- Data controller
- Kudbi Enterprise, Kazakhstan
- Privacy contact
- privacy@monsterko.app
- App
- Monster KO (com.monsterko.game)
This policy explains what the Monster KO game (the “Game”) collects, why, who else handles it and what you can do about it. The short version:
- The camera never leaves your phone. Pose tracking runs on the device. No video, photo or body landmarks are recorded, uploaded or shared.
- You can play without an account. As a guest, your progress stays on your phone.
- No ads and no tracking. We don't use advertising IDs, ad networks, analytics or attribution SDKs, and we never sell your data.
- Online play needs a small amount of data: a player name, friend code, level and trophies, and, if you sign in, your progress saved in the cloud.
- You can delete your account at any time in the Game or by email. See Delete your account.
- Camera and pose tracking
- What we collect
- What stays on your phone
- What other players see
- Why we use it
- Who handles data for us
- How long we keep it
- Your choices and rights
- Security
- Where data is processed
- Children
- Changes and contact
1. Camera and pose tracking
The Game asks for camera access so it can see your punches, uppercuts and dodges. Each camera frame is analysed in your phone's memory by an on-device pose model and then discarded. The model is built into the app; nothing is sent to us or anyone else for analysis.
- We do not record, store, upload or share video, photos or body landmarks.
- During online duels only game events travel to our server, such as “jab with the left hand” or “dodged”. Your opponent never sees your camera.
- Calibration saves a few numbers about your movement range (for example shoulder width and how far you lean), never an image.
- The Game does not use the microphone.
You can turn camera access off in your phone's settings at any time. The Game cannot be played without it.
2. What we collect
| Data | When | What it is |
|---|---|---|
| Player profile | When you open online features | Player name (a random “Fighter 1234” until you change it), friend code, chosen fighting-style avatar, level, trophies, wins, losses and draws, account creation date. |
| Guest ID | Playing online as a guest | A random ID created by the Game on your phone. It is not a hardware or advertising ID. It is removed if you upgrade to a full account. |
| Email account | If you sign up with email | Your email address and your password, stored only as a salted scrypt hash. |
| Apple or Google sign-in | If you sign in with Apple or Google | The account identifier Apple or Google gives us. From Google we also receive your email address and name; from Apple only the name you choose to share. |
| Cloud save | Signed-in accounts only, while you play | Your game progress, items and settings, plus training data: daily minutes, punches and dodges, punch-test results, totals, calibration numbers and your body weight if you entered it. |
| Friends, blocks and reports | When you use them | Who you are friends with or have blocked. A report contains who reported whom, the duel and a short reason. |
| Arena recordings | After an Arena duel with at least three punches | The timing of your punches (when, which punch, which hand), how many you dodged, and a copy of your name, avatar, level and trophies at that moment. No video. |
| Password reset | When you ask to reset your password | Your email address and a one-time 6-digit code (stored as a hash, valid for 15 minutes), sent to you by email. |
| Purchases | When you buy something | Payments are made through the App Store or Google Play; we never see your card details. We receive which products you own and your subscription status, linked to your account ID. |
| Support emails | When you write to us | Your email address and whatever you write. |
| Technical data | Every request to our server | Your IP address, used briefly in memory to limit abuse (for example too many sign-in attempts) and not stored. Our server log notes events such as sign-ins and duels with a shortened account ID and your player name. |
We do not collect your contacts, location, photo library, health app data, advertising ID or device identifiers. Body weight is optional: it is only used to estimate calories, and you can leave the default value.
3. What stays on your phone
- Your save file with progress, settings, calibration, weight and training log. As a guest, this is the only copy.
- Your sign-in token, so you stay signed in.
- A small performance log (frame rate, timings, device temperature state and memory for your last fights). It is used to diagnose tracking problems and is never uploaded.
- Weekly recap images, only if you choose to share or save one. Saving to your photo library asks for permission first.
Settings → Reset progress clears the save on your phone. Uninstalling the Game removes everything stored on the phone.
4. What other players see
- Leaderboards and matches: your player name, avatar, level and trophies.
- Friends: the same, plus whether you are online or in a duel.
- Arena recordings: when no player is available, the Arena may match another player against a recording of one of your past Arena fights, shown with your name, avatar, level and trophies. Recordings of players who blocked each other are never used.
Choose a player name that does not reveal personal information. You can change it in the Game.
5. Why we use it
| Purpose | Legal basis (EEA / UK) |
|---|---|
| Running the Game: accounts, cloud save, friends, duels, the Arena and leaderboards | Performance of our contract with you (the Terms of Use) |
| Estimating calories from the weight you enter | Your consent, given by entering it; you can change it or reset it at any time |
| Password reset emails and answering support requests | Performance of our contract |
| Keeping the Game fair and safe: rate limits, reports, blocks, logs | Our legitimate interest in protecting players and our service |
| Purchases and subscriptions | Performance of our contract; legal obligations for accounting |
6. Who handles data for us
We do not sell or rent personal data and we do not share it for advertising. These providers process data on our behalf, only to run the Game:
| Provider | What for | Where |
|---|---|---|
| Fly.io | Hosts our game server and database | Frankfurt, Germany |
| Resend | Delivers password reset emails | Ireland (EU) |
| Cloudflare | Domain name service and forwarding of emails sent to our addresses | Global network |
| Our support mailbox; Google sign-in; Google Play purchases | Global | |
| Apple | Sign in with Apple; App Store purchases | Global |
| RevenueCat | Keeps track of purchases and subscription status for your account | United States |
| Unity Technologies | The game engine may send basic, non-identifying information about your device's hardware | Global |
We may also disclose information if the law requires it, or to protect players, the public or our rights.
7. How long we keep it
- Account, profile, cloud save, friends and blocks: until you delete your account.
- Sign-in sessions: until you sign out, reset your password or delete your account.
- Arena recordings: only the most recent ones are kept (currently the newest 2,000 across all players); older ones are deleted automatically, and all of yours are deleted with your account.
- Reports: deleted together with the account of the reporter or the reported player.
- Password reset codes: 15 minutes.
- Server logs: about one week.
- Backups of the server database: replaced automatically within 30 days.
- Support emails: as long as needed to help you, then deleted.
- Purchase records: as long as tax and accounting laws require.
8. Your choices and rights
- Play as a guest and keep everything on your phone, or skip online features entirely.
- Change your player name and weight in the Game at any time.
- Delete your account in Settings → Online account, or by email. See Delete your account.
- Ask for a copy of your data, a correction, or deletion, or object to how we use it, by writing to privacy@monsterko.app. We answer within 30 days and may need to confirm the request comes from the account owner.
Depending on where you live (for example the EEA, the UK or California), you have rights to access, correct, delete and port your data and to object to or restrict its use. You can also complain to your local data protection authority. We do not sell or “share” personal information for cross-context behavioural advertising as defined by Californian law.
9. Security
All traffic between the Game and our server is encrypted (HTTPS). Passwords are stored as salted scrypt hashes, sign-in tokens and reset codes as one-way hashes. Access to the server is limited to us. No system is perfectly secure, so please use a password you don't use elsewhere.
10. Where data is processed
Our server and database are in Frankfurt, Germany. Some providers listed above are based in the United States or operate worldwide, so data may be processed outside your country. Where the law requires it, these transfers are covered by the providers' data processing terms, including standard contractual clauses.
11. Children
The Game is made for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children under 13 (or the higher age of digital consent in your country) without a parent's permission. If you believe a child has created an account, write to privacy@monsterko.app and we will delete it.
12. Changes and contact
We will post any change to this policy on this page with a new effective date, and tell you in the Game about important changes.
Questions or requests: privacy@monsterko.app. Kudbi Enterprise, Kazakhstan.