Combat HIIT

English Tiếng Việt Afrikaans አማርኛ العربية Български Català Čeština Dansk Deutsch Ελληνικά Español Eesti فارسی Suomi Filipino Français עברית हिन्दी Hrvatski Magyar Bahasa Indonesia Íslenska Italiano 日本語 한국어 Lietuvių Latviešu Bahasa Melayu Norsk Nederlands Polski Português (Brasil) Português (Portugal) Română Русский Slovenčina Slovenščina Српски Svenska Kiswahili ไทย Türkçe Українська 简体中文 繁體中文

Privacy Policy

Combat HIIT app (iOS and Android) · Effective October 22, 2026

This policy explains what data the Combat HIIT app (the “App”), published by Buca Joint Stock Company (BJSC, “we”), collects, how it is used, who it is shared with, and what rights you have. By using the App, you agree to the practices described below.

1. Summary

• The App does not require an account: no name, email or password.
• Your workout history, progress, weight, height and custom workouts are stored only on your device. The App never sends them to our servers.
• Our server is used only to verify VIP purchases, register your device for push notifications, and check that the App is genuine.
• We use Google Analytics for Firebase to understand how the App is used. Your weight, height and BMI are never sent to analytics.
• We do not sell your data.
• The App shows ads from Google AdMob. Personalized ads are shown only with your consent.

2. Data we collect

2.1. Data that stays on your device

Your workout history (date and time, workout, time trained, estimated calories, level, and whether you finished), your progress through the 30-day plan, the weights you log, your height, the custom workouts you create, your workout reminders, and your settings (level, timers, voice guide, units, language and appearance) are stored on your device and are not sent to us or to any third party. The voice guide uses your device’s built-in text-to-speech. This data may be included in your device’s own backup (such as iCloud or Google backup) if you have turned backups on. Uninstalling the App deletes it from the device.

2.2. Device identifier

Without an account, our server needs a way to know which VIP status and notification registration belong to your device, so the App sends a device identifier with each request to our server. On iOS this is Apple’s identifier for vendor (identifierForVendor); if it cannot be read, the App generates a random identifier and stores it on the device. On Android, the App generates a random identifier and stores it on the device; it changes if you clear the App’s data, or uninstall and reinstall the App without restoring from a backup. Before sending it, the App one-way hashes this identifier (SHA-256 with an App-specific value), so the server never receives the original identifier and cannot use it to recognize you in other apps. It is not an advertising identifier and contains no information about you.

2.3. Push notifications (if you allow them)

The App asks for permission after you finish a workout. If you allow it, the App sends our server a notification token issued by Firebase Cloud Messaging, your platform (iOS/Android) and the App language, together with the device identifier above, so we can occasionally send you notifications such as workout challenges or news about the App. You can turn notifications off at any time in your device settings.

2.4. Workout reminders

Reminders you set in the App are local notifications scheduled by your device for the days and times you choose. No data about them is sent to our server.

2.5. VIP purchases and rewarded ads

Payments are processed by the Apple App Store or Google Play; we never receive your card number or payment details. When you buy or restore a subscription, the App sends our server only the product identifier and the transaction identifier (App Store) or purchase token (Google Play), so the server can verify the purchase directly with Apple or Google. We store your device’s VIP status and expiry date. If you watch a rewarded ad to the end, the App tells our server, which grants your device 24 hours of VIP and records the time so that this reward can be limited.

2.6. Advertising

The App uses Google AdMob to show ads (banner, native, app-open, interstitial and rewarded ads; VIP users see no ads) and Google User Messaging Platform to ask for your consent where the law requires it (such as the European Economic Area, the United Kingdom and Switzerland). On iOS, the App asks for permission to track through Apple’s App Tracking Transparency. Google may collect your device’s advertising identifier (IDFA on iOS — only if you allow tracking; Advertising ID on Android), IP address, device information and ad interactions. How Google uses data: policies.google.com/technologies/partner-sites.

2.7. Usage analytics

The App uses Google Analytics for Firebase to count how features are used: which of the four main tabs you open; when a workout starts and ends (whether it comes from the 30-day plan, the library or a custom workout, the workout code, minutes trained and whether it was finished); when you create a custom workout, set a reminder or complete the introduction; and whether you are a VIP user. Firebase also automatically collects an app-instance identifier, device model, operating-system and App version, approximate location (country or region derived from the IP address) and in-app purchase events reported by the App Store or Google Play. The App does not send your weight, height, BMI or any other health data to analytics.

2.8. App integrity checks

To stop modified copies of the App and emulated devices from abusing VIP and notification services, the App uses Apple’s App Attest (iOS) and Google’s Play Integrity (Android). The operating system produces proof that the App is the official version running on a genuine device; Google may collect information about the device, the app and the Google Play account to reach this verdict. Our server only receives the verdict (valid or not) and a public key used for later checks — not your personal information.

2.9. Exercise videos and update checks

Exercise videos and images are downloaded from our media server (api.deepviet.com) and kept in the App’s cache on your device. These downloads carry no identifier; as with any web request, the server sees your IP address and the time of the request. To tell you when a new version is available, the App checks the App Store (on iOS, sending the App’s identifier and your device’s region) or Google Play (on Android).

2.10. Feedback and ratings

If you use Send feedback in Settings, the App sends the type of feedback, your message, your email address if you choose to leave one and — if you keep that option on — the App version, device model, operating-system version and language. When you rate the App in its rating prompt, the star rating, any comment you write, the App version and the same device information are sent in the same way. These messages go to a private channel of our team on Discord and are used only to reply to you and improve the App.

2.11. Technical logs

As with any Internet service, our servers and infrastructure providers may record IP addresses and request times to operate the service, prevent abuse and troubleshoot problems. Device identifiers are truncated before being written to logs.

3. How we use data

• To run your workouts, the voice guide, reminders and progress tracking on your device.
• To verify purchases and apply VIP benefits (every workout, unlimited custom workouts, no ads), including VIP earned by watching a rewarded ad.
• To send push notifications if you allow them.
• To prevent abuse through app integrity checks.
• To understand which features are used and to fix problems (analytics, feedback).
• To show ads that keep the free version available.

For users in the EEA / UK, our legal bases are: performing the service you request (VIP, notifications, replies to feedback), legitimate interests (security, abuse prevention, aggregated analytics), and your consent (personalized ads, tracking on iOS, push notifications).

4. Retention and deletion

Data	How long it is kept
Workout history, weight, height, custom workouts and settings	On your device only, until you uninstall the App or clear its data. We have no copy.
Hashed device identifier and notification token	Until the token expires or you uninstall the App; registrations of devices that stop opening the App are removed automatically.
VIP status, transaction identifiers and rewarded-ad records	While your plan is active and for as long as required for accounting and dispute resolution.
Analytics data	Kept by Google Analytics for the retention period set for the App, then deleted automatically.
Feedback and rating messages	Until they are no longer needed to reply to you or improve the App, or until you ask us to delete them.

5. Third parties that receive data

We share data only with providers needed for the App to work:

• Our server hosting provider — runs the VIP, notification and integrity service and its database, and serves the exercise videos.
• Google Firebase (Cloud Messaging and Analytics) — push notifications and usage analytics.
• Google AdMob and User Messaging Platform — advertising and consent management.
• Apple and Google — payment processing, purchase verification, app integrity checks (App Attest, Play Integrity) and update checks.
• Discord — delivers the feedback and rating messages you send to our team.

We may disclose data when required by law. We do not sell or rent personal data. Data may be processed in countries other than the one you live in; the providers above protect data according to their own standards.

6. Security

All connections between the App and our servers are encrypted with HTTPS. Your workout history, weight and height are not transmitted by the App at all. No system is perfectly secure, but we take reasonable measures to protect your data.

7. Your rights

• Withdraw ad consent: in the App, go to Settings → Ad privacy (shown in regions where the law requires it). On iOS, you can turn off tracking in Settings → Privacy & Security → Tracking.
• Turn off notifications and reminders: in your device settings, or remove reminders in Settings → Workout reminders in the App.
• Access or delete data on our servers: email dungtools92@gmail.com. Because there are no accounts, please include details that help us find your data (for example the purchase date and your App Store or Google Play order number). We respond within 30 days.
• Delete data on your device: uninstall the App.

Depending on where you live (for example GDPR in Europe, CCPA in California, Decree 13/2023/ND-CP in Vietnam), you may have additional rights to object, restrict processing, receive a copy of your data, and lodge a complaint with a data protection authority.

8. Children

The App is not directed to children under 13, and we do not knowingly collect data from children. If you believe a child has sent us data (for example through the feedback form), please contact us and we will delete it.

9. Changes to this policy

When this policy changes, we will update this page and the effective date at the top. Significant changes will be announced in the App.

10. Contact

Buca Joint Stock Company (BJSC) · Email: dungtools92@gmail.com