Privacy Policy

Your drawings belong to you. This policy explains how personal data is handled in the Gesture Gym app, on gesturegym.com, and when you subscribe to the newsletter.

Who is responsible?

Marcel Wichmann · Tiptop Software
Poßmoorweg 19
22301 Hamburg, Germany
[email protected]

Your drawings and iCloud

The app saves your drawings, practice history, preferences, and membership card on your device. When iCloud is available, drawings, practice history, and membership details—including your drawn portrait and signature—are also stored in your private iCloud database so they can be restored or synced between devices.

Photos you import for your own reference packs stay on your device. Gesture Gym does not upload those photos to its iCloud sync service.

Membership numbers and community counts

To assign unique membership numbers, the app creates a number record in CloudKit’s public database. To show how many people have collected or completed each weekly card, it also stores the week number and number of practice days in that public database, associated with a pseudonymous CloudKit user identifier. Other app users can access these public records. Your drawings, portrait, and signature are not included in these community records.

This information is used to provide membership and community features. It is not sold or used for advertising.

Membership purchases

Practising in Gesture Gym is free; a paid membership unlocks extra features. Memberships are bought through the App Store, and Apple handles payment. Gesture Gym never sees your name, Apple Account, or payment details.

To check and restore your membership, the app uses RevenueCat. RevenueCat receives a random identifier the app creates for your purchases, the App Store’s purchase and subscription information (such as the product, price, currency, purchase and renewal dates, trial status, and whether a subscription is active), and technical information such as the app version, device model, operating system, country or region, and IP address. This is used only to provide your membership, not for advertising or tracking.

Game Center and drawing together

If you sign in to Game Center, the coins you earn are sent to Gesture Gym’s Game Center leaderboards. Other players can see your score and Game Center name there, depending on your Game Center settings. You can use the app without signing in.

When you draw together on a shared canvas, the app uses Apple’s SharePlay to send what you draw, where you are drawing, and the name and avatar you choose to the people in that session. By default, your name is your Game Center name if you are signed in, otherwise a made-up one; you can change both in the app. The others in the session see this, and the shared canvas can be kept on their devices.

Anonymous usage statistics

To learn which packs, round types, and features get used, and where people get stuck, the app sends anonymous usage signals to TelemetryDeck. A signal says that something happened, such as a round ending (its type, the packs it used, how many drawings were kept, and whether it was finished), a pack being downloaded, an own pack or canvas being made, an app icon being picked, drawings being shared (as an image or video, and how many), or reminders being turned on or off. Packs from the Gesture Gym catalog are identified by their ID; your own packs only ever as “own”.

With each signal, TelemetryDeck receives technical information such as the app version, device model, operating system, language and region settings, and a random session identifier, together with a salted, hashed identifier derived from your device’s app identifier. This hash lets signals be counted per device without revealing who you are; it is not linked to your name, Apple Account, Game Center profile, or membership. Your drawings, photos, pack names, and anything you type are never sent. Usage statistics are not used for advertising or tracking, and are not shared with anyone else.

You can turn this off at any time in the app under Settings → Privacy → Share Anonymous Usage. When it is off, the app sends no usage signals at all.

The website and newsletter

Cloudflare hosts and protects this website. When you visit, Cloudflare processes technical request information such as your IP address, browser information, requested page, and request time to deliver the site and protect it from abuse. The drawings you make on the website stay in your browser’s memory and disappear when you reload or leave the page; they are not uploaded.

If you sign up for the newsletter, Kit processes your email address, subscription and confirmation status, and related signup information to send Gesture Gym updates. Kit may also process email-open and link-click information through its email reporting features. You can unsubscribe using the link in any newsletter or by contacting me. Signing up is optional and is not required to use the app.

When you email me, your address and message are processed to respond. Incoming domain email is routed through Cloudflare and delivered to Gmail.

Diagnostics and service providers

Apple may provide crash reports and aggregate app usage or download statistics, depending on your Apple privacy settings. These help identify problems and understand app usage. Gesture Gym does not include advertising trackers; anonymous usage statistics are described above.

Relevant providers are Apple (iCloud, Game Center, SharePlay, App Store purchases, and app distribution), RevenueCat (membership purchases), TelemetryDeck (anonymous usage statistics), Cloudflare (website hosting, security, and email routing), Kit (newsletter), and Google (email correspondence). Their information is available in the Apple, RevenueCat, TelemetryDeck, Cloudflare, Kit, and Google privacy policies. Providers may process data outside the EU/EEA, including in the United States. Where required, transfers rely on applicable adequacy decisions or contractual safeguards, such as EU standard contractual clauses. Contact me for details about the safeguards relevant to your data.

Why data is processed

Under the GDPR, processing needed to provide requested app features is based on performance of a contract (Article 6(1)(b)). Newsletter delivery is based on your consent (Article 6(1)(a)). Site security, responding to inquiries, diagnosing issues, anonymous usage statistics, and producing community counts are based on legitimate interests in operating and improving the service (Article 6(1)(f)); inquiries about a contract may also fall under Article 6(1)(b). Legal recordkeeping, where required, is based on Article 6(1)(c).

Storage and deletion

Device and private iCloud data remain until you delete them. Removing the app does not necessarily remove its iCloud data; you can manage that separately in your Apple account’s iCloud storage settings. Public membership-number records are retained to prevent numbers being reassigned, and weekly activity records remain for historical community counts. Usage signals are kept by TelemetryDeck in aggregated, anonymous form to show how the app is used over time; because they cannot be tied to you, they cannot be looked up or deleted individually. Purchase records are kept by Apple and RevenueCat for as long as needed to provide your membership and meet tax and accounting obligations. Contact me about deletion of records associated with you.

Newsletter information is retained while you subscribe. After unsubscribing, a limited suppression or consent record may be retained to respect your choice and document compliance. Correspondence is retained while needed to resolve your inquiry and meet any applicable legal obligations. Technical logs are retained according to the providers’ security and operational retention practices.

Your choices and rights

Depending on applicable law, you can request access, correction, deletion, restriction, or a portable copy of your personal data, and object to processing based on legitimate interests; for usage statistics, turning off Share Anonymous Usage in the app does this. You can withdraw newsletter consent at any time without affecting earlier lawful processing. Contact [email protected] to exercise these rights. You may also complain to your local data protection authority, including the Hamburg Commissioner for Data Protection and Freedom of Information.

Providing an email address is necessary only for newsletter delivery or a reply. iCloud-dependent features require an available iCloud account. We do not use your data for automated decisions that produce legal or similarly significant effects.

Updates

Changes to this policy will be posted here with an updated date.