Privacy
Policy dated September 15, 2026 · Move Further for iOS and Android
Move Further is published by Quentin Navard. For any question or request about your data, write to hello@bebou-app.com and mention “Move Further”.
Camera and movement recognition
With your permission, the camera detects movements on your device using Apple Vision or Google ML Kit. The game does not retain camera images or joint landmarks and does not send them to our server or AdMob. From version 1.15, Android uses a native CameraX stream analyzed in memory by ML Kit without saving frames to disk. Squats track eye landmarks on iOS and Android; other exercises track body landmarks. Earlier Android versions may use a temporary cache deleted after analysis. The microphone is not used. You can remove camera access in your device settings and discover the game in Demo mode.
Separately from images, Google ML Kit may transmit technical device and app information, an installation identifier, API configuration, latency measurements and event or error codes for its diagnostics and usage statistics. The game's optional usage statistics setting does not control these SDK measurements. Google ML Kit iOS data information and Android data information.
Profile, activity and progress
A pseudonymous session is created to provide saving and rewards. Our Supabase server in the Paris region stores that session's identifier, your nickname if you choose one, character, scores, exercises, repetition counts, session durations, combos, coins, inventory, challenges and reward transactions. This data supports game operation, synchronization and fraud prevention.
The leaderboard shows your chosen nickname, character and game results. Friend relationships and blocks are stored to personalize the friends leaderboard and hide blocked players. The game does not access your phone's contacts. Do not include personal information in your nickname. Your weight, muscle goal and training preferences stay on your device and are not sent to advertisers. We do not use HealthKit or medical records.
Google AdMob rewarded videos
You choose whether to watch an ad for the stated bonus. Playing does not require watching ads. The applicable consent request is shown before loading ads; you can revisit your choices in Settings → Ad privacy.
Before version 1.15, ads are non-personalized and IDFA is not requested. From version 1.15, an optional age range choice is saved on the phone. Ages 16–17 and undisclosed ages receive non-personalized ads only. For adults, personalization requires the applicable consent choices and, on iOS, ATT tracking permission. Without it, ads remain non-personalized. On Android, Google may collect the Android advertising ID and app set ID; you can reset or delete the advertising ID in Android settings. This does not mean that no data is processed: the advertising SDK may process your IP address and inferred approximate location, device and app identifiers, ads viewed, interactions, and technical performance or crash data to serve and measure ads and prevent fraud.
A pseudonymous identifier and bonus reference are sent to Google for server-side verification. Our server stores reward requests and confirmations, as well as advertising events and their estimated value. No camera feed, body landmark, weight, muscle goal or session summary is sent to AdMob.
See also the Google privacy policy and AdMob iOS data information and AdMob Android data information.
Purchases and accounts — version 1.15
Apple or Google sign-in is required before the first real purchase. Supabase retains the provider identity and any email address the provider sends, which may be masked by Apple. We never receive Apple or Google passwords. Guest progress may be linked to that identity; recovering an existing account does not merge wallets.
Apple and Google process payments. RevenueCat validates receipts using your Supabase user ID, transaction and product identifiers, store, country, price and technical SDK information. We do not receive your card number. Our server wallet records gems, credits, spending and refunds, and chest rarity, price, deadlines and rewards. No eye or body landmarks are sent to RevenueCat. Transaction receipts retained after account deletion are dissociated from the player ID to prevent crediting the same purchase again. Stores and RevenueCat apply their own retention rules to payment records. RevenueCat privacy policy.
Interstitial ads may appear after results from the fourth real game, subject to frequency limits. No ads appear on the first visit, during exercise, calibration or the tutorial. Rewarded videos are optional.
Optional statistics and diagnostics
“Optional usage statistics” is off by default. If you enable it, we store app opens and journey steps, their date and a pseudonymous identifier on our server to improve the game. These events exclude images, weight and muscle goals. You can turn this off and erase these statistics in Settings.
Technical diagnostics stay on your device: up to ten game reports and twenty technical events. You can erase or choose to export them. Detection comparison results are included only if you choose. Our diagnostic feature never sends a report automatically. SDKs may process their own technical data as described above.
Reports and blocks
When you block or report a player, we store the relevant profile identifiers, the predefined reporting reason and the date. This lets us hide results for you and handle abuse. Reports are not public and are accessible only to moderation. You can unblock a player from the leaderboard.
Notifications and sharing
Reminders and chest-ready alerts are optional local notifications sent with your permission. We do not collect a remote push notification token. Score sharing creates a card you can send using your device’s share sheet; you choose the recipient and service.
Service providers and retention
Supabase provides authentication and game data hosting. Google provides advertising and collects advertising choices. Vercel hosts this website and may process technical connection logs. The website has no ads or audience analytics. Providers may process data outside the European Economic Area under their contractual safeguards and privacy policies.
Progress data and related operations are kept while the account exists. The wallet session history is limited to the latest 1,000 sessions; leaderboard results and transaction logs remain with the account. Deleting your account removes associated data from our active database. Backups and security logs may remain temporarily under providers' rules. Google determines retention for the data it processes under its policy.
Your choices and rights
Processing needed for your profile, scores and rewards provides the service you request. Advertising processing subject to consent and optional statistics depend on your choices. Security and abuse prevention serve our legitimate interest in protecting the game.
You can request access, correction, erasure, restriction or portability of your data, object to applicable processing and withdraw consent. Deletion is available in Settings → My account. For other requests, use the contact address above. For a guest profile without an associated email, we may need information to identify your profile without disclosing another player's data. You can complain to the CNIL.
You can also request deletion of your Move Further account and data here, including after uninstalling the app.
Updates
This page will be updated if features or processing change. The date at the top identifies the current version.