Privacy Policy.

Last updated: October 16, 2026. Beta policy.

Who we are (the “controller”): Iris360 SA, Chemin Davel 14, 1009 Pully, Switzerland, the company that makes Pose Duel. Privacy contact: privacy@poseduel.com.

This policy covers two things. Section 1 covers this website: the early access form, the website analytics we run, and the cookie choice you make. Sections 2 to 12 cover the Pose Duel service, the webcam prehab and movement-practice game at poseduel.com that uses your cameras to count reps and score form.

The short version:

On this website, analytics cookies are off until you accept them in the cookie banner. Declining never blocks browsing or early access.
The beta is for adults only. Minors cannot play during the beta.
The game runs in Full Analysis mode, which is required to use it for now. It is free during the beta.
Video is uploaded as recorded. In your settings you can blur your face and the background.
We keep your data internally to track your training and progress, and you can ask us to delete it at any time.
We never sell personal data and never show ads.

1. This website

1.1 The early access form

When you join the waitlist from the home page or the standard waitlist form, we collect:

Your email address.
The request’s source and submission time.

The squat test form also collects your confirmation that you are 18 or older and agree to the Privacy Policy and the Terms of Service. The standard waitlist form does not ask this. After you receive an invite code and create an account, the app asks about your role and sport during onboarding.

These forms do not ask for a child’s name, email, date of birth, health information, photos, or recordings. Please use your own adult contact details. Parents and coaches join the list for themselves; family and team programs will come later with their own terms and privacy notice.

We use these details to manage early access, understand interest in adult, family, and team programs, and contact you about availability and next steps. Legal basis: the steps you ask us to take before a contract, and our legitimate interest in running the beta. Joining the list does not create a game account or give this website access to a camera.

Your submission is forwarded to Pose Duel’s waitlist service and stored in our database. The first time we save an address we send a confirmation email to it. An internal notification containing your email address, plus the adult confirmation from the squat test form when that is the form you used, is sent to our team over Telegram so we can respond to new requests. The services involved are Vercel (hosting), Supabase (database), Resend (the confirmation email), and Telegram (team notification); see Section 6.

We keep early access details until the beta ends or you ask to leave the list, whichever comes first. To ask what we hold, correct your email, leave the list, or request deletion, write to privacy@poseduel.com from the address you used to join.

1.2 Website analytics and cookies

We use two analytics tools on this website, PostHog and Google Analytics, to understand how visitors use the site and to improve it. Neither is used for advertising. The game itself uses neither tool (Section 2).

Your choice comes first. On your first visit a banner asks whether you accept analytics cookies. Until you accept, no analytics cookie is set. Your choice is remembered in your browser so we don’t ask again on every visit, and you can change it at any time with the “Cookie settings” link in the footer or the button below. Declining does not prevent you from browsing or requesting early access.

What we record. Page views, clicks on calls to action (which button and where on the page), which sections of a page scrolled into view, which FAQ questions were opened, that the early access form was submitted (the form’s location, never your email), page performance metrics (web vitals), and JavaScript errors. Analytics requests also carry technical information such as your browser and device type, screen size, language, referring page, and your IP address, which the tools use to derive an approximate location.

PostHog. PostHog is a product analytics service. Our project is hosted on PostHog Cloud EU (PostHog Inc., data stored in Frankfurt, Germany). If you accept, PostHog sets cookies and local storage entries that recognise you on return visits and link your page views into one visit. If you decline, or before you choose, PostHog runs in cookieless mode: no cookie and no persistent identifier are stored, and at most anonymous, aggregate counts are kept.

Google Analytics. Google Analytics 4 is provided by Google (Google Ireland Limited and Google LLC). It loads with consent defaults that deny advertising storage, ad user data, and ad personalization permanently; only analytics storage changes when you accept. If you accept, Google Analytics sets cookies that recognise you on return visits. Google may process this data on servers in the United States under the EU-US and Swiss-US Data Privacy Frameworks (Section 9).

Legal basis. Analytics cookies and similar storage are set only with your consent (GDPR Art. 6(1)(a) and the ePrivacy rules that apply where you live). Cookieless, aggregate measurement and the technical logs our hosting keeps rely on our legitimate interest in running and securing the site (GDPR Art. 6(1)(f)). We keep website analytics data for no more than 14 months.

1.3 Hosting and technical logs

This website is served by Vercel. Like any web host, it processes technical information such as your IP address, browser, requested page, and network details to deliver pages and protect the site against abuse. These logs are short-lived and are not combined with analytics data.

2. What the game collects

Camera video. Live video from your laptop or desktop webcam and, if you pair one, a phone camera, while you play. Video is uploaded for analysis (Section 4). By default it is sent as recorded, with no blur. It is about you, and anyone who walks into frame, so keep the play space clear.
Pose data. Skeleton keypoints (stick-figure coordinates) computed from the video, plus rep counts, movement-quality scores, and exercise timing. Pose data is not a photo, but it is still personal data: movement patterns can be identifying.
Account data. Your email address, hashed password, and display and hero names (use nicknames, not real names).
Health-context data. The exercise program configured for you (which exercises, targets, difficulty tiers). We do not ask for diagnoses, and we ask you not to enter medical details in free-text fields.
Telemetry. Technical logs: session times, feature usage, errors, device and browser type, approximate region from IP address (for security and server routing), and performance metrics. The game uses no advertising identifiers, no cross-site tracking, and no third-party analytics cookies.
Communications. Emails you send us, and consent records: what you agreed to and when.

Video is unblurred by default. Recordings go to our servers as captured. In your settings you can blur your face and the background. That choice applies to new recordings.

We never: sell personal data, show ads, use advertising trackers, or let your data train third-party AI models. Where Google Gemini generates form feedback, we use it through Google Cloud, whose terms prohibit using our data to train Google’s models.

3. Why we process it (purposes and legal bases)

European and Swiss law require us to name a legal basis for every use of personal data.

Purpose	Data used	Legal basis
Running and personalising the game: detecting reps, scoring movement quality, adapting difficulty thresholds, progressing through encounters	Video, pose data, exercise config	Our contract with you; your explicit consent for video, pose, and health-context data (GDPR Arts. 6(1)(a), 9(2)(a); FADP Art. 6(7))
AI feedback on exercise form (our AI movement coach, an AI, not a health professional)	Video clips, pose data	Explicit consent
Improving our detection and scoring models (“model improvement”)	Pose data, video	Explicit consent, given when accepting Full Analysis mode (Section 4); you can ask us to stop and delete at any time
Review of selected clips by qualified movement professionals under confidentiality, to keep scoring honest	Selected clips	Explicit consent
Accounts, support, and proof of consent	Account data, communications, consent records	Contract performance; legitimate interest in evidencing consent
Security, abuse prevention, debugging	Telemetry	Legitimate interest, with narrow logs and short retention (GDPR Art. 6(1)(f))

4. Full Analysis mode: the only mode for now

During the beta the game runs in one privacy mode, Full Analysis. You cannot use the software without it for the moment. The consent step shows exactly what it collects before you accept. We may offer more restrictive modes later; if we do, we will say so here.

In Full Analysis mode:

What leaves the device: video plus pose data. Video is sent as recorded unless you turn on face and background blur in settings.
What it enables: AI form feedback, personalised difficulty thresholds, progress across devices, and review of selected clips by our contracted movement professionals.
What we do with it: we keep your recordings, pose data, and progress internally to track your training and show your progress, and we use them to make rep detection and form scoring better for everyone (“model improvement”). Model improvement never means advertising, sale, or unrelated AI training.
The raw upload is a working copy, deleted shortly after processing. The stored clip remains: as recorded, or with face and background blurred if you chose that.

5. How long we keep things

We keep what the game collects (recordings, pose data, progress, and account data) internally for as long as your account is active, to track your training and show your progress over time, and to keep rep detection and scoring honest. We keep it for that purpose only; it is never sold, shared for advertising, or used to train third-party AI models.

You can ask us to delete your data at any time by writing to privacy@poseduel.com. We then delete it across our systems and providers within 30 days (backups purge within 90 days). Where the law requires us to keep a record, for example proof of consent, we keep only that record. Early access details and website analytics are covered in Section 1.

6. Who processes data for us

We use a small set of providers under data-processing agreements. They may only process data on our instructions.

For the game

Google Cloud Platform. Video and pose storage and processing. europe-west1 (Belgium).
Supabase. Database for accounts, progress, and pose data. EU.
Vercel. Web hosting and serverless functions. EU, with a global edge network.
Google Gemini, via Google Cloud (Vertex AI). Generates AI form feedback from video clips and pose data. Our data is not used to train Google’s models. Processing location is set by Google Cloud and may be outside the EEA (Section 9).
Resend. Sends account and consent emails. EU.
Qualified movement professionals under contract. Review selected clips. Switzerland and EU.

For this website

Vercel. Hosting of this website and the early access form’s relay.
Supabase. Stores early access entries. EU.
Resend. Sends the waitlist confirmation email. EU.
Telegram. Delivers the internal notification of a new early access request (email address and any details supplied through the squat-analysis signup form) to our team. Telegram operates outside the EU.
PostHog. Website analytics, with your cookie consent. PostHog Cloud EU (Frankfurt, Germany).
Google Analytics. Website analytics, with your cookie consent. Google may process data in the United States (Section 9).

We update this list before adding any provider and notify account holders of material changes.

7. Adults only during the beta

The beta is for adults 18 or older. Minors cannot play, and we do not knowingly collect personal data from anyone under 18. Parents and coaches on the early access list join for themselves. If we learn that a minor has used the game, we delete the related data. Family and team programs, including play by minors, will come later with their own terms and privacy notice.

8. Your rights and how to use them

Every account holder, everywhere: you can view your account data, withdraw any consent, export your data in a machine-readable format, and delete the account and all associated data, by email (Section 5). Website visitors and early access subscribers exercise their rights by email (Section 1).

Switzerland (FADP): right to information (Art. 25), rectification, deletion, data portability (Art. 28), and to complain to the FDPIC (Federal Data Protection and Information Commissioner, Bern, edoeb.admin.ch).
EU/EEA (GDPR): access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), withdrawal of consent at any time without affecting past lawfulness (Art. 7(3)), and complaint to your national supervisory authority.

Withdrawing a consent is as easy as giving it: one email to privacy@poseduel.com, or one click in the cookie settings for this website. Because Full Analysis mode is required for now, withdrawing consent to video and pose processing means you stop using the game until other modes are available (Section 4).

9. International transfers

Game data is stored in Europe (Google Cloud europe-west1; Supabase EU region; PostHog Cloud EU). Some processing happens outside Switzerland and the EEA: Google Analytics may process data in the United States, Gemini requests are processed where Google Cloud routes them, and Telegram delivers our internal notifications from outside the EU. Where a provider processes data outside Switzerland or the EEA, we rely on the Swiss-US and EU-US Data Privacy Frameworks where the provider is certified, or on the EU Standard Contractual Clauses with the Swiss addendum, plus technical measures such as encryption in transit and at rest. Details are available on request.

10. Security

Encryption in transit (TLS) and at rest; access to video restricted to the minimum staff and contracted reviewers needed, all under confidentiality obligations, with access logging; signed, expiring URLs for media; and raw uploads removed shortly after processing. No system is perfectly secure. If a breach affects your data, we will notify you and the competent authority as the FADP and GDPR require.

11. No sale, no ads

We do not sell or rent personal data. We do not show advertising, on this website or in the game. We do not permit third parties to collect data through Pose Duel for their own purposes, and our analytics tools are configured so that advertising features stay off. If US state privacy laws apply to you (for example CCPA/CPRA), we do not “sell” or “share” personal information as those laws define it.

12. Changes and contact

We will post changes here and email account holders before material changes take effect. If a change expands what we collect, we ask for fresh consent first. Silence never equals consent.

Iris360 SA, Chemin Davel 14, 1009 Pully, Switzerland. privacy@poseduel.com. See also our Terms of Service.

This policy is written to satisfy the Swiss FADP and the EU GDPR. If a translation conflicts with the English original, the original governs.