Privacy

Privacy Policy

Last updated: October 8, 2026

This policy explains what personal data the TamagoFit app (version 2.0 and later), its servers and this website handle, why, with whom, for how long, and how you control it. It applies to everyone who plays TamagoFit or visits tamagofit.app.

1. The short version

We use your daily step totals from Apple Health to run the game. Health data is never sold, never used for advertising and never shown to your friends.
There are no ads and no third-party tracking in TamagoFit. We don't sell or rent personal data.
Your friends see your player name, avatar, levels, monster and island. They never see your steps, calories, coins, e-mail or real name.
Photos of your monster are made on your phone and never uploaded.
You can delete your account in the app at any time (Settings → Delete My Account).

2. Who we are

TamagoFit is published by Erwan Massou, an individual developer ("TamagoFit", "we", "us"), who is the data controller for the processing described here. Our postal address is available on request by e-mail.

Privacy questions and requests: support@tamagofit.app.

3. What we collect

Account

Sign in with Apple or Google: your e-mail address (with Apple it may be a private relay address), your name if the provider shares it, your Google profile picture if any, and the provider's account identifier.
Apple sign-in token: when you sign in with Apple we keep a token that lets us revoke the link with Apple when you delete your account. It is never shown in the app.
Player profile: your player name (handle), avatar and its boy/girl version, player level, XP, titles, achievements, quests, collection (Tamagodex), themes and decorations you own.

Game data

Your monster and its state (hunger, sleep, level, XP), coins, inventory, purchases made with coins, fights in Training, daily, weekly and monthly quests, Season Pass progress, and a ledger of player XP.
Your time zone offset, used to know when your local day starts (daily rewards, quiet hours).

Device and notifications

Your push notification token, if you allow notifications, and a log of the notifications we planned and sent (to avoid duplicates and respect quiet hours).
The app version, and a hashed device identifier (a one-way hash of Apple's identifier for vendor) used only to stop people from inviting themselves to collect friend rewards.

Purchases

For in-app purchases (coin packs, welcome pack, instant revive, Season Pass Premium): the product, price, currency, store and the store's transaction identifier. Payments are handled by Apple; we never see your card details.

Usage analytics and crash reports

Product analytics (PostHog, EU servers): game events such as "egg hatched", "item bought", "fight finished", linked to your account identifier, with game properties (levels, monster rarity, account age, whether notifications are on, a coarse band of daily steps). No e-mail, no player name, no session recording.
Crash reports (Sentry, EU servers): technical information when the app crashes or hits an error, with your account identifier and game context (monster stage, screen). We don't send IP-based personal data by default.

E-mails

If you receive our news e-mails, we keep delivery events (delivered, opened, clicked, bounced, complained) and your unsubscribe choice.

What we don't collect

TamagoFit does not use your location, contacts, camera or microphone, does not read your photo library, has no chat, and contains no advertising or tracking SDK.

4. Apple Health data

With your permission, TamagoFit reads the following from Apple Health (it never writes to Apple Health):

Steps: the heart of the game (hatching, coins, XP, quests, achievements, active days).
Active energy (calories) and walking + running distance: shown in the app and on your share card; calories also earn coins. Without an Apple Watch, the app adds a small estimate of calories per step.
Sleep analysis and mindful minutes: requested and stored as daily totals, not used for gameplay in 2.0.
Heart rate: requested, read on your phone only, and never sent to our servers.

Only daily totals leave your phone (steps, calories, distance, sleep hours, mindful minutes), stored as one snapshot per day with your account. Raw Health samples never leave your device. Our analytics receive only aggregated step counts per sync and a coarse daily-steps band, to balance the game.

Health data is never used for advertising or marketing, never sold, never shared with data brokers, never shown to friends and not stored in iCloud by us. You can change access at any time in Settings → Health → Data Access & Devices → TamagoFit. Without step access the game can't progress, but your account stays intact.

TamagoFit is a game, not a medical device, and gives no medical advice.

5. Friends and what others see

When you add friends (by friend code or by exact player name), each of you can see the other's:

player name, avatar, player level and title;
monster: name, appearance, mood, level, and whether it is an egg, awake or asleep;
island: theme, decorations and the number of species in your Tamagodex;
whether you were active recently ("online" or "today"), unless you turn off Show when I'm active;
your friendship level, high-fives and Cheers. When a friend cheers you on, they learn whether you reached the day's Cheer goal, not your step count.

Friends never see your steps, calories, coins, hunger or sleep numbers, deaths, time zone, e-mail or real name. There is no chat and no free text.

Safety records. We store friend requests (including requests that were declined or silently held back to stop spam), blocks and reports. A report keeps the reason (offensive name, harassment, other), a snapshot of the reported player name and any action we took (forced rename, temporary suspension of social features). Several reports about a name can hide it until we review it. Privacy settings live in Settings → Privacy & Friends.

6. Photos and sharing

Photo moments and share cards are images made by the app on your phone. Save to Photos asks only for permission to add pictures (TamagoFit can't see your library). Share opens the iPhone share sheet: what you share, and with whom, is your choice and then follows the rules of the app you share to. We never upload your photos.

The share card shows your daily steps, distance, calories and game stats, plus your player name and avatar, only when you choose to share it. If you tag us on Instagram or TikTok for the monthly giveaway, see the giveaway rules.

7. Why we use it (legal bases)

Purpose	Data	Legal basis (GDPR)
Run your account and the game	Account, game, device data	Contract (art. 6(1)(b))
Turn your steps into game progress	Apple Health daily totals	Your explicit consent (art. 9(2)(a)), withdrawable in iPhone settings
Friends and social features	Profile, friends, safety records	Contract; legitimate interest in keeping players safe (art. 6(1)(f))
Game notifications	Push token, notification log	Your consent (iOS permission)
News e-mails (big updates and gifts)	E-mail, delivery events	Legitimate interest: news about the game you play, sent to existing players only, with a one-click opt-out in every e-mail and in the app
Analytics, crash reports, fraud prevention	Events, errors, hashed device id	Legitimate interest in a working, fair game
Purchases, accounting, refunds	Purchase records	Contract; legal obligation

We don't use your data for advertising, profiling with legal effects or automated decisions about you.

8. Service providers

We share personal data only with providers that run TamagoFit for us, under contracts that limit their use of it:

Convex: backend database and server functions (all game data), hosted in the United States on Amazon Web Services.
Apple: Sign in with Apple, App Store payments, push notifications (APNs), Apple Health on your device.
Google: Sign in with Google.
Expo: delivery of push notifications to Apple.
RevenueCat: in-app purchase validation, linked to your account identifier.
PostHog (EU Cloud, Germany): product analytics.
Sentry (EU region, Germany): crash and error reports.
Resend: sending news e-mails and reporting delivery events.
Vercel: hosting of this website.

We may also disclose data if the law requires it, or to protect players' safety. We don't sell personal data and we don't "share" it for cross-context behavioral advertising.

9. International transfers

Some providers (Convex, RevenueCat, Resend, Expo, Vercel, and Apple and Google for sign-in) process data in the United States. These transfers rely on the European Commission's Standard Contractual Clauses included in each provider's data processing terms, or on the EU-US Data Privacy Framework where the provider is certified under it.

10. How long we keep data

Account and game data, including daily Health snapshots: as long as your account exists, then deleted.
Player name: after you change it, or delete your account, the name stays reserved for 30 days so nobody can impersonate you, then it is released.
Purchase records: kept for 10 years for accounting (French Commercial Code, art. L123-22), anonymised when you delete your account (no link to you remains).
Pending friend requests expire after 30 days.
Crash reports: kept by Sentry for up to 90 days, then deleted automatically.
Analytics events: kept by PostHog for the data retention period of our plan, and deleted for your account on request (see below).
E-mail delivery logs: kept by Resend for its retention period.
Waiting list: until we announce the Android launch or you ask us to remove you.

11. Deleting your account

In the app, open Settings → Delete My Account and confirm twice. Here is what happens:

All scheduled notifications for your account are cancelled.
You are signed out on every device and your account is deleted, together with your monster, coins, inventory, player level, achievements, quests, collection, avatars, themes, decorations, Health snapshots, notification records and news-e-mail records.
Friendships, friend requests, high-fives, blocks, referrals and reports involving you are deleted on both sides. Rewards a friend already received stay with them.
Your player name is held for 30 days, then released. Your purchase records are kept anonymised for accounting.
If you signed in with Apple, we ask Apple to revoke TamagoFit's access to your Apple ID (retried automatically if Apple is unavailable), then delete the token.
Any waiting-list entry with the same e-mail is removed.

Data held by providers outside our database (analytics events, crash reports, e-mail logs, RevenueCat purchase history) is deleted on request or expires with their retention. Write to support@tamagofit.app to have it erased as well. Can't open the app? E-mail us from your sign-in address and we'll delete the account for you.

12. Your rights and choices

Depending on where you live (including the EU/UK GDPR and US state laws such as the CCPA/CPRA), you can ask to access, correct, delete or receive a copy (portability) of your data, object to or restrict some processing, and withdraw consent at any time. There is no export button in the app yet: e-mail support@tamagofit.app and we answer within one month. We may ask you to write from your sign-in e-mail to confirm it's you. We won't treat you differently for exercising your rights.

In the app you can also:

change Health access in iPhone Settings → Health;
turn notifications off in iPhone Settings → Notifications;
turn off news e-mails in Settings → News emails or with the one-click link in any e-mail;
control who can find you, send requests, visit your island or see when you're active in Settings → Privacy & Friends.

You can complain to your data protection authority. In France: the CNIL (cnil.fr).

13. Children

TamagoFit is meant for players aged 13 and over. We don't knowingly collect data from children under 13. If you believe a child under 13 has an account, write to support@tamagofit.app and we will delete it.

Social features are built to be safe for younger players: no chat, no free text, no step counts shared, block and report everywhere. Our servers already support stricter defaults for under-13 accounts (not findable by name, friend codes only, no activity status), which will apply once the app can receive an age range from iOS.

14. Security

Data travels over encrypted connections (TLS) and is stored by our providers with encryption at rest. Access is limited to the people who run TamagoFit. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

15. This website and the waiting list

This website uses no cookies for tracking and no analytics. Our host keeps standard technical logs (such as IP address and pages requested) for security. If you join the Android waiting list, we keep your e-mail address and the date, only to tell you when TamagoFit is available on Android. Ask us anytime to be removed.

16. Changes

We'll update this policy when the app changes. For important changes, we'll tell you in the app or by e-mail before they take effect. The date at the top shows the latest version.

17. Contact

Erwan Massou (TamagoFit), individual developer
support@tamagofit.app (privacy and support)