1. Overview
This Privacy Policy explains how Box4Fit handles personal data when you access or use the Box4Fit website, web application, desktop application, and related services (collectively, the "Service").
Box4Fit is designed to minimize the collection of personal data. In particular, camera images used for movement detection are intended to be processed locally on your device and are not uploaded, recorded, or stored by Box4Fit unless a feature clearly informs you otherwise and asks for your permission.
2. Data Controller
The data controller for the Service is:
SAASHUP LUX S.à r.l.
13, rue de Peppange, L-3378 Livange, Grand Duchy of Luxembourg
Registered with the Luxembourg Trade and Companies Register under number B 269.103
Privacy email: [email protected]
Website: https://box4.fit
Processing is governed by Regulation (EU) 2016/679 (GDPR) and by the Luxembourg law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework. As the controller is established in Luxembourg, its lead supervisory authority is the Commission nationale pour la protection des données (CNPD).
3. Data We Process
Depending on the features you use, Box4Fit may process the following categories of data:
| Category | Examples | Typical location |
|---|---|---|
| Camera and pose data | Camera frames, detected body points, movement classifications, punches and dodges | Processed locally on your device |
| Game and fitness data | Scores, completed sessions, estimated calories, combinations, wins, settings and calibration values | Stored locally on your device; your cumulative arcade score is also sent to the multiplayer server (see Section 5) |
| Profile data | Player name, selected profile, preferences and avatar choices | Stored locally on your device; the profile name is also sent to the multiplayer server and shown in the public ranking (see Section 5) |
| Online multiplayer data | Player identifier generated on your device, profile name, cumulative score, cumulative connected time and last connection time | Stored on the Box4Fit multiplayer server, and partly published in the public ranking (see Section 5) |
| Technical data | Browser type, device type, application version, operating system and basic error information | May be processed when needed to operate or troubleshoot the Service |
| Communications | Messages, feedback or support requests that you send to us | Stored only as needed to respond and keep appropriate records |
Box4Fit does not intentionally collect medical records. Fitness estimates and gameplay statistics are provided for entertainment and general fitness purposes and should not be treated as medical information or medical advice.
4. Camera and Motion Detection
Box4Fit requires camera access to detect your body movements and provide gameplay.
- Your browser or operating system asks for permission before Box4Fit can access the camera.
- Camera images are intended to be analyzed locally on your device.
- Box4Fit does not intentionally transmit, record, or store raw camera footage.
- Detected movement information may be used temporarily to calculate punches, dodges, scores, calibration, and other game events.
- You can revoke camera access at any time through your browser or operating-system settings.
If a future feature uploads or records camera data, Box4Fit will provide additional information and request any consent required by applicable law before that feature is used.
5. Online Multiplayer and Public Ranking
When Box4Fit starts, it connects automatically to the Box4Fit multiplayer server at
wss://ws.box4.fit/players. That connection powers the online player count,
versus matchmaking and the public ranking. It never carries camera data: camera images and
pose data are processed on your device and are not sent to the server.
On connecting, and whenever your profile name or score changes, the Service sends:
- a player identifier generated on your device and kept in its local storage;
- the profile name you have chosen;
- your cumulative arcade score.
The server stores this information in a file so that the ranking survives a restart. The
profile name, cumulative connected time, last connection time, cumulative score and online
status are displayed publicly on the server's ranking page and are available through its
public /api/ranking endpoint. The player identifier itself is not published.
Please choose a profile name you are comfortable displaying publicly. Automatic clean-up
only removes entries that still carry the default name, have no score and have been idle for
more than one hour; other ranking entries are kept until you ask for their removal. To have
your ranking entry deleted, or to object to it being published, write to
[email protected].
The server also records the total number of connected players every few minutes so that it can display activity history. Those records contain a timestamp and a count only, no personal data, and are kept for 28 days.
6. Purposes and Legal Bases
Where the GDPR applies, Box4Fit may rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing gameplay, motion detection, profiles, settings, scores, and requested features | Performance of a contract or steps taken at your request |
| Providing the online player count, versus matchmaking and the public ranking (see Section 5) | Performance of a contract or steps taken at your request for the online features you use, and legitimate interests in operating a shared ranking, subject to your right to object |
| Maintaining security, preventing abuse, diagnosing faults, and protecting the Service | Legitimate interests in operating a safe and reliable service |
| Responding to support messages and requests | Performance of a contract, legitimate interests, or compliance with legal obligations |
| Optional analytics, marketing, or non-essential cookies, if introduced | Your consent, where required |
| Complying with legal obligations or lawful requests | Compliance with a legal obligation |
7. Local Storage and Device Data
Box4Fit may use browser storage, application files, IndexedDB, local storage, or similar device features to remember your profiles, game progress, scores, settings, calibration, preferences, and application version.
This information normally remains on your device. You can remove it by using Box4Fit's reset or deletion features, clearing the website's stored data in your browser, or uninstalling the desktop application. Clearing local data may permanently delete your profiles, settings, and game history.
8. Cookies and Analytics
Box4Fit may use strictly necessary storage to operate the Service, remember preferences, maintain application state, and provide offline or installation functionality.
Box4Fit does not use advertising cookies, cross-site tracking, or optional analytics. If analytics or other non-essential tracking technologies are introduced, this policy will be updated and, where consent is required, a consent interface will be provided before they are activated.
9. Data Sharing
Box4Fit does not sell your personal data.
Personal data may be shared only when reasonably necessary:
- with hosting, support, security, or technical service providers acting on our behalf;
- to comply with law, court orders, or valid requests from public authorities;
- to investigate fraud, abuse, security incidents, or threats to users and the Service;
- during a merger, acquisition, restructuring, or transfer of the Service, subject to applicable safeguards; or
- when you have explicitly asked for or consented to the sharing.
10. International Data Transfers
When personal data is transferred outside the European Economic Area, the United Kingdom, or Switzerland, Box4Fit will use an appropriate legal mechanism where required, such as an adequacy decision, approved standard contractual clauses, or another lawful safeguard.
11. Data Retention
Local profile, settings, and gameplay information remains on your device until you delete it, clear the application's storage, reset Box4Fit, or uninstall the application.
Information sent directly to Box4Fit, such as support messages, is retained only for as long as reasonably necessary to respond, resolve disputes, maintain security, enforce agreements, and comply with legal obligations.
Ranking information held by the multiplayer server — player identifier, profile name, cumulative connected time, last connection time and cumulative score — is kept until you ask for its deletion. Entries that still carry the default profile name, have no score and have been idle for more than one hour are removed automatically. Aggregate player-count history is kept for 28 days.
12. Security
Box4Fit uses reasonable technical and organizational measures designed to protect personal data. However, no website, application, network, or storage system can be guaranteed to be completely secure. You are responsible for protecting your device, browser profile, and operating-system account.
13. Children's Privacy
Box4Fit is not intended for children below the minimum age at which they can lawfully use the Service without parental authorization in their country. A parent or legal guardian should supervise minors using Box4Fit and ensure that the physical exercise and camera use are appropriate.
If you believe that a child has provided personal data unlawfully, contact us so that the matter can be investigated and appropriate action taken.
14. Your Privacy Rights
Depending on applicable law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain data in a portable format;
- withdraw consent at any time where processing is based on consent; and
- lodge a complaint with a competent data-protection authority.
Many Box4Fit records are stored only on your device and are not accessible to the Box4Fit operator. In that case, you can manage or delete them directly through Box4Fit, your browser's site-data controls, or your operating system.
To exercise a right concerning information held by the Box4Fit operator, contact the privacy address listed in Section 18. We may need to verify your identity before processing a request.
15. Complaints
You may submit a complaint to the data-protection authority in the country where you live, work, or believe an infringement occurred.
As the data controller is established in Luxembourg, its lead supervisory authority is the Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg — www.cnpd.lu.
16. Third-Party Links and Services
Box4Fit may contain links to third-party websites or services, such as community pages, software distribution platforms, or social networks. Their privacy practices are governed by their own policies. Box4Fit is not responsible for third-party privacy practices.
17. Changes to This Privacy Policy
This Privacy Policy may be updated to reflect changes to Box4Fit, legal requirements, or data-handling practices. The updated version will be posted with a revised "Last Updated" date. Material changes may also be communicated through the Service where appropriate.
18. Contact
For privacy questions or requests, contact:
SAASHUP LUX S.à r.l.
13, rue de Peppange, L-3378 Livange, Grand Duchy of Luxembourg
Email: [email protected]
Website: https://box4.fit