What is sent: camera stills, microphone audio, text you send in the chat and other coaching information are sent to Google to generate the coach's responses. Image analysis for punch detection runs on your device.
Use for model training: Google's terms state that API inputs and responses from a project linked to an active billing account are not used to improve Google products, including AI model training. See Section 4 for the conditions and official terms.
Storage: Punchy does not persistently store the images, audio or chat text themselves. Google's records and Punchy's usage and diagnostic logs are handled separately.
1. Operator (Data Controller)
"Punchy" (formerly "AI Boxing Trainer"; the "Service") is a Progressive Web App (PWA) operated by Do the right thing (a sole proprietorship; "we", "us", or "our"). We are responsible for the handling of personal information within the Service.
Information related to payments for previously sold paid plans is managed independently by the payment provider, Paddle.com Market Limited ("Paddle"), acting as the seller of record (Merchant of Record). See Section 5.
2. Information We Collect
The Service handles the following information.
Camera video: used to analyze your posture and punches during training. It is processed through two separate paths:
On-device analysis (no external transmission): detection of wrist, elbow and other landmarks via MediaPipe is performed entirely within your browser, and the video is not sent externally.
Transmission for AI coaching: so that the AI coach can understand the situation, the video is thinned to still images (JPEG) at approximately 0.5 fps (about one frame every two seconds) and relayed through Punchy's server to Google's Gemini Live API. Punchy does not persistently store these images on its server.
Microphone audio: for two-way voice interaction with the AI coach, audio (a PCM stream) is relayed through Punchy's server to the Gemini Live API. Punchy does not persistently store the audio itself on its server.
Chat text: when you use "Ask by chat", the text you enter and the recent messages of the same conversation (up to 10 exchanges) are relayed through Punchy's server to Google's Gemini API to write the answer. Punchy does not store the text on its server or write it to logs. Logs record the usage ID, language, length, number of messages, processing time and the amount of AI processing (tokens). The conversation is kept in your browser's sessionStorage for that tab (browser session) only and can be cleared with "New chat"; it may remain if the browser restores the tab. To prevent abuse and apply limits, we count questions per usage ID and IP address per day.
Usage ID: to understand repeat usage and improve the Service, a random string is stored in your browser's localStorage, sent to the server when a session connects, and recorded in logs. Creating the ID does not require your name or other registration details. To prevent abuse and enforce free-time limits, we aggregate usage time per usage ID and IP address by UTC date (changing at 9 a.m. Japan time). Older daily totals are deleted when usage time is next written.
Practice history and punch detection data: history including punch counts, types, combination rate and duration is stored in your browser's localStorage (up to 30 entries). History summaries and previous practice assignments used for coaching, along with detected punch types, sides and estimated speeds, are sent to the server. Information needed for coaching is also sent to Google, and some information is recorded in diagnostic logs.
Settings and nickname: effects, volume, coaching interval, style, voice, language, stance and any optional nickname are stored in localStorage. The settings and nickname used to generate AI responses are sent to our server and Google.
Authentication token: a random string issued upon successful authentication is stored in sessionStorage (expires automatically after 24 hours).
Usage and diagnostic logs: for abuse detection and troubleshooting, we record IP addresses, connection times and status, punch detection data and related diagnostics. Parts of coaching data (including nicknames and history summaries), AI response text and recognized game calls may also be logged.
Free use does not require registration of your name, address, phone number, email address or date of birth. However, personal information included in an optional nickname, camera images, conversations or inquiries is also processed. Information required for past paid-plan payments was collected by Paddle (see Section 5).
3. Purposes of Use
We use the information only within the following purposes.
To pass camera stills and audio to the AI in real time and generate coaching responses.
To write AI answers to questions sent with "Ask by chat".
To detect punches and display particle effects via in-browser MediaPipe.
To display statistics and improvement feedback after a session.
To improve the Service through anonymous, aggregated retention metrics.
To detect unauthorized access, apply rate limiting, and operate the Service reliably.
We do not use the information beyond the scope necessary to achieve these purposes.
4. Transmission to External Services / Third Parties
The following external services handle data to provide the Service or support past purchases.
Google Gemini API (including the Gemini Live API) (Google LLC, a U.S. company)
To generate the coach's responses, we send still images, audio, chat text and coaching information such as the nickname, settings and practice data described in Section 2 to Google. Data handling is governed by the Gemini API Additional Terms and Google Privacy Policy.
Model training and product improvement: Google's terms classify API access through a project linked to an active billing account as a Paid Service and state that its inputs and responses are not used to improve Google products, including AI model training. Different data-use terms apply to Unpaid Services. What Punchy charges its users is separate from Google's classification of the API as a Paid or Unpaid Service.
Google's records: even for Paid Services, Google logs inputs and responses for a limited period for abuse detection and prevention or legal requirements. Exclusion from model training does not mean that Google stores no data.
Paddle.com Market Limited (a UK company; Merchant of Record): processed past paid-plan purchases and handles information relating to their receipts, billing and refunds. See Section 5.
Fly.io (a U.S. company): our hosting infrastructure, handling application logs and connection information. It runs in the Tokyo (NRT) region.
MediaPipe (client-side only): image analysis is completed within your browser and is not sent externally.
We do not sell or provide user data to any third party other than the above.
Cross-border transfers:
Information sent to the Gemini API may be processed or temporarily stored in countries where Google or its agents maintain facilities, including the United States. Payment information from past purchases is processed by Paddle (a UK company) mainly in the UK, EU and US. The data protection regimes of these countries may differ from that of Japan. By using the Service, you are deemed to consent to such cross-border transfers. Please review each provider's terms and privacy policy for details of their safeguards.
5. Past Payments and Information Held by Paddle
Punchy is currently free to use, with no card required. New paid-plan sales are paused. Free use does not open a Paddle checkout or verify a new purchase entitlement.
Payments for previously sold paid plans were provided by Paddle (Paddle.com Market Limited, a UK company) acting as the seller of record (Merchant of Record). Paddle handles card and billing information, taxation and refunds for past purchases. We do not receive or store your credit card information. Records used to confirm past purchases, such as customer IDs, subscription IDs and purchase status, are not automatically deleted when the Service becomes free.
Paddle processes the name, email address, billing address, card details and similar information needed to manage past purchases, as an independent data controller/processor in its own right. The handling of that information is governed by Paddle's privacy policy and data processing terms.
Type of information
Us (Punchy operator)
Paddle (past payments)
Google (Gemini)
Camera video (0.5 fps stills)
Relayed (not persistently stored)
Not received
Received (processed under Section 4)
Microphone audio
Relayed (not persistently stored)
Not received
Received (processed under Section 4)
Chat text
Relayed (text not stored or logged; counts and lengths are logged)
Not received
Received (processed under Section 4)
Name, email, billing address
No mandatory registration for free use; may be included in optional input or inquiries
Past purchase information managed
Received if included in images, conversations or other coaching input
Nickname / coach settings / practice data
Stored on device; coaching information sent and partly logged
Not received
Information used for coaching is received
Credit card details
Not received / not stored
Past purchase information managed (PCI DSS compliant)
Not received
Past purchase entitlement token (claim)
May remain on device; not used to determine current free access
Purchase confirmation information provider
Not received
Past purchase records (customer ID, purchase status, etc.)
Past purchase records retained on server
Past purchase information managed
Not received
Usage ID / usage logs
Logging and daily free-time totals (see Section 7)
Not received
Not received
For details of information Paddle handles for past purchases, your rights, and how to contact Paddle, please see:
For questions about past purchase receipts, refunds or billing, Paddle's support channel (or the contact shown in your receipt email) is the primary point of contact.
6. Free Access and Usage Time
AI practice: free for up to 60 minutes in total per day. Camera video and audio are handled as described in Sections 2 and 4. No card required.
Demonstrations and the gym timer: can be used repeatedly without using your AI time.
Usage-time limits use daily totals per anonymous usage ID and IP address. Past purchase entitlement tokens do not extend the current usage time.
7. Data Storage and Retention
Camera stills, audio and chat text themselves: not persistently stored on Punchy's server. See Section 4 for Google's records.
WebSocket session: ends according to the daily AI practice limit (60 minutes in total) and per-connection limits.
Server-side usage and diagnostic logs: retained according to the hosting platform's log retention settings. Questions about information in these logs can be sent to our contact channel.
Free-time usage totals (seconds per usage ID and IP address): aggregated by UTC date; older daily records are deleted when usage time is next written.
Chat question counts (per usage ID and IP address): aggregated by UTC date; older daily records are deleted at the next question.
Chat conversation: kept in your browser's sessionStorage for that tab only (can be cleared with "New chat").
Authentication token: expires 24 hours after issuance.
Payment information from past purchases (name, billing address, card details, etc.): retained by Paddle in accordance with Paddle's policy and its statutory retention obligations.
Data in your browser's localStorage: until you delete it.
8. Security Measures
We implement the following measures.
Encryption of communications via HTTPS (with HSTS).
A design in which highly sensitive information such as card details is not held by us (current free use requires no card; Paddle manages past payment information).
9. Your Rights and Data Deletion
Deleting in-browser data: you can delete site data for this domain from your browser settings (this erases statistics, settings and the anonymous ID).
Stopping use: after you stop accessing the Service, access logs and daily usage totals follow the retention periods in Section 7. Questions about past purchase records can be sent to the contact below.
Disclosure, correction or suspension of information we hold: requests can be made via our contact channel.
Requests regarding past payment information (name, billing address, card details, etc.): these are managed by Paddle; please make such requests via the channel stated in the Paddle Privacy Policy.
10. Cookies and SDKs
The Service uses localStorage / sessionStorage to maintain authentication state and save settings.
We do not use advertising tracking cookies or third-party advertising SDKs.
The Service no longer loads the Paddle payment SDK. If you visit Paddle's website to check a past purchase, review Paddle's policy for its use of cookies.
11. Notes
The Service is not a medical act, diagnosis or treatment. Please train at your own risk.
Specifications may change without notice.
Minors should use the Service with the consent of a guardian. Users under 13 may use it only with the consent and supervision of a guardian.
12. Contact
For privacy inquiries about the Service, please contact us at punchy.trainer@gmail.com. For payment inquiries about a past purchase, use the Paddle contact shown in your receipt email.
13. Changes to This Policy
This policy may change without notice. Where changes are material, we will announce them within the Service or on the home page.