Privacy Policy

1. At a glance: what we collect, why, and for how long

None of the above includes scores, step-by-step logs, sound, camera images, location, or device identifiers. That data either stays on your phone or isn't collected by us at all (Sections 8 and 9). The only exception: when you tap Generate AI review and confirm, a stats summary of that game is sent (without names; Section 5).

2. Accounts and sign-in

Signing in is optional. You need to sign in with a Google or Apple account to redeem a serial code, make in-app purchases, use AI credits, or send feedback. Sign-in is handled by Firebase Authentication (provided by Google), and we receive:

• Account identifier: An ID that Firebase creates for your account. We use it to link your licenses, purchases, and feedback.
• Email address and sign-in method: Used to let you confirm which account a license will be linked to before you redeem, and to reply to your feedback and support emails. If you use Apple's Hide My Email, we receive only the forwarding address Apple provides.

To provide sign-in, Firebase Authentication processes your account identifier, email address, and sign-in times. For sign-in security and to prevent abuse, it also processes the IP address you connect from and your user agent string (version information the app or browser sends automatically when connecting). Google keeps logged IP addresses for a few weeks. Other sign-in data is kept until your account is deleted, after which Google removes it from its live and backup systems within 180 days (Section 11).

We don't receive your Google or Apple password, contacts, or other account data. Without signing in, you can still play some of the basic content in each game on the mat. Whether or not you sign in, your play records stay only on your phone (for the AI review exception, see Section 5).

3. Serial code redemption and licenses

• Redemption records: Which account redeemed which serial card, and when. Serial codes are stored only as irreversible hashes, so even our staff can't see them.
• Account entitlements: What your account has unlocked, and whether it came from redeeming a serial code or buying an Extra Account.
• Offline licenses: After you redeem, the server gives your phone a signed license so you can play offline. It needs to re-verify online from time to time. Verification only checks your account entitlements and doesn't record which phone you're using.

We don't record device data. We don't collect device identifiers, and we don't record how many phones you use. We receive your phone model only if you choose to include it when you send feedback (Section 6). The Unity engine built into the apps separately sends phone hardware information to Unity; see Section 9.

4. In-app purchases (Extra Accounts, AI credit packs)

Extra Accounts and AI credit packs are sold as in-app purchases through the App Store or Google Play, and payment is handled by Apple or Google. We never receive your credit card, payment method, or billing address.

To confirm and credit each purchase, we keep the following for every transaction: your account identifier, the store, the store's transaction ID (plus the order ID for Google), which app and product it was for, the purchase and credit times, whether it was a test purchase, and the time and reason of any refund or revocation. We don't keep prices or the original receipts.

When you buy, the app gives Apple or Google an account token calculated from your account identifier. It's recorded on the transaction so our server can confirm that the purchase belongs to your account. This token isn't your email address, but because we can calculate it from your account identifier, we still treat it as personal data.

We trust only the transaction results we get from Apple's and Google's servers. When a store tells us about a refund, we check with the store again, and then revoke the entitlements from that purchase or deduct the credits.

Apple or Google decides whether to give a refund. When reviewing a refund, Apple may ask us about your usage. We won't respond, and we don't give the store your usage data or refund recommendations.

5. AI reviews

The apps can create an AI review after each round. When you don't use AI, or AI isn't available, the app shows a free template report created on your phone. There are three AI sources. None is selected by default; you choose one in Settings:

• Custom server: In Settings, enter your own OpenAI-compatible server by hand (URL and model; the key is optional). Data goes directly from your phone to that server. We don't handle it, act as an intermediary, or store it. How that service handles data, and whether it charges fees, is governed by its own policies.
• Armor EdgeAI (external site, opens in a new tab) on your local network: Pair it by scanning its QR code. Data goes only to your own computer on your local network, never through us.
• AI credits: Use credits bought through in-app purchase, and we call an AI model on your behalf (see below).

AI never runs automatically. Each time, you tap Generate AI review, and the app shows a confirmation screen first. Nothing is sent until you confirm. With AI credits, the confirmation screen shows how many credits will be used and how many you have left.

When you use AI credits:

• What we send to the model is a summary of that round's results: the game and difficulty, your score, hits and reaction times, how you did on each square of the 3×3 grid, a few performance measures, summaries of your last few rounds, and the report language. It doesn't include your account, nickname, avatar, email address, sound, device data, or the timing sequence of your steps. The server rejects any request that contains these fields.
• Requests go through Cloudflare AI Gateway to a model service. This may be Cloudflare's own Workers AI, or a third-party model provider such as Google (see the list in Section 10). The gateway is set up not to store request or response content. It keeps only records such as the amount of text processed (token count), the cost, the result, the report language, and a code calculated from your account (not the account itself), which we use to track costs and troubleshoot errors. Once these records reach a set limit, the oldest are deleted automatically; they aren't separately deleted when you delete your account.
• We don't store the round summary or the content of the AI review. The review is sent back only to your phone. The server records only the request ID used for deducting credits, the time, the model used, the amount of text processed (token count), and the cost, to calculate credits and costs. These records are kept for 90 days, and are deleted earlier if you delete your account.
• Your credit account records your balance and every change to it (purchases, use, credits returned when a review fails, deductions for refunds, and credits added or deducted by support). It's deleted when you delete your account, and any unused credits are forfeited.
• To control costs, each account has a daily usage limit. The count uses a code calculated from your account, not the account itself, and is kept for up to 3 days.

AI reviews are generated by an AI model. They may be inaccurate, are for reference only, and are not medical or professional advice. You can report a problem with a review right next to it, and the report goes to our feedback inbox (Section 6).

6. Feedback and support

When you send feedback in the app, it includes: your feedback text (up to 500 characters), the app name, the feedback type, language, date, and your account identifier. The app version, OS version, and phone model are included only if you check the box to add them.

Feedback is sent with your account so we can reply to the email address you signed in with. Staff handling your feedback may add internal notes, which are kept and deleted along with that feedback. We keep feedback for one year, and it's also deleted when you delete your account.

When you email support, we use the information you give us (email address, proof of purchase, such as a receipt or invoice, store order ID, and so on) to handle your request. We use proof of purchase only to verify your purchase, and you can cover up any details not needed for that. Please don't include any passwords in your email. If we need your serial code, we'll ask for it.

7. Anonymous usage statistics

If you sign in, you can turn on usage statistics in the app's settings. It's off by default. When it's on, the app sends only daily totals: how many rounds of each game were played, a range for how long you played, the app version, and the app language.

• Off by default, and sent only with your consent. You can turn it off anytime in Settings and view what has been sent.
• Each app sends at most once a day, and only four kinds of numbers: how many rounds you played of each game (or mode or sport) that day, roughly how long you played that day (a range such as "10–30 minutes"), the app version (such as 1.2), and the app language. It contains no scores, device model, or timestamps, and is stored separately from the sign-in system.
• To prevent abuse, uploading requires signing in with a Google or Apple account. Once the server confirms the account is real, it discards the sign-in data and keeps neither the account nor the IP address. To avoid counting the same day's data twice, the server temporarily keeps a code calculated from the account, app, and date (not the account itself) for up to 10 days.
• In transit, our network provider (Cloudflare) handles IP addresses, but we don't store them or link them to accounts.
• Uploads are merged each day into daily totals across all users. The uploaded data is deleted within 3 days after the end of the day it was received, and only the daily totals are kept. Totals are deleted after one year. Internal reports are weekly, and any cell with fewer than 10 entries is hidden.

8. Data stored only on your phone, microphone, camera, and local network

The following data is stored only on your phone and is not uploaded (except that when you tap Generate AI review and confirm, a stats summary of that game is sent; see Section 5):

• Player profiles (nickname, avatar)
• Scores and reports (including AI reviews), plus a detailed log of every step
• Settings and mat calibration data
• MotionSports match replays

You can export your scores to a file in the app and import them when you switch phones. Please export before deleting the app or switching phones. Signing back in to your account restores your game licenses, but not the history stored on your phone. You're responsible for keeping and sharing any exported files.

Microphone: The mat sends your steps as high-frequency sound, so the app needs microphone permission to receive them. Sound is analyzed on your phone in real time. It is never recorded, saved, or uploaded. You can turn off microphone permission in your phone's settings, but then the mat can't control the games.

Camera: Used only to scan QR codes (your serial card and Armor EdgeAI pairing codes). Images are processed on your phone and are never saved or uploaded. You can also type in the serial code instead of granting camera access.

Local network: Used only when you connect to an Armor EdgeAI device or your own server on your local network, to send AI review requests to that device. It isn't used for anything else.

9. Data we don't collect

We don't collect: sound, location, device identifiers, advertising identifiers, phone models (except when you choose to include them with feedback), contacts, photos, precise play timestamps, or the timing sequence of your steps. The apps have no ads and no tracking tools, and apart from the Unity hardware statistics described below, no third-party analytics tools.

Unity hardware statistics: The four apps are built with the Unity engine. While an app is running, the engine's built-in hardware statistics (Unity Hardware Statistics) send your phone's hardware and system information (for example, device model, operating system version, processor, graphics chip, memory, and screen resolution) to Unity Technologies, so that Unity can compile statistics on the hardware people use. This may also include a device identifier and the IP address of the connection. Unity collects this data itself and handles it under Unity's privacy policy (external site, opens in a new tab). It doesn't include your account or your scores, and we don't receive it. The current versions of the apps have no in-app setting to turn this off.

10. Service providers and international transfers

We use the following service providers to process data. Cloud data is stored outside Taiwan and processed by these providers on our instructions and under their terms:

In addition, Unity Technologies collects phone hardware information itself as described in Section 9 (not on our behalf); this data may be transferred outside Taiwan, including to the United States.

Except for the service providers above, when required by law, or to protect your rights or the rights of others, we don't share your personal data with anyone. We don't sell your personal data, and we don't use it for advertising.

11. Retention and deletion

• Accounts, redemption records, and account entitlements: kept as long as your account exists, and deleted when you delete your account. Redeemed serial codes stay marked as used and don't become redeemable again, but they're no longer linked to your account.
• In-app purchase records: your account identifier is removed when you delete your account. The transaction ID, product, and time are kept for as long as accounting and tax laws require, for refunds and reconciliation.
• AI credit balance and history: kept as long as your account exists. Records of credit-deducting requests are kept for 90 days, and daily usage counts for up to 3 days. All of these are deleted when you delete your account. AI Gateway records (without content) are deleted automatically once they reach a set limit.
• Feedback: kept for one year, or deleted along with your account if you delete it.
• Customer service emails: kept as long as needed to handle your case; records related to purchases and returns that the law requires us to keep are kept for the period the law requires.
• Usage statistics: uploaded data is deleted within 3 days after the end of the day it was received, the code used to avoid double counting is kept for up to 10 days, and daily totals are kept for one year.
• Store notification records (without account information): one year.
• Admin and system activity logs: Every action our staff take in our admin system, and entitlement changes our system makes automatically (for example, revoking an Extra Account entitlement after a store refund), are logged, including what was acted on (an account identifier or serial card). We use these logs for auditing and to show that we've handled your requests. They can't be changed or deleted, and are kept long term.

Deleted data is removed from our database right away. When you delete your account, your account identifier and the deletion time are also kept briefly, to block sign-in credentials issued before the deletion; we check once a day and clear them once the sign-in account is confirmed deleted. Copies in our database backups are automatically overwritten within 30 days, and backups are used only to recover from failures. Your sign-in account is managed by Google's Firebase Authentication: when you delete your account, we also delete your sign-in account, and Google removes the related data from its live and backup systems within 180 days (Section 2).

12. Data security

• All data is encrypted in transit (HTTPS). Serial codes are stored only as irreversible hashes.
• Only verified staff can access our admin system. Access depends on each person's role, and every action is logged. Sensitive actions, such as viewing customer data or generating serial codes, have daily limits.
• Server logs don't record sign-in credentials or full serial codes, and keep only the last few characters of account identifiers.
• We collect only the data needed to provide our services (Section 9).

If personal data is stolen, leaked, altered, or otherwise compromised, we'll notify you once we've looked into it, by email, an in-app notice, a notice on this website, or another suitable way. We'll explain what happened and what we've done about it.

13. Your rights

Under Article 3 of Taiwan's Personal Data Protection Act, you may ask us to let you inquire about or review your personal data, give you a copy of it, supplement or correct it, stop collecting, processing, or using it, or delete it.

1. Email service@genius-gh.com from the email address you sign in with, and tell us which right you want to exercise. We ask you to write from your sign-in address to confirm you own the account. If needed, we may ask for more information to verify your identity.
2. Inquiries, reviews, and copies: we'll reply within 15 days and give you an electronic file of your account's data in the cloud (account email and sign-in method, entitlements, redemption records, purchase records, AI credit history, feedback, and so on).
3. Supplementing, correcting, stopping processing, or deleting: we'll handle your request and reply within 30 days.
4. If necessary, we may extend these periods once (by up to 15 days for inquiries and copies, and up to 30 days for other requests), and we'll tell you why in writing.

Data on your phone (Section 8) isn't in our systems. Please view, export, or delete it directly in the app.

If you choose not to provide data: You can play some of the basic content in each game on the mat without signing in. However, without signing in, you can't redeem a serial code, make in-app purchases, use AI credits, or receive replies from us. If you turn off microphone permission, you can't use the mat to control the games.

14. Deleting your account

You can delete your account in any of the four apps: Settings → Account → Delete account. To confirm it's really you, the app will ask you to sign in again.

After deletion, your account, entitlements, AI credits, and feedback are all deleted. Licenses and unused credits can't be restored and won't be refunded, and redeemed serial codes can't be used by anyone again. See Deleting your account for details. If you can't open the app, email service@genius-gh.com from the email address you sign in with.

15. Age requirement and minors

This service is intended for users aged 13 and over. Minors need a parent's or guardian's consent to sign in and make purchases.

Whether or not you sign in, scores and play records stay only on your phone; only when you tap Generate AI review and confirm is a stats summary of that game sent (without names). If you believe a child under 13 has given us personal data without a parent's or guardian's consent, email service@genius-gh.com and we'll help delete it.

16. This website

This website has no account features and sets no cookies. When you open the home page, you're directed to a language version based on your browser's language setting; this choice isn't stored. If you pick a light or dark theme with the button at the top of the page, the choice is kept only in your browser (localStorage) and is never sent to us; switching back to your system's theme clears it.

Website analytics: This website is hosted by Cloudflare, and Cloudflare automatically inserts its website analytics script (Cloudflare Web Analytics) into every page. While you browse, the script sends Cloudflare the following: the path of the page you view (without any query string in the URL), the site that linked you here, your device type, browser and operating system, your country or region, and how fast the page loaded. The script doesn't use cookies or localStorage, and it doesn't use your IP address or browser details to identify or track you. We only view aggregated traffic statistics (for example, views per page) in Cloudflare's dashboard to understand how the website is used and to improve it. They're never linked to app accounts, and the aggregated statistics are kept in Cloudflare's dashboard for up to about 6 months. You can block static.cloudflareinsights.com with your browser's content blocker without affecting how the website works.

Apart from the website analytics above, this website uses no other third-party tracking or analytics tools. We've turned off request logging for the website. Any processing Cloudflare does for security and network operations (such as blocking malicious traffic) is governed by its own policies.

Developer site: This section also applies to the developer site (motionpad-developers.genius-gh.com). It works the same way as this website: it has no account features and sets no cookies, and your theme choice is kept only in your browser. It is also hosted by Cloudflare, and the website analytics described above apply to it too.

17. Policy updates and contact

When we update this policy, we'll post the changes on this page and update the date. For significant changes that affect your rights, the app will show an update notice, and tapping Continue and continuing to use the app means you accept the new version. If we want to use your data for a new purpose that needs your consent, we'll ask for it first.

This policy covers data collected by Genius Holdings Co., Ltd. (薩摩亞商傑尼斯投資控股有限公司台灣分公司), located at 10F, No. 66, Sec. 1, Chongyang Rd., Sanchong Dist., New Taipei City, Taiwan. If you have any questions about this policy or your personal data, email service@genius-gh.com.