person, one account. Creating multiple accounts to gain an advantage in the game is not permitted.
• Tell us promptly at [email protected] if you believe your account has been compromised.

4. What Cardio Critters is — and what it is not

Cardio Critters is a game. You run, and a virtual pet responds to your physical activity. That is the whole purpose of the Service.

It is not a medical device, nor a health, medical, or training service. Nothing in the App is medical advice, diagnosis, or treatment, and it must not be used as a substitute for the judgment of a qualified health professional. Distances, paces, durations, calories, and any other figures shown are estimates produced by your device's sensors or by the health platform you connect, and may be inaccurate.

Do not make health decisions based on what the App shows you. If you have any doubt about your fitness to exercise, consult a physician before you start.

5. Physical activity and your safety

Running carries inherent risks. You take part in physical activity at your own risk and remain solely responsible for your own safety.

• Pay attention to your surroundings, traffic, and terrain. Do not interact with the App while it is unsafe to do so.
• Obey all traffic laws and local regulations, and respect private property.
• Stop immediately if you feel pain, dizziness, or discomfort, and seek medical help if needed.
• Nothing in the game — streaks, missions, rewards, or your pet's condition — is a reason to exercise beyond your limits, in unsafe conditions, or against medical advice. Your pet is not real. Your health is.

6. Acceptable use

When using Cardio Critters, you agree not to:

• Use the Service for any unlawful purpose, or in breach of these Terms.
• Attempt to access accounts, data, or systems that are not yours.
• Interfere with, overload, or disrupt the Service or its infrastructure.
• Reverse engineer, decompile, or attempt to extract the source code of the App, except where applicable law expressly allows it.
• Use bots, scrapers, or automated systems to interact with the Service.
• Copy, redistribute, sell, or create derivative works from the App or its content without our written permission.
• Upload a display name, biography, or image that is offensive, misleading, infringing, or that impersonates someone else.

7. Integrity of activity data

The game rewards real physical activity. Falsifying that activity is a material breach of these Terms. In particular, you agree not to simulate or manipulate location, motion, or step data, use GPS spoofing tools or emulators, submit activity that is not yours, or exploit bugs to obtain energy, items, or rewards you have not earned.

Where we detect activity that is implausible or manipulated, we may disregard the affected session, adjust the resulting balances, or apply the measures in §12.

8. Energy, items, and virtual content

• Energy, items, buffs, cards, achievements, and any other in-game element have no monetary value, are not your property, and are not convertible into money, goods, or services outside the game.
• They are granted to you as a revocable, non-transferable, non-sublicensable licence to use them within Cardio Critters.
• They cannot be sold, exchanged, or transferred to other people or accounts.
• Game balance is part of the design. We may adjust, rebalance, or discontinue any in-game element, including costs, rewards, drop rates, and the rules of progression, without that giving rise to compensation.
• If your account is closed, any associated virtual content is lost and is not reimbursed.

9. Intellectual property

The App, its code, design, art, Critters, names, brands, sounds, texts, and all its content are owned by the developer or are used under licence, and are protected by intellectual property law.

We grant you a personal, limited, non-exclusive, non-transferable, revocable licence to install and use the App on devices you own or control, solely for your personal, non-commercial enjoyment. No other right is granted to you.

10. Content you provide

You keep ownership of the content you submit — display name, biography, and profile choices. You grant us a non-exclusive, worldwide, royalty-free licence to store, reproduce, and display that content, strictly for the purpose of operating the Service (for example, showing your profile inside the App).

You are responsible for that content and warrant that you have the right to provide it. We may remove content that breaches these Terms.

11. Third-party services and app stores

• The Service relies on third-party providers listed in Part I §6 — among them our identity provider and, where you choose to connect them, Apple Health or Health Connect. Their own terms and privacy policies apply to your relationship with them.
• Connecting a health platform is always optional and you may revoke it at any time from your device settings.
• The App is distributed through the Apple App Store and Google Play. Those stores are not parties to these Terms and are not responsible for the App or its content. Your use is also subject to the applicable store rules.
• Where the App is obtained from the Apple App Store, Apple has no obligation to provide support or maintenance for the App, and Apple and its subsidiaries are third-party beneficiaries of these Terms, entitled to enforce them against you.

12. Availability, suspension, and termination

• We work to keep the Service available, but we do not guarantee that it will be uninterrupted or error-free. We may modify, suspend, or discontinue features, and carry out maintenance, at any time.
• You may close your account at any time, from within the App or by writing to us. See Delete account and Part I §8 for what happens to your data.
• We may suspend or close your account if you materially breach these Terms — in particular §6 and §7 — or where required to protect the Service or other users. Where reasonable and lawful, we will tell you why.
• If we discontinue the Service entirely, we will give notice through the channels in §14 with reasonable notice where possible.

13. Disclaimers and limitation of liability

To the fullest extent permitted by applicable law, the Service is provided “as is” and “as available”, without warranties of any kind as to accuracy, continuity, or fitness for a particular purpose.

We are not liable for injury, harm, or loss arising from your physical activity, nor for decisions you make based on estimates shown by the App, nor for failures of third-party services or your device, nor for loss of progress or virtual content caused by events beyond our reasonable control.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for wilful misconduct or gross negligence, or the rights granted to you as a consumer by mandatory consumer-protection law.

14. Changes to these Terms

We may update these Terms. Where a change is substantial, we will notify you through the App or by email before it takes effect, and — where the law requires it — we will ask you to accept the new version. Continuing to use the Service after a change takes effect means you accept it. The version and date at the top of this document always identify the text in force.

15. Governing law and jurisdiction

These Terms are governed by the laws of the Republic of Colombia, where the developer resides, without prejudice to the mandatory protections you enjoy as a consumer under the law of your country of residence. Disputes will be submitted to the competent courts of Colombia, save where mandatory law grants you the right to bring proceedings before the courts of your own domicile.

16. Contact

Questions about these Terms: [email protected].