Consumer Health Data Privacy Policy

caspyr is a step competition, so it works with health data. This policy explains what consumer health data caspyr collects, where it comes from, how it’s used, who it’s shared with, and how to use your rights over it. It’s written for Washington’s My Health My Data Act, and it also covers Nevada’s and Connecticut’s consumer health data laws. We offer the rights below to every caspyr player, wherever you live.

caspyr is made by caspyr LLC (“caspyr,” “we,” or “us”). This policy adds to our Privacy Policy, which covers everything else caspyr collects. Questions or requests: support@caspyr.app.

The consumer health data caspyr collects

Step counts. Your hourly step totals from Apple Health. Each time caspyr syncs, it reads and uploads the hours of yesterday and today, so caspyr keeps your hourly steps for each day it has synced since you joined. Once, when you join, caspyr also reads your daily step totals for the last 30 days to set your starting rating, and keeps only their average.
Information worked out from your steps. Your daily step totals, the results of your matches (win, loss, or tie, and the final step counts), your ELO rating and every change to it, your tier, your rank on the Ladder, and your win streak.
Sync times. When caspyr received your steps. We treat these as health data too, since they come with your steps.
Your consent. When you agreed to let caspyr collect and share your steps.

caspyr reads nothing else from Apple Health (no workouts, heart rate, sleep, weight, cycle tracking, medications, or health records), never writes to Apple Health, and never collects your precise location. caspyr doesn’t ask for any other health information. If you choose to mention your health in a chat message or an email to us, it’s handled as our Privacy Policy describes for messages and emails, and used only to deliver the message or answer you.

Where it comes from

Apple Health on your iPhone, with your permission. Apple Health gets steps from your iPhone, your Apple Watch, and any other app you’ve let write steps to it. caspyr reads Apple Health’s combined totals, so the same steps are never counted twice.
caspyr’s servers, which work out your results, ratings, tiers, and ranks from those steps.

Why we collect it and how we use it

Only to run caspyr:

to score your daily matches and decide who won at midnight;
to set your starting ELO, update it after each match, apply the ELO decay rule, and work out your tier and rank;
to pair you with a rival and set up your matches;
to show your steps and rating to other players as described below;
to send you the nightly result notification (your result and rating change, never step counts);
to check uploads for errors and keep the game working and fair.

We never sell consumer health data. We never use it for advertising, marketing, or data mining, never share it with advertisers or data brokers, never use it to train AI, and never use it for anything unrelated to caspyr.

caspyr collects and shares steps only after you agree. Before any steps are read, the “Share your steps with your rivals” screen lists what your rival sees, what your friends and the Ladder show, and how to stop; tapping “Agree and connect Apple Health” records your consent. Apple then asks you separately which Health data caspyr may read, and caspyr asks only for Steps. If we ever want to collect health data for a new purpose, or show it to more people than this policy describes, we’ll ask for your consent again first.

Other caspyr players, as part of the game

Your rival for the day sees your step total for that day, your steps hour by hour during it, when your phone last synced that day, and your ELO and tier.
Your friends see your step total so far today (your own day; only when you’ve both agreed to share), your ELO and tier, and your place among them on the Ladder’s Friends view, but never your hourly steps or sync times.
Everyone on caspyr sees your ELO, tier, and rank on the Ladder, with your username and photo, while you’re one of the top 100 players by ELO among those whose steps caspyr received in the last 7 days.
Rivals also see the result of their match with you, including your final step count, and friends see the result of a friendly match with you.

Service providers that handle it for us

Supabase (hosting) stores all of it on our behalf, in the United States.
Expo and Apple (push notifications) carry the nightly result notification, which can include your result, your rating change, and a promotion to a new tier, but never step counts.

When the law requires it

We may disclose consumer health data when the law requires it, such as in response to a valid court order.

We don’t sell consumer health data to anyone, and we don’t share it with any affiliates.

How long we keep it

Your steps, sync times, match results, rating history, and consent record: until you delete your account.
After you delete your account, deleted data can stay in our database backups for up to 7 days before it’s gone for good.
Our records of notifications sent to you: deleted within a few days.
Former rivals keep their own match results, but not your steps or your name.

Your rights

Confirm. You can ask whether caspyr collects, shares, or sells your consumer health data. (We collect and share it as described here, and we never sell it.)
Access. You can get a copy of the consumer health data we have about you, along with a list of every third party and affiliate we’ve shared or sold it to, and an email address or website for contacting each one.
Withdraw consent. To stop caspyr collecting your steps, turn off Steps for caspyr in the Health app (tap Summary, then your picture or initials, then Apps, then caspyr); caspyr gets no new steps after that. Steps it already has stay until you delete your account; you leave the Ladder after 7 days without new steps, and friends still see your ELO and tier. Sharing with other players is how caspyr’s matches work, and caspyr has no way to keep an account while hiding its steps from other players, so to withdraw consent to sharing, delete your account (or email us and we’ll delete it for you).
Delete. Delete your account in the app (Profile, then the gear, then Delete account) to delete your consumer health data right away, or email us and we’ll do it for you. We delete it from our records, which our hosting provider stores for us; copies in backups are gone within 7 days.
Correct. If a step count is wrong, correct it in Apple Health (for example, by deleting a bad entry); caspyr picks up changes to today’s and yesterday’s steps at its next sync. Hours in a match that has already ended stay as they were. For anything else, email us.

Using these rights is free, and we won’t treat you worse for using them.

How to make a request

Email support@caspyr.app with “Health data request” in the subject, your caspyr username, and what you’d like us to do.
We’ll confirm the request comes from you. If we need more information to do that, we’ll ask for only what we need. We never ask for your Apple password.
We’ll answer within 45 days of getting your request. If we need more time, we’ll tell you why within those 45 days, and we can take up to 45 more days.

Someone you’ve authorized can make a request for you; we’ll need to confirm you gave them permission.

How to appeal

If we turn down your request, in whole or in part, you can appeal. Reply to our answer, or email support@caspyr.app with “Appeal” in the subject. We’ll send you our decision in writing within 45 days of getting your appeal, with the reasons for it. If we deny your appeal, you can contact your state’s attorney general:

Washington: www.atg.wa.gov/file-complaint
Nevada: ag.nv.gov
Connecticut: portal.ct.gov/ag (choose “Consumer Data Privacy”)

Nevada and Connecticut

Nevada. Nevada’s consumer health data law gives you rights like Washington’s: to confirm whether we collect, share, or sell your consumer health data, to get a list of the third parties we’ve shared it with, to have us stop collecting or sharing it, and to have it deleted. Make requests and appeals as described above. To review your data, ask us for a copy; to change it, see “Correct” above.

Connecticut. Connecticut’s privacy law treats consumer health data as sensitive data that needs your consent, which caspyr asks for before collecting any steps. You can ask to access, correct, delete, or get a copy of your data. caspyr doesn’t sell your data or use it for targeted advertising or for profiling that produces legal or similarly significant decisions about you, so there’s nothing to opt out of. Make requests and appeals as described above.

No tracking across sites or apps

No third party collects information about your activity over time or across other websites or apps through caspyr or caspyr.app. caspyr has no ads, analytics, or tracking code, and caspyr sets no cookies.

Changes to this policy

When we change this policy, we’ll post the new version here and update the date at the top. For important changes, we’ll tell you in the app before they apply, and we’ll ask for your consent again before collecting health data for a new purpose or showing it to more people.

Contact

caspyr LLC, support@caspyr.app.