Who is responsible
FlapUps is provided by Alexander Mayle, trading as Abenteuergeist, Widenmayerstraße 11, 80538 München, Germany (“Abenteuergeist”, “we”, “us”). Questions and privacy requests can be sent to info@abenteuergeist.com.
What FlapUps does
FlapUps turns body movement into game controls. Its camera feature estimates your pose on your iPhone. Camera frames are processed in real time on your device. We do not record, store or upload camera frames, photos or video.
Data we process
Account and authentication
If you create an account with Apple or Google, we process an account identifier, your email address as provided by that service, your optional display name and authentication session information. Apple lets you hide your email address. Clerk provides our authentication infrastructure.
Game and fitness activity
We store your display name, player handle, game mode and course, scores, repetitions, active time, completion date, recent rounds, personal records, experience points, level and streaks in Convex. We use this information to provide your progress history and the game features you request. FlapUps does not write to or read from Apple Health.
Leaderboards and friends
FlapUps has a daily leaderboard. Your player handle, display name, best daily-course score and repetition count for that day are visible to other signed-in players. Handles are assigned automatically and can be changed in Settings; every handle you have used stays reserved for you. Invite links contain your handle. When another player accepts your link (or you accept theirs) you become friends and see each other’s daily scores, level and streak. The share card you can export contains your score, handle and invite link. Endless play, your full history and personal records remain private.
Product analytics
We use PostHog (PostHog Inc., hosted in the European Union) to understand how FlapUps is used and to fix problems: which screens you open, onboarding steps, rounds started and completed, scores, subscription and sign-in outcomes, invites and reminder settings, together with a device identifier generated by the app, app version, iOS version and device model. Analytics events are linked to your account identifier once you sign in. IP-based location is disabled. Analytics contain no camera frames, pose data or health inferences and are not used for advertising or cross-app tracking.
Subscriptions
Apple processes payments. RevenueCat receives an app user identifier, product identifiers, transaction and receipt information, and subscription status so that we can provide and restore paid access. We do not receive your full payment-card details.
On-device data
Your onboarding choices and checkpoint, cached subscription state, your reminder preference, a pending friend invite and any game result waiting to be uploaded are stored on your device. The optional daily reminder is a local notification scheduled on your iPhone; no push server is involved. A pending result is tied to your FlapUps account so it is not shown to another signed-in user.
Camera SDK diagnostics
QuickPose performs pose estimation on your device. For license validation, usage measurement and diagnostics, QuickPose may receive technical data such as your IP address, device type, model or identifier, app activity, timestamps and error details. QuickPose states that camera frames and personal images are not transmitted.
Support and sharing
If you contact support, we process the information you include in your message. FlapUps opens the iOS share sheet only when you tap Share; the destination you choose then processes the shared score text under its own terms.
Why we process data
We process account, game, progress and subscription information to perform our contract with you and provide FlapUps (Article 6(1)(b) GDPR). We process limited security, fraud-prevention, license-validation, reliability and product-analytics information for our legitimate interests in protecting, operating and improving the service (Article 6(1)(f) GDPR). Where consent is legally required, we rely on your consent (Article 6(1)(a) GDPR). You can deny or revoke camera access in iOS Settings; the motion-controlled game requires camera access.
Service providers and transfers
We use Clerk for authentication, Convex for the app backend and database, RevenueCat for subscription entitlement management, QuickPose for on-device pose detection and related SDK validation, PostHog for product analytics, Apple for App Store payments and Sign in with Apple, and Google if you choose Google sign-in. These providers process data on our behalf or as independent controllers for their own services. We require processors to protect personal data consistently with this policy and applicable law.
Some providers process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.
Retention and deletion
We keep your account and progress while your account is active. You can start permanent deletion in FlapUps under Profile → Settings → Delete account. Deletion removes your FlapUps account, game records, leaderboard entries, friendships in both directions, profile, membership mirror and the associated RevenueCat customer record; analytics events are retained in pseudonymous form by PostHog for up to 12 months. A minimal deletion marker remains for approximately 24 hours to prevent an old session from recreating the account. Provider security, transaction or legal records may be retained for the periods those providers or applicable law require.
Deleting your FlapUps account does not cancel an Apple subscription. Cancel it separately in iPhone Settings → your name → Subscriptions, or through Apple’s subscription management page.
Local onboarding and pending-result data is removed during in-app account deletion. Uninstalling the app removes its local data but does not by itself delete your cloud account or cancel a subscription.
Your choices and rights
Depending on your location, you may have rights to access, correct, erase, restrict or receive your personal data and to object to certain processing. You may withdraw consent without affecting earlier lawful processing. Contact us at info@abenteuergeist.com. You may also complain to a data protection authority; our competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
Children
FlapUps is not directed to children under 13, and we do not knowingly create accounts for children under 13. If you believe a child has provided personal data, contact us so we can delete it.
Security and changes
We use technical and organizational safeguards appropriate to the data and service, but no transmission or storage system is completely secure. We may update this policy when FlapUps or the law changes. We will post the new version here and update the date above; material changes may also be communicated in the app.
Contact
Alexander Mayle · Abenteuergeist
Widenmayerstraße 11
80538 München
Germany
info@abenteuergeist.com