Privacy Notice

Project O2 · Version 2026-09-04 · Portugal

Project O2 is a fitness contest app. You stake real money on hitting your own daily activity targets, and money you forfeit goes to the people who did hit theirs. To run it we handle two sensitive categories of information: your health data and your money. This notice explains exactly what we do with both, in plain terms.

The short version. We read the daily totals you approve from Apple Health or Health Connect, and only those totals, never your raw location, workouts, heart rate or medical history. We hold them so a contest can be judged and so we can detect cheating. We never sell them, and we never use them for advertising. You can export or delete everything, and deleting your account anonymises your financial records rather than destroying the accounting we are legally required to keep.

1. Who is responsible

The data controller is the operator of Project O2, contactable at privacy@theprojecto2.com. Postal address available on request. If you are in the EU or UK and believe we have mishandled your data, you may complain to your national supervisory authority; in Portugal that is the CNPD.

2. What we collect, and why

Data	Why	Legal basis (GDPR)
Email address, password (hashed), display name	To create and secure your account	Contract, art. 6(1)(b)
Date of birth	To prove you are 18 or over, which is a legal requirement for a real-money service	Legal obligation, art. 6(1)(c)
Daily health totals (steps, distance, flights climbed) for the days a contest covers, plus a 30-day baseline used to set your targets	To judge whether you met your target, to set fair targets, and to detect fabricated activity	Explicit consent, art. 9(2)(a), which you give separately and can withdraw
Wallet balance, deposits, withdrawals, stakes, payouts, ledger entries	To run the contests and keep books that balance	Contract, art. 6(1)(b), and legal obligation for accounting records
Country, derived from your connection	To honour the countries we are permitted to operate in	Legal obligation, art. 6(1)(c)
Device and payment fingerprints, stored only as irreversible hashes	To detect one person running several accounts to farm referral rewards	Legitimate interests, art. 6(1)(f), preventing fraud
Identity documents, if you pass a withdrawal threshold	Anti-money-laundering checks, handled by our payment provider	Legal obligation, art. 6(1)(c)

Health data deserves a separate paragraph

Health data is a special category under article 9 of the GDPR, so we ask for your explicit, separate consent before we store or process any of it, and the app records which version of this notice you agreed to and when. Granting your phone's health permission is not the same thing as consenting to us. If you decline, you can still browse the app; you simply cannot enter a contest, because there would be nothing to judge. You can withdraw the consent at any time in Settings, which stops further processing.

We receive daily totals only. We do not receive, ask for, or want your workout routes, GPS traces, heart rate, sleep, weight, menstrual data, medical records, or anything else your phone's health app may hold.

3. What we never do

We never sell your data, to anyone, for any price.
We never use health data for advertising, and no health signal is ever sent to an advertising service.
We never share your health data with other users. Other racers see a display name and a progress percentage, nothing else. If you opt out of leaderboards, they do not see even that.
We do not make automated decisions that produce legal or similarly significant effects about you. Anti-cheat scoring is automated, but a human being makes every decision that affects your money or your account, which is your right under article 22.

4. Who else touches your data

Processor	What they handle	Where
Stripe	Card and bank payments, identity checks for withdrawals. They are the payment controller for those operations and hold their own card data; we never see your card number.	EU/US, standard contractual clauses
Hetzner Online GmbH	The servers holding the database	Germany
Apple / Google	App distribution, subscription billing. Your health data does not pass through them.	EU/US

Our servers are in Germany. Where a processor moves data outside the EEA, it is under standard contractual clauses.

5. How long we keep it

Health totals: for the contest they relate to, plus 12 months, so a disputed result can still be examined.
Financial records: 10 years, because Portuguese accounting and anti-money-laundering law requires it. This is why deletion anonymises rather than erases them.
Account details: until you delete your account.
Anti-cheat hashes: 24 months.

6. Your rights, and how to use them

You have the right to access, correct, delete, restrict, object, and to receive your data in a portable form. Two of these are built into the app rather than requiring an email:

Export: Settings, Privacy and data. Produces one JSON file with your account, consents, health days, ledger and social records.
Delete: Settings, Close your account. See section 7, because money changes how this works.

For anything else, write to privacy@theprojecto2.com. We answer within 30 days.

7. What deletion actually does

We would rather tell you precisely than reassure you vaguely.

You cannot delete an account holding money. The app will refuse and offer to transfer your whole balance to your bank first, with no minimum and no fee. We are not keeping your money; we are refusing to destroy the only account that can claim it.
Deletion is also refused while a stake is in an unsettled race, while a payout is still in flight, and for 14 days after a payout is marked paid, because a bank can return a transfer during that window and the money would otherwise land in an account nobody can reach.
Once allowed, we erase your email, name, password, date of birth, health days and social records.
Financial ledger entries are kept but anonymised, attached to a random identifier that is no longer you. The books must still balance for the people you raced against, and the law requires us to retain them.
Unspent promotional credits are cancelled. They were never withdrawable cash and they end with the account.

8. Advertising

The free tier may show ads on two browsing screens only, never on a wallet, staking, or results screen. No advertising is requested at all unless you have given a recorded consent decision, and no health data ever reaches an advertiser. Premium removes ads entirely.

9. Children

Project O2 is strictly 18+. We ask for your date of birth at registration and refuse the account outright if you are under 18. We do not knowingly hold data about children; if you believe we have, write to us and we will delete it.

10. Changes

The version and date are at the top of this page. The app records which version you accepted. If we make a change that affects how we handle health data or money, we will ask you to accept the new version rather than quietly updating this page.