Privacy Policy

Effective 28 June 2026

This policy explains what personal data TourenUp processes, why, the legal basis under the EU General Data Protection Regulation (GDPR), who we share it with, how long we keep it, and the rights you have. We've written it in plain language; where a section matters legally, we say so.

01Who is responsible

TourenUp is operated by Denis Bondar, a sole trader, of 3 rue des Maximins, L-8247 Luxembourg.

For any privacy question or to exercise your rights, contact dev@touren.tech. We have not appointed a Data Protection Officer (not legally required at this size); requests go to the address above.

02The short version

• Your sensor and camera analysis runs on your phone. Raw camera frames and raw motion data never leave your device — only the derived results, and only when you choose.
• Your account and training data live on EU servers (in Ireland).
• Some optional AI features send data to Google (Gemini), which may process it outside the EU. These are features you turn on.
• You can export or permanently delete everything from Settings → Privacy.

03What we collect, why, and the legal basis

Almost everything in TourenUp is tied to your account, so it's personal data. “Contract” means we need it to provide the service (Art. 6(1)(b)); “Consent” means it's optional and only happens if you agree (Art. 6(1)(a), or Art. 9(2)(a) for biometric data); “Legitimate interest” means a justified reason that doesn't override your rights (Art. 6(1)(f)).

04Special-category data: voice and body-motion (Art. 9)

Two kinds of data get extra protection as special-category (biometric) data:

• Voice notes — audio carries a voiceprint.
• Drill video and body-pose data — footage and motion of your body.

We only process these with your explicit consent, which you give the first time you use the feature and can withdraw any time in Settings → Privacy. If you withdraw consent or delete the content, the audio/video and anything derived from it are deleted from our storage. If you enable AI transcription of voice notes, the audio is sent to Google (Gemini) to produce a transcript (see §6–§7); we do not transcribe voice notes without your consent.

05What stays on your device

The most sensitive analysis happens on your phone, so it never reaches our servers:

• Camera / pose analysis. Drill frames are analysed on-device; raw frames never leave the phone — only abstract body-angle numbers and pose landmarks, uploaded only if you save the clip for coach review.
• Raw motion sensors. High-rate accelerometer/gyroscope data is processed on-device; only a downsampled summary is uploaded with a ride.
• Location labelling. Turning your location into a region name happens on-device; we store the region label, not the underlying coordinates, for that purpose.

06Who we share data with

We don't sell your data. We use a small set of providers; where one is outside the EU/EEA, see §7.

07International transfers (outside the EU/EEA)

Some providers process data in the United States. Our email sign-in provider and Apple are certified under the EU–US Data Privacy Framework. The AI features involve processing by Google; we are putting the formal EU-transfer safeguards for that processing in place and will update this section accordingly.

AI features (the AI co-rider, ride/drill narratives, voice-note transcription) are the main cross-border transfer. They are optional and controlled in Settings → Privacy. If you don't want any data leaving the EU for AI processing, leave these features off.

08How long we keep your data

We keep your personal data for as long as you have an account. You can delete any individual item — a ride, a voice note, a drill clip — at any time, and deleting your account (Settings → Privacy → Delete account) erases all of your data and its media from our systems.

• Rides, training data, voice notes, drill clips and pose data are kept until you delete them or close your account, then erased.
• Shareable videos you generate from a ride may also expire automatically after a set period.
• Consent records are kept while your account exists (so we can demonstrate consent) and removed on account deletion.

09Your rights

Under the GDPR you have the right to:

• Access your data (Art. 15) — Settings → Privacy → Export my data gives a machine-readable copy.
• Rectify inaccurate data (Art. 16) — edit your profile in the app.
• Erase your data (Art. 17) — Settings → Privacy → Delete account.
• Port your data (Art. 20) — the same export is machine-readable JSON.
• Restrict or object to processing (Art. 18 & 21).
• Withdraw consent any time (Art. 7(3)) — toggle any optional feature off in Settings → Privacy; withdrawal is as easy as granting.

You can also email dev@touren.tech. There's no charge, and we'll respond within one month. You may also lodge a complaint with a supervisory authority — your local authority, or the Luxembourg Commission nationale pour la protection des données (CNPD).

10Automated processing and profiling

TourenUp builds a profile of your riding — a persona classification and per-skill ability estimates — to tailor recommendations and the wording of AI feedback. This is profiling in the GDPR sense, but it does not produce decisions with legal or similarly significant effects about you. The AI never makes high-stakes calls; it explains your data and defers safety, injury, and judgment calls to a human coach.

11Children

TourenUp is intended for adults (18+) and is not directed at children. We don't knowingly collect data from children.

12How we protect your data

Your data is stored on EU servers, encrypted in transit and at rest. The most sensitive analysis runs on your device. Diagnostics are pseudonymised and stripped of location data. Access to coach features is gated by your explicit connection to a coach, which you can pause or end at any time.

13Changes to this policy

If we change how we handle your data, we'll update this page and the effective date above, and — for material changes — notify you in the app.