Dojojojo is operated from Singapore by Reynard and May Yee ("we", "us", or "our"). We process the information described below to provide the features you choose, maintain account security, answer support and privacy requests, support existing purchase entitlements, and improve reliability. Permission-based features only access the data categories you authorize in your device settings.
Account and profile information
When you create or use an account, we process account identifiers such as your email address and authentication details, along with your display name and settings. Your fitness profile can include your date of birth, gender, height, weight, activity level, experience, and fitness or weight goals. We use this information to sign you in, check age eligibility, personalize fitness features, keep your profile and progress available across supported devices, and send account or service messages.
HealthKit and Health Connect
If you grant permission, Dojojojo can read the health and activity categories you select through Apple HealthKit or Android Health Connect, such as step and exercise activity. We use authorized activity data to show progress, support fitness features, and connect movement to in-app goals and rewards. You can review or withdraw these permissions at any time in your device settings; withdrawing permission may limit the related features.
Nutrition, camera, and AI recognition
Nutrition entries, meal details, and recognition results help you record food and understand your progress. Dojojojo requests camera access for meal capture and pose or form checking. You can change camera permission in device settings; it is not needed for ordinary account browsing.
Food photos and meal text you submit for AI recognition are uploaded to our private backend and stored in Cloudflare R2. Photo recognition sends submitted photos to Google Gemini Paid Services, and meal-text recognition uses Cloudflare Workers AI. These providers process the submitted content to return food and nutrition estimates. Do not include unrelated personal information in photos or meal descriptions.
Under Google's Gemini API terms, paid-service prompts and responses are not used to improve Google's products. Google may log them for a limited period for safety, security, and required legal or regulatory disclosures. This provider retention is separate from our backend cleanup described below.
Activity and device sensors
We use authorized health and activity data and supported step-counting features for movement-based progress, such as walking goals and hatching a pet. This release does not track GPS routes or collect live voice-chat audio. Service security logs may still include IP addresses and related network information.
Gameplay and pets
We process workout and activity progress, completed challenges, in-game currency, pet choices, pet growth, and gameplay results so the app can award progress and keep your pets in step with your training. We also use the settings and content you provide to save your game state and respond to support questions about your account.
Purchases and subscriptions
New in-app purchases and RevenueCat checkout are disabled in this release. For existing purchases or subscriptions, we may still process store purchase identifiers, products, and entitlement status to support existing access and billing questions. The relevant app store handles payment records, subscription management, and refunds. We do not need your full payment-card number for this support.
Diagnostics, service providers, and international transfers
Firebase Crashlytics is enabled for crash and reliability reporting. App-generated release log breadcrumbs and exception payloads are redacted before reporting. Crash diagnostics can still include stack traces, timestamps, app and operating-system versions, device information, Crashlytics installation UUIDs, and Firebase installation IDs. Redaction does not remove these diagnostic identifiers. See Firebase's privacy information for its processing and retention practices.
In-app product analytics through Firebase Analytics and PostHog are disabled in this release. Separately, when your stored analytics consent is granted, our backend can send allowlisted movement, streak, and workout events and your account ID to PostHog. You can withdraw this consent through a privacy request. Account security, device synchronization, crash reports, error logs, IP addresses, and request timestamps remain in use for service operation and abuse prevention.
Our providers include Cloudflare for backend hosting, R2 storage, and Workers AI; Google Firebase for authentication and crash diagnostics; Google Gemini Paid Services for photo recognition; and PostHog for consented backend analytics. We also use providers for email delivery, support, and existing purchase entitlements. Their processing is subject to applicable provider terms and data-processing protections. Some providers may process information outside Singapore.
Retention and deletion
We retain information for as long as it is needed to provide your account and the features you use, meet operational and legal requirements, resolve disputes, and enforce our agreements. Retention periods vary by the type of information and why it was collected.
Raw recognition jobs and request payloads become eligible for backend cleanup after 24 hours. Cleanup is scheduled and may need retries; this is not a promise that every copy is deleted at exactly 24 hours. Saved meal logs and results are account data and do not share this raw-job cleanup window.
To request account deletion, select Delete Account on the in-app Account screen or contact team@dojojojo.com. You may need to sign in again before the request can be accepted. Once accepted, account access is blocked while the backend removes account data, recognition payloads, food images, and user state. Storage or provider failures can defer cleanup, which the service retries. Acceptance does not mean that every copy has already been deleted.
Provider records, diagnostics, security logs, and backups may follow separate retention and deletion processes. We do not promise immediate deletion from every processor or backup. We will explain any information retained for a documented legal or security reason. Deleting your Dojojojo account does not delete your Apple or Google account or automatically cancel an existing app-store subscription; use the store's subscription controls for that.
The in-app account-deletion request does not automatically delete the Firebase authentication identity used for sign-in. Contact us if your privacy request also covers sign-in provider records.
Your privacy rights and choices
You may ask to access personal data in our possession or control, correct an error or omission, withdraw consent with reasonable notice, or make a privacy complaint. We will explain the likely feature consequences of withdrawing consent and stop the affected collection, use, or disclosure when required. Depending on where you live, you may also have rights to deletion, a portable copy, objection, or restriction. We may need to verify your identity before completing a request.
You can withdraw device permissions for HealthKit, Health Connect, or camera in device settings. This may prevent the related feature from working. Account deletion is available through the in-app Account screen or by contacting us.
Security
We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, or change. No internet transmission or storage system can be guaranteed completely secure, so contact us promptly if you suspect unauthorized access.
Age eligibility
Dojojojo is only for adults aged 18 or older and is not directed at anyone under 18. You must be at least 18 to use the app. Date of birth is self-reported and used to check eligibility; it is not proof of your actual identity or age. If you believe someone under 18 has provided personal information, contact us so we can review access and delete the information where required.
Contact and privacy complaints
Reynard and May Yee operate Dojojojo from Singapore. Our public data protection contact is team@dojojojo.com. Use that address for access, correction, consent-withdrawal, deletion, or complaint requests, or submit a message through our contact page. Please do not include passwords, health records, payment-card details, or other information that is not needed for the request.
Effective date
This Privacy Policy is effective October 12, 2026. We may update it when our services or legal obligations change. If we make a material change, we will update the effective date and provide notice through an appropriate app or service channel.