lazypigPrivacy Policy
Last updated 2 November 2026
Test version. This policy is for the lazypig beta and will be replaced by the final version before launch.
lazypig collects only what it needs to run your challenges and pools, never sells your data, and never uses your health data for advertising. The controller of your personal data is lazypig (test operator), Praha, Czech Republic, company ID (IČO) 00000000. Contact us at privacy@lazypig.app.
What we collect
| Data | What exactly | Where it comes from |
|---|---|---|
| Account | An anonymous Apple user ID; your name, the first time only, if you choose to share it | Sign in with Apple |
| Profile | Display name, username, emoji | You |
| Friends | Friend requests and friendships | You |
| Challenges | Challenges you create or join, bids, folds, prizes, oinks you send and receive | You |
| Health totals | One number per challenge day for the activity a challenge counts (for example 9,412 steps, 6.2 km, 34 minutes in zone 2) | Apple Health, with your permission |
| Notifications | Your device's push token | Your iPhone, if you allow notifications |
| Payments | Your paid entries, refunds, winnings, balance and withdrawals; a Stripe customer reference | You and Stripe |
| Identity for withdrawals | Name, date of birth, ID document and bank account, collected and kept by Stripe, not by us | Stripe, only if you withdraw |
We don't collect your location, contacts, photos or advertising ID, and the app has no ads or third-party tracking.
Apple Health
lazypig only reads Health data, never writes to it, and only the types you allow: workouts, distances, steps, heart rate, exercise minutes and active energy.
Your iPhone turns these into daily totals, and only the totals for your challenges' days are uploaded, never individual heart-rate readings, routes or workouts. Manually entered samples are skipped.
Health data is used for one thing: scoring your challenges and pools. It is never sold, never shared with advertisers or data brokers, never used for advertising and never used for any other purpose. You can turn access off at any time in the Health app › your profile › Apps › lazypig.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, friends, challenges and oinks | Contract (Art. 6(1)(b)) |
| Scoring challenges from health totals | Your explicit consent (Art. 9(2)(a)), given when you allow Apple Health access; withdraw it any time |
| Paid entries, payouts, refunds and balance | Contract (Art. 6(1)(b)) |
| Keeping payment records for tax and accounting | Legal obligation (Art. 6(1)(c)) |
| Spotting cheating and keeping pools fair | Legitimate interest in fair results (Art. 6(1)(f)) |
| Push notifications | Your consent, given in iOS; turn them off in Settings |
Who sees what
- Anyone signed in can find you by username and see your display name and emoji.
- Friends see your record against them and the challenges you share.
- People in a challenge with you see your score and daily totals for that challenge, your bids and the prize. Oinks are seen only by the sender and the receiver.
- People in a pool with you see your name, emoji and progress in that pool.
- Nobody sees your raw health data, your balance or your payment details.
Who we share it with
We use a few service providers who process data only on our instructions:
| Provider | What they do | What they get |
|---|---|---|
| Supabase | Hosts our database, sign-in and server functions | Everything stored in your account |
| Stripe | Takes entry payments, makes refunds and withdrawals, checks identity for withdrawals | Payment details, amounts, a customer reference; identity data if you withdraw |
| Apple | Sign in with Apple and push notifications | Your Apple ID sign-in; notification text sent to your device |
Exchange rates for showing amounts in euros or dollars come from the European Central Bank through frankfurter.dev; that request carries none of your data.
We share data with authorities only when the law requires it.
Where it's stored
Our database runs on Supabase in the European Union. Stripe processes payments in the EU and may transfer data to the US under the EU–US Data Privacy Framework and standard contractual clauses. Apple handles sign-in and notifications under its own privacy terms.
How long we keep it
- Your account, friends, challenges, oinks and health totals: until you delete your account. Deleting it removes them from our database straight away, and from backups within 30 days.
- Payment records (entries, refunds, payouts): kept for as long as Czech tax and accounting law requires, up to 10 years, even after you delete your account.
- Identity checks for withdrawals: kept by Stripe under its own legal obligations.
- Push tokens: removed when you sign out or uninstall the app.
Your rights
You can see, correct, export or delete your data, object to how we use it, and withdraw consent at any time.
- Export your data: Me › Export my data.
- Delete your account: Me › Delete account.
- Stop health access: Health app › your profile › Apps › lazypig.
- Anything else: email privacy@lazypig.app. We reply within 30 days.
If you're unhappy with how we handle your data, you can complain to the Czech data protection authority, ÚOOÚ (uoou.gov.cz), or the authority in your own EU country.
Children. lazypig is for people aged 16 and over, and 18 and over for paid pools. If you think a younger child has an account, tell us and we'll delete it.
Changes. If we change this policy in a way that matters, we'll tell you in the app before it takes effect.