Effective date: 2 September 2026
Last updated: 2 September 2026
1. Scope
This policy describes how we process personal data when you use Cardio Bunny on iPhone and iPad, wherever you are.
Cardio Bunny is a fitness app. It may include a personalized cardio plan, live heart-rate zones, cardio games (including Zig Zag Ball and stairmaster sessions), progress tracking, and optional Health app sync.
We do not use health or fitness data for advertising. We do not sell personal data.
2. Data we process
2.1 Profile and onboarding (on your device)
You may provide, and we store on your device:
- display name
- email address (optional, in Profile)
- sex, age / date of birth
- height, weight, target weight
- fitness goal, training frequency, location, and pace
- diet type, barriers, aspirations, and whether you work with a coach
- how you heard about us
- unit, language, and appearance preferences
This is used to personalize your plan and show your profile. It stays on the device unless you send it to us yourself (for example by emailing support).
There is no Cardio Bunny user account on our servers yet. Sign in with Apple is not active. Deleting the app removes this data from the device.
2.2 Workout and heart-rate data (on your device)
During and after sessions we may store locally:
- session start time and duration
- calories and estimated fat burn
- average BPM and heart-rate zone time
- streaks, achievements, and monthly summaries
- the local identifier of a paired heart-rate device (so we can reconnect)
Live BPM can come from a Bluetooth heart-rate strap or watch, or from the Health app if you turn that on.
2.3 Health app (optional, your permission)
If you connect the Health app, we may:
- read: heart rate and active energy
- write: completed workouts
You can turn this off in Cardio Bunny and in your device settings (Health permissions). Turning it off in the app stops our use of Health data. It does not by itself revoke the system permission.
We never use Health data for ads, marketing profiles, or sale. It is used only to show live BPM, estimate effort, and save workouts you complete.
2.4 Bluetooth heart-rate devices (optional)
With your permission we connect to a Bluetooth heart-rate monitor (strap or watch) to show live BPM during training. We store the device’s local identifier on your device. Heart-rate samples are processed on the device and are not uploaded to our servers.
2.5 Camera, photos, and video (optional, on your device)
- Camera: live preview as a stairmaster background. The preview is processed on the device. We do not upload the camera stream.
- Photo library: you may pick a photo (for example a crop during onboarding) or a video as a game background.
- Screen recording: you may record a session (microphone off) and save the video to Photos. Recordings stay on the device unless you share them yourself.
2.6 Notifications (optional)
With permission we send local reminders (for example workout nudges). We do not operate a push-notification server for these reminders.
2.7 Subscriptions (RevenueCat and Apple)
Full access is sold as an auto-renewable subscription (weekly or yearly) through Apple, under the name Cardio Bunny Plus.
To check entitlement we use RevenueCat. We generate an anonymous app user ID (stored in the Keychain on your device) and send it to RevenueCat with purchase and receipt information needed to validate the subscription.
RevenueCat may process: anonymous user ID, product identifiers, purchase status and dates, device and app version, and country / storefront. Apple processes payment. We do not receive your full card number.
RevenueCat privacy: https://www.revenuecat.com/privacy
Apple privacy: https://www.apple.com/legal/privacy/
2.8 App Tracking Transparency (optional)
We may ask for permission to track activity across other companies’ apps and websites, to measure advertising performance.
If you allow it, we may access an advertising identifier and related measurement data. If you deny it, we do not use that identifier for tracking. You can change this in your device privacy settings (Tracking).
Health data, heart-rate data, body metrics, and workout history are never used for tracking or ads.
2.9 Support
If you email helpcardiobunny@wedobrandshq.com, we process the address, message, and any attachments you send, to reply and improve the app.
2.10 Technical data on the device
The app stores preferences and history in iOS storage (including UserDefaults and Keychain). We do not run our own analytics backend. The device also keeps standard OS logs that you do not send to us unless you share them.
3. Why we process data
Where applicable law requires a legal basis (for example GDPR in the EU/UK):
Purpose: provide Cardio Bunny (plan, zones, games, history).
Legal basis: contract.
Purpose: Health app and Bluetooth heart rate.
Legal basis: explicit consent (including for health-related data where required).
Purpose: camera, photos, recordings.
Legal basis: consent.
Purpose: notifications.
Legal basis: consent.
Purpose: subscriptions (RevenueCat, Apple).
Legal basis: contract; legitimate interest in preventing fraud and abuse.
Purpose: ads measurement (ATT, if you allow).
Legal basis: consent.
Purpose: support emails you send.
Legal basis: legitimate interest or steps before a contract.
Purpose: legal duty (accounting, requests from authorities).
Legal basis: legal obligation.
You can withdraw consent in device settings or in the app (Health, notifications, Bluetooth, tracking). Withdrawal does not affect processing already done.
4. Sharing
We share data only as follows:
- Apple — App Store, in-app purchases, Health (if you connect it), and OS permissions.
- RevenueCat — subscription status (see section 2.7).
- You — if you save or share a recording or screenshot.
- Providers we instruct (hosting for this website, email) — only as needed to run the service, under contract.
- Law — if required.
We do not sell personal data. We do not share Health app data with data brokers or ad networks.
5. International transfers
RevenueCat and Apple may process data in the United States or other countries. Where required by law, we rely on appropriate safeguards (for example Standard Contractual Clauses or equivalent mechanisms). See RevenueCat’s and Apple’s privacy policies for details.
6. Retention
On your device: until you delete the data in the app (where available) or delete the app.
RevenueCat: for the life of the subscription relationship and as needed for receipts, taxes, fraud prevention, and legal claims.
Support email: as long as needed to handle the request, then as required by law (for example accounting).
We do not keep a copy of your onboarding profile, heart-rate stream, or workout history on our own servers.
7. Security
Data on the device is protected by iOS (including Keychain for the anonymous subscription ID). Live camera and heart-rate processing run on the device. No method is 100% secure. Keep iOS updated and use a device passcode or Face ID / Touch ID.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent.
Because most app data is only on your device, the practical way to erase it is to delete the app and revoke Health, Bluetooth, camera, photos, notifications, and tracking permissions in device settings.
To delete the RevenueCat anonymous ID association, email helpcardiobunny@wedobrandshq.com from a contact you can verify and ask us to delete subscription records we can legally remove. Apple’s copy of the purchase remains with Apple.
You may lodge a complaint with a data protection authority in your country or region.
9. Children
Cardio Bunny is a fitness product. It is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact helpcardiobunny@wedobrandshq.com and we will delete what we hold.
If you are under the age required in your country to consent to data processing on your own (for example 16 in some EU countries), use the app only with a parent or guardian.
10. Not medical advice
Cardio Bunny is for fitness training, not diagnosis or treatment. Heart-rate zones and calorie / fat estimates are approximations. Consult a professional before starting a new exercise program, especially if you have a medical condition.
11. Changes
We may update this policy. The “Last updated” date will change. Material changes will be posted at https://wedobrandshq.com/cardiobunny/privacy.html. Continued use after the update means you accept the new policy, unless the law requires extra consent.
12. Contact
Healthy Steps LLC
Email: helpcardiobunny@wedobrandshq.com