Privacy Policy

Date of Last Revision: October 18, 2026

This Privacy Policy explains what personal information Cadoo Inc. (“Cadoo,” “we,” “us”) collects, how we use and share it, and the choices you have. It is part of our Terms of Use. By using the Services you agree to this Policy.

1Information We Collect

Information you provide

• Account & profile: name, email, mobile phone number, date of birth or age, password, and any profile photo or details you add.
• Identity verification: when required (for example, before you cash out), a government-issued ID and a selfie, collected and checked by our verification provider (currently Stripe Identity). Cadoo receives the result and limited details (such as name and date of birth), not a copy of your ID images, unless needed for a dispute.
• Payment information: handled by PCI-compliant payment processors; Cadoo does not see or store full card numbers.
• Content: photos, workout videos, messages, and other content you post.
• Invites: if you invite a friend, the email or phone number you provide, used only to send that invitation and reminders.

Information collected automatically

• Device & usage: IP address, device identifiers, app/version, and interaction logs, used to operate, secure, and improve the Services and to detect fraud, emulators, and duplicate accounts. When you sign up we also keep a one-way scrambled code made from your network (IP) address, not the address itself, so we can spot one person or group opening many accounts. We cannot turn that code back into your address, and we do not use it for advertising.
• Location: approximate location and location signals, used to verify activity and to enforce eligibility for cash games. You can limit this in your device settings, though some features may then be unavailable.

Information from third parties

Health sources you connect (Apple Health and Google Health Connect) and login providers (such as Google and Facebook) provide information under their own policies; we use it as needed to run the Services.

2Health, Fitness & Workout Data

Activity data. With your permission, we read step, distance, and workout data from the sources you connect: Apple Health and Google Health Connect. Before July 2026, some players connected wearables such as Garmin and Fitbit through our former provider Terra; we no longer receive data that way, and data we received earlier is kept as part of your activity history. We use it solely to verify game results and show your progress. We don’t share it with brands, use it for advertising, or sell it. If you disconnect a source, we stop reading from it, and you can ask us to delete the data we received from it.

Workout video & movement data. When a game requires recording, we capture workout video and process it with automated computer vision (CadooVision) to count and score your movements. We use the video and the movement data derived from it only to verify results, credit your account, secure the integrity of contests, review miscount reports, and generate highlight clips and cards. Workout video is never shown to other players. Only you and Cadoo’s internal review (for verification, miscount review, anti-cheat review, and dispute resolution) can see it. Workout video is encrypted in transit and at rest. We delete raw workout video within 30 days after the game it was recorded for ends, unless it’s needed for an open review or dispute. Highlight clips and cards generated from verified workouts are visible only to you unless you share them; because shared links depend on them, clips and cards persist until you ask us to delete them. Movement measurements derived from video (such as rep counts and form scores) are retained as part of your activity and contest history. We do not use workout video or movement data for advertising and do not sell it.

3How We Use Information

We use personal information to: create and manage your account; operate games and verify results; process deposits, winnings, withdrawals, and subscriptions; verify identity and age and prevent fraud and multi-accounting, including automated review of workout submissions and miscount reports, which may hold a payout while a person reviews it; provide support; send transactional messages, texts (only if you turn on Text alerts), and marketing email (you can unsubscribe any time); personalize matchmaking; comply with legal obligations; and improve and secure the Services. You can ask for a person to review any automated decision that withholds money by contacting tim@cadoo.io.

4SMS & Mobile Messaging

How you opt in. We text you only if you turn on Text alerts, which is off unless you opt in (an unchecked box when you add your number, or the switch in Settings), or when you ask for a one-time login or verification code, in which case we text that code only. Text alerts cover texts about your Cadoo games: results, stake returned, cancellations, and cash-out status. We don’t send marketing texts; if we ever add them, we’ll ask for your separate consent first. Consent is not a condition of using Cadoo or of any purchase.

Quiet hours, frequency, rates, and opting out. We don’t send reminders between 9 PM and 9 AM your local time. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out at any time, or reply HELP for help. You can also turn off Text alerts in Settings or visit cadoo.games/support. Opting out won’t affect your ability to play, though you may miss reminders. Carriers are not liable for delayed or undelivered messages.

No sharing of mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We share your mobile number only with our SMS provider (Twilio), solely to deliver the messages you asked for.

5Cookies & Similar Technologies

We and our providers use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand usage. You can control cookies through your browser settings; some features require cookies to work. We do not store your password in a cookie.

6How We Share Information

• With other users and brands: your display name, photo, and game results are visible to others in your games, on leaderboards, and on the brand’s hub for brand games. Your workout video is never shown to other players. Brands don’t receive your email, phone number, ID, or health data unless you choose to share them. Don’t share anything in-game you consider private.
• With service providers: vetted vendors who process information only on our behalf (see Section 7).
• For legal & safety reasons: to comply with law or legal process, enforce our Terms, prevent fraud, or protect the rights and safety of Cadoo, users, or the public.
• Business transfers: in a merger, acquisition, or sale of assets, subject to this Policy.
• With your consent: otherwise, we share personal information only with your permission.

We do not sell your personal information for money, and we do not share your phone number for third-party marketing.

7Service Providers We Use

We share limited personal information with providers who process it only to provide services to Cadoo, including:

• Payments & payouts: Stripe and PayPal;
• Identity verification: Stripe Identity (processes the government ID and selfie you submit for KYC);
• Subscriptions: RevenueCat, and the Apple App Store and Google Play;
• Hosting, sign-in, storage, and analytics: Google Cloud and Firebase (including Firebase Analytics and Crashlytics);
• Error monitoring: Sentry;
• Support chat and help center: tawk.to;
• Messaging: Twilio (SMS) and SendGrid (email);
• Contact list management: Brevo (stores contact details for business and partner contacts; it doesn’t send Cadoo email today);
• Automated review: AI model providers that analyze submissions on our behalf and may not use them to train their own models.

These providers are contractually limited to using your information on Cadoo’s behalf.

8Data Retention

We keep personal information only as long as needed for the purposes in this Policy (to run your account, operate and verify games, meet legal, tax, and fraud-prevention obligations, and resolve disputes), after which we delete or de-identify it. Workout video is retained as described in Section 2. You can request deletion as described below.

9Security

We use encryption in transit and at rest (including for workout video stored in our cloud), access controls, and other safeguards to protect your information, and limit access to personnel who need it. No system is perfectly secure, so we cannot guarantee absolute security. Protect your account by using a strong password and signing out of shared devices.

10Your Choices & Rights

You can review and update your profile in the app and adjust notification preferences, including Text alerts, in Settings. You can delete your account in the Cadoo app (Settings, then Delete account). That in-app path deletes the account immediately when available cash is $0.00 and no withdrawal or deposit is pending; there is no grace period and no undo. The public page at cadoo.games/delete-account does not delete the account itself. If you no longer have the app, write tim@cadoo.io or use that page to request deletion. Support confirms the account and then runs the same delete. We usually finish web or email deletion requests within 30 days, subject to legal retention requirements. After deletion you will not receive marketing or reactivation messages.

11California Privacy Rights (CCPA / CPRA)

California residents have the right to know what personal information we collect and how we use it; to access, correct, and delete it; and to opt out of any “sale” or “sharing” as defined by California law. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. In the last 12 months we collected these categories:

• Identifiers (name, email, phone, account ID, IP address): from you and your device; used to run your account, games, and support; disclosed to the service providers in Section 7; kept while your account is open and as needed for legal, tax, and fraud-prevention obligations.
• Customer and commercial records (deposits, entries, winnings, withdrawals, subscriptions): from you and our payment providers; used to process payments and payouts; disclosed to payment providers; kept as tax and financial law requires.
• Device and usage information: from your device; used to operate, secure, and improve the Services and prevent fraud; disclosed to hosting, analytics, and error-monitoring providers; kept as long as needed for those purposes.
• Approximate location: from your device; used to verify activity and eligibility for cash games; not disclosed except to service providers.
• Audio and video (workout video): from you; used to verify results and review miscounts; never shown to other players; kept as described in Section 2.
• Health and fitness data (steps, distance, workouts): from the sources you connect; used only to verify results and show progress; disclosed only to our hosting providers; kept as part of your activity history until you delete your account or ask us to delete it.
• Government ID and selfie (sensitive): from you, through our verification provider; used only to verify identity and age and prevent fraud; kept by the provider under its own retention rules, with Cadoo keeping the result.
• Inferences (such as skill level for matchmaking): derived from your activity; used to personalize games; not disclosed except to service providers.

We use sensitive personal information only to provide the Services, verify identity and age, and prevent fraud, as permitted by the CPRA, so we don’t offer a right to limit its use. To exercise your rights, contact tim@cadoo.io. You may use an authorized agent. We verify requests by matching your account email or phone number, and we respond within 45 days. We will not discriminate against you for exercising your rights.

12EU / UK Users (GDPR)

Cadoo is the controller of the personal information you provide. We process it to perform our contract with you (operating the Services), to comply with legal obligations, for our legitimate interests (security and fraud prevention), and with your consent where required. You have the right to access, correct, delete, restrict, or object to processing, and to data portability, and you may withdraw consent at any time. You can also ask for a person to review any automated decision that withholds money. To exercise these rights, contact tim@cadoo.io. You may also lodge a complaint with your local data protection authority (and, for UK residents, the UK Information Commissioner’s Office). Some actions may limit your ability to use the Services.

13Children

Cadoo is for people 13 and older. We ask your age at sign-up and don’t knowingly collect information from children under 13. If we learn we have, we delete it. Players 13 to 17 may join games with no entry stake, Cadoo-hosted games entered with Cadoo store credit, and brand games (which have no entry stake or take brand credit), and may not deposit, enter cash games (including all user-hosted games), or withdraw money. If we learn that someone under 18 took part in cash activity, we reverse it. Contact tim@cadoo.io with concerns.

14Changes & Contact

We may update this Policy from time to time; we will post changes here and update the revision date, and for material changes provide additional notice. The Policy in effect when information is used governs that use. Contact us at tim@cadoo.io or by mail at Cadoo Inc., 132 Barbaree Way, Tiburon, CA 94920.