New Game PlusPrivacy Policy
Effective August 26, 2026
The short version. New Game Plus is a local-first game. Your data lives on your device and is backed up to an anonymous account so you don't lose it. There are no ads and no advertising identifiers, we never ask for your name, email or a password, and nothing is ever sold. We do use one analytics tool — PostHog — to see how the game is actually played. It never receives the numbers you log about your body, and you can switch it off in Settings → Analytics. You can erase everything from inside the app in two taps.
This policy covers the New Game Plus mobile app for iPhone and Android, and this website. It describes what the app collects, why, who it is shared with, and the choices you have.
Data the app keeps
- Profile you enter: age, sex, height, weight, activity level, and goals — used only to compute your daily targets.
- Daily logs: water, steps, calories, protein, sleep, weigh-ins, gym check-ins, and screen-time quest results.
- Game progress: levels, gear, streaks, gold, and settings.
All of this is stored on your device and mirrored to our server (hosted on Supabase), tied to your anonymous account and readable only by you. Some health and fitness information is therefore stored on our servers, not only on your phone.
Your account
The app quietly creates an anonymous account to hold your save. There is no sign-up: we never collect your name, email address, or password. Your account is identified only by a random identifier generated on first launch and stored on that device, which means there is no way for anyone — including us — to log in as you from another device.
Device permissions
The app asks for each of these only when you first use the feature that needs it, and it works without them — you just lose that feature.
| Permission | Used for | Where the data goes |
|---|---|---|
| Location (while using the app) | Checking you in at the gym and noticing when you leave | Coordinates go to the OpenStreetMap Overpass API to find gyms near you. We never store your location on our servers. |
| Camera | Scanning meals, barcodes and water bottles | The photo goes to our server and on to Google's Gemini API, then is discarded. |
| Photo library | Analysing a meal photo you already took | Same as camera. Only the image you pick is read. |
| Microphone | Describing a meal out loud instead of typing it | The clip goes to our server and on to Gemini, then is discarded. |
| Motion & fitness | Counting your steps toward the daily goal | Stays in your save data. There is no Apple Health or Health Connect integration. |
| Screen Time (iPhone only) | The sleep and screen-time quests | Stays on your device — see below. |
| Notifications | Local reminders and quest nudges | Scheduled on your device. No server ever pushes to your phone. |
Sleep & screen time (iPhone only)
The sleep and screen-time quests use Apple's Screen Time frameworks (Family Controls and Device Activity). You choose which apps count toward your budget, and that selection is held by iOS in an opaque token the app cannot read.
The app is only told when a threshold you set has been crossed — it never receives your actual usage minutes, and neither does our server. Real minute counts are rendered only inside a sandboxed Apple extension that cannot send anything anywhere. The sleep quest works the same way: it infers whether you picked up your phone overnight from those threshold events alone.
These features are not available on Android.
Meal & water scanning
When you scan a meal or bottle, or describe a meal by voice, that photo or audio clip is sent to our server and forwarded to Google's Gemini API to estimate nutrition. The app asks for your permission before the first AI scan, and nothing is sent until you allow it — you can change that choice anytime in Settings → AI scanning. Photos and audio are processed and discarded — we store only a daily count of scans, to enforce a monthly fair-use limit. Food search sends your search text or barcode to USDA FoodData Central and Open Food Facts.
Subscriptions & purchases
New Game Plus Pro is purchased through Apple's App Store or Google Play. We never see your payment details — the store sends us a purchase receipt, which we verify to record your subscription status (plan, status and expiry date) against your anonymous account. The stores also tell us when a subscription renews, lapses or is refunded. If you buy an extra-scan pack, we verify it the same way and keep your remaining scan balance against your account until you use it.
Analytics, crash reports & session recordings
To work out which parts of the game people actually use — and which parts quietly break — the app sends usage data to PostHog, a product analytics service we run on PostHog's US cloud. This is the one measurement tool in the app. It is not advertising, it is not shared with anyone else, and you can turn it off.
You can switch it off at any time in Settings → Analytics. That stops events, crash reports and recordings from that moment onward; the game is unaffected. It does not retroactively erase what was already collected — see Deleting your data for that.
What it receives
| What | Detail |
|---|---|
| Actions in the game | A fixed list of events: finishing onboarding, claiming a quest, logging a meal, water or a weigh-in, starting and finishing a battle, checking in and out of the gym, equipping or forging gear, opening the paywall, and subscribing or restoring. Each carries a little context — which battle level, whether you won, which food lane you used, which quest you claimed. |
| Screens you open | Which screen or tab you moved to, and when the app was installed, updated, opened or backgrounded. |
| Crash reports | Uncaught errors and their stack traces, so a crash we never see on our own phones still gets fixed. |
| Session recordings | A sampled share of app sessions (roughly one in four) is replayed as a recording of the interface. Text you type is masked, the scan camera preview is masked, and every screen that displays your logged figures — Daily Tracking, Profile & Targets, the food sheet, the gym card, the onboarding questions and the goal rows on the home screen — is masked out of the recording. |
| Device & app | Device model, operating system version, app version, language, timezone, and a random identifier for this install. Tied to your anonymous account ID so a person's events hold together across a reinstall. |
| IP address | Received the way any server receives it. We have location lookup switched off, so no country, region or city is derived from it or stored on the event. |
What it never receives
The numbers you log about your body stay out of analytics entirely. PostHog is told that you logged a meal and which lane you used — never the calories, the protein, the food, or the photo. The same goes for how much water you drank, what you weigh, how long you trained, your steps, your sleep and your screen time. It never receives the profile figures behind your targets — your age, sex, height or weight — nor your coordinates or the name of your gym, nor your name or email, which we don't have in the first place, nor any advertising identifier.
Two preferences from onboarding do go with it, because they say who the game is being built for: whether you chose metric or imperial, and whether your goal is to lose, gain or maintain weight. Neither is a measurement of you.
Nothing collected here is used to track you across other companies' apps or websites, and none of it is sold.
Who we share data with
We do not sell your data and we do not share it for advertising. These are the only third parties involved, and each only receives what its feature needs:
| Service | What it receives | Why |
|---|---|---|
| Supabase | Your anonymous account ID and your save data | Hosts our database and backs up your save |
| PostHog | Usage events, screens opened, crash reports and sampled session recordings, tied to your anonymous account ID — never your logged health figures | Shows us how the game is played and what is broken |
| Google (Gemini API) | Meal photos, bottle photos and voice clips you submit | Estimates nutrition from what you scanned |
| USDA FoodData Central | Your food search text or barcode | Looks up nutrition facts |
| Open Food Facts | The barcode you scanned | Looks up packaged-product nutrition |
| OpenStreetMap (Overpass) | Your approximate coordinates, at check-in only | Confirms there is a gym where you are |
| Apple / Google | Your purchase receipt | Sells and verifies the subscription |
We may also disclose data if we are legally required to, or to protect the service from abuse.
What we don't do
- No ads, no advertising identifiers, and no advertising or attribution SDKs.
- No health data in analytics — the figures you log stay in your save.
- No tracking across other companies' apps or websites.
- No selling or sharing of your data, beyond the processors named above.
- No analytics you can't refuse: Settings → Analytics turns PostHog off and the app carries on working exactly as before.
How long we keep it
Your save is kept for as long as your account exists, so that it is there when you reinstall. Daily scan counts are kept for the current month only. Subscription records are kept while the subscription is active and afterwards for as long as we need them for tax and accounting. Meal photos and voice clips are never stored — they are processed and dropped. Analytics events and crash reports are kept while we still need them to understand how the app is used; session recordings expire automatically on PostHog's retention schedule, which is far shorter. Everything else disappears when you delete your account.
Deleting your data
In the app: Settings → Account → Delete account. This permanently removes your account, your save, your scan counts and your subscription record from our servers, immediately and irreversibly, and drops the link between this device and its analytics history. Deleting the app removes all local data.
Analytics records are the one thing that step does not reach: they sit in a separate system at PostHog. If you want those erased too, turn analytics off in Settings and email us before deleting the account — because the account is anonymous, it has to still exist for us to find the right records. What is left behind afterwards is a stream of gameplay events with nothing identifying attached to it.
You can also request deletion without the app.
Your rights
Depending on where you live you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to complain to your local data protection authority.
Because your account is anonymous, the app itself is the fastest route: your data is visible in the app at all times, and deleting your account exercises the deletion right in full. For anything else, email us — but note that we may be unable to link an email address to an anonymous account without information only you can supply.
If you are in the EEA or UK: we process your data to provide the service you asked for (performance of a contract) and, for optional features like scanning, on the basis of your consent, which you can withdraw by not using them. Analytics and crash reporting rest on our legitimate interest in understanding and fixing the app; you have the right to object to that, and Settings → Analytics gives effect to it immediately, without having to write to us. We are the data controller; PostHog and the other services listed above are our processors.
If you are in California: we do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA — analytics data goes to PostHog as a service provider, under contract, and is not used for advertising. We have not sold or shared personal information in the preceding twelve months. We will not discriminate against you for exercising your rights.
Where your data is processed
Our processors are United States companies, so your data may be stored and processed in the United States regardless of where you use the app.
Children
New Game Plus is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the app, email us and we will delete the account.
Attributions
Gym locations come from OpenStreetMap, © OpenStreetMap contributors, available under the Open Database License. Nutrition data comes from USDA FoodData Central and from Open Food Facts, also available under the Open Database License.
Changes
If this policy changes, the effective date above will be updated, and material changes will be flagged in the app.
Contact
Questions or requests about your data: geehwan@gmail.com.