PoseTracker Privacy Policy

At PoseTracker, we are committed to protecting the privacy and personal data of our users. This privacy policy explains how we collect, use, store, and protect personal data in accordance with the General Data Protection Regulation (GDPR). It covers the public website (posetracker.com), the signed-in product (app.posetracker.com), the tracking API and SDKs, the assistant chat, and agents you connect (the MCP connector).

When you create an account we collect:
- Email address
- Password (stored as a secure hash)
- First and last name
- Optional company or project details you choose to provide

When you use the product we also process:
- Your API key identifier and plan, so we can authenticate tracking calls
- Tracking credit and AI credit balances, and an append-only ledger of credit movements used for billing and abuse prevention
- Assistant conversations: the text you send, the assistant replies, draft or saved custom-movement specifications, and technical metadata such as token counts

- If you mark frames on a local video, the count and timestamps of those marks — not the video file and not the still images (images are sent only to generate that assistant turn)
- Support requests you submit
- Payment and subscription identifiers processed by our payment provider (Stripe) when you subscribe
- Technical logs reasonably needed for security (for example IP address, user agent, and error reports)

Pose estimation in your application typically runs on the end-user device. We receive what your integration sends to our tracking API for metering and the service you requested. We do not ask you to upload raw workout videos to the assistant.

PoseTracker, including the PoseTracker AI app, does not use facial recognition, Face ID, or any face template to identify a person. During an exercise, the on-device pose model estimates body keypoints, including five points on the head (nose, eyes, and ears). Those coordinates are used only to draw the skeleton and count repetitions.

Camera frames and videos selected from the photo library are processed on the device for that session. We do not store face images, facial geometry, or a biometric identifier, we do not share them with third parties, and we do not retain them after the session ends.

We use this information to:
- Authenticate you and provide the API, SDKs, and assistant
- Meter tracking calls and assistant turns, enforce plan limits, and refill monthly wallets
- Generate assistant replies and custom-movement drafts through a language-model provider
- Communicate about service updates, security, and billing
- Prevent abuse, debug incidents, and comply with law

We do not sell your personal data. We do not use assistant chats to train a public PoseTracker model.

The assistant is available only to signed-in users. A typical language-model turn sends the conversation text needed for that reply. When you confirm marked video frames, the JPEG stills you selected are included in that turn and are not persisted in the chat after the call. Your PoseTracker API key is never sent to the model. Off-topic use may be refused and may consume extra AI credits as described in the Terms of Use.

You can connect an agent you choose, such as Claude or Cursor, to your existing PoseTracker account through the MCP connector (setup, https://mcp.posetracker.com/api/mcp). Nothing about your account is shared until you sign in at app.posetracker.com and click Allow.

After you allow it, that agent receives only what the permissions you granted cover: your email, plan and remaining credits; the public exercise catalog; integration code that keeps the placeholder YOUR_API_KEY; your saved custom movements and skeleton presets; and assistant replies.

If you grant the API key permission, the agent also receives your tracking API key so you can store it in your app configuration. We do not send camera video or workout recordings to the agent. The API key is still never sent to the language model that drafts assistant replies.

The agent is a service you choose. We return those tool results to it because you instructed us to. It is not one of our subprocessors. The agent cannot create an account for you and cannot pay: a billing tool only returns a Stripe link that you open and confirm yourself. You can disconnect the agent at any time under Settings → Account → Connected agents, which revokes its access.

We store the agent’s client registration, the permissions you granted, and hashed access tokens while the connection is active, plus the time that connection last read your API key. Hashed tokens are removed when you disconnect or when they expire.

The connector does not collect medical records, diagnoses, or patient files. Exercise names, repetition counts, and movement specifications are configuration for the app you build. PoseTracker is not a medical device.

A first-party cookie banner is shown on posetracker.com and app.posetracker.com until you choose. Your choice is stored for 6 months in the pt_consent cookie on .posetracker.com, so the same choice applies on both hosts. You can change it anytime from Cookie settings in the footer.

Strictly necessary (no opt-in):
- jwt-client on the signed-in product, to keep you logged in
- pt_consent, to remember this choice

Analytics (only if you accept):
- Google Analytics 4 (G-RXMP9XQG0J) on the marketing site and the signed-in product, with Google Consent Mode v2. After you accept, analytics cookies use the posetracker.com cookie domain so a visit can be measured across www and app
- Vercel Analytics and Speed Insights on the signed-in product, to understand feature reliability

Advertising (only if you accept):
- Google Ads (AW-11180435376) with Consent Mode v2 (ad_storage, ad_user_data, ad_personalization). Until you accept advertising cookies, those signals stay denied. Google may still receive cookieless pings used to model conversions

You can accept all optional cookies, keep necessary cookies only, or customize analytics and advertising separately.

Tracking embeds you place in your own app (/pose_tracker/) do not show this banner and do not load our marketing tags. Those embeds are your responsibility.

We use subprocessors to operate PoseTracker, including hosting and database providers, Stripe for payments, and an OpenAI-compatible language-model provider for assistant turns. Some processors may be located outside the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses. Copies of applicable open-source model licenses are described in the Terms of Use.

We implement technical and organizational security measures to protect your data from unauthorized access, loss, destruction, or alteration. Passwords are stored using robust hashing. No method of transmission or storage is completely secure.

We retain account data, assistant conversations, custom movements, connected-agent records, and credit ledgers for as long as your account is active and as needed to provide the service, handle disputes, and meet legal obligations (including tax and accounting records). Face keypoints and camera frames from a pose session are not retained after the session ends.

You can request deletion of your account at any time. We will then delete or anonymize associated personal data, including assistant chats, custom movements, and connected-agent tokens, except data we must keep by law.

In accordance with the GDPR, you have the following rights regarding your personal data:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object
To exercise these rights, email contact@posetracker.com or call +33 6 45 20 01 91.

We reserve the right to modify this privacy policy at any time. Changes will take effect immediately upon their posting on our site.

For any questions or concerns regarding this privacy policy, email contact@posetracker.com or call +33 6 45 20 01 91.