Privacy Policy

Last updated: 19 August 2026

This policy explains how Trainoro ("the app") — a free app operated privately by an individual, with no company behind it — processes personal data, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). It covers the Android and the iOS version of the app; where the two differ, it says so.

Trainoro keeps as much as possible on your device. Your videos, analyses, training statistics and personal training profile never leave your phone. There is no tracking, no advertising and no profiling.

Four things do involve a server. First, using the app requires an account (e-mail address, password, display name, username and, if you choose one, a profile picture), because the MyClub section is shared with other people. Second, the MyClub section itself — your club, its teams, the team chat and the club news feed — is stored online so that your teammates can see it. Both run on Google's Firebase platform in the European Union. Third, before our server answers the app, the app proves that it is a genuine, unmodified copy of Trainoro; Google (on Android) or Apple (on iOS) issues that proof. Fourth, if — and only if — you switch it on, the app sends us anonymous usage counts so that we can see which features are actually used; these are plain numbers, contain no identifier of any kind and cannot be traced back to you (section 15). Optional AI features additionally send text to OpenAI, and only after your explicit consent.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is the private individual who operates Trainoro, resident in Germany and reachable at the e-mail address given in the legal notice (Profile → Legal notice). There is no company behind the app.

For your account and the MyClub data we use Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor under Art. 28 GDPR, on the basis of the Google Cloud Data Processing Addendum. The Firestore database and the file storage used by the app are located in the European Union (multi-region "eur3"). Section 9 describes the access we ourselves have to that data.

For the on-device functions we have no access to your data at all. If you enable the optional AI features, you use your own OpenAI account and API key; in that respect you determine the processing yourself and OpenAI acts as your provider under its own terms.

2. Data stored on your device

The following is stored solely in this app's private, sandboxed storage and is never uploaded: your training profile (age, height, playing hand, skill level), recorded videos and captured frames, analysis results including pose and biomechanics data, drill and fitness sessions, racket configurations, game scores, language and consent settings, AI chat history, and a local cache of the news photos and member profile pictures of your club.

Legal basis: Art. 6(1)(b) GDPR — this processing is necessary to provide the app's core functions that you requested.

3. Camera, microphone and photos

The camera and microphone are used exclusively to record your training videos and capture single frames. Access to your photo and video library is used only at the moment you pick a file yourself: a video to analyse, a profile picture, or a photo to attach to a club news post. The app never reads or scans your library in the background.

All video analysis — pose estimation, ball tracking, table detection and biomechanical measurement — runs entirely offline on your device using on-device models. No footage is transmitted to us or to any third party by these functions. (On iOS these analysis features are not available yet; recording and the club functions work as described here.)

Legal basis: Art. 6(1)(a) GDPR — your consent, given through your device's system permission prompt on Android or iOS, which you can withdraw at any time in your device settings.

Please note: if other people are visible or audible in your recordings, or in a photo you upload to your club, you are responsible for their data. Recording or publishing identifiable persons generally requires their consent under the GDPR and, in Germany, under §§ 22, 23 KunstUrhG (right to one's own image).

4. Account and MyClub (Firebase)

An account is required to use the app. When you register we process your e-mail address and password (held by Firebase Authentication; we never see your password), a display name and a username you choose. Your e-mail address is used to confirm your address and to reset your password; it is stored only in Firebase Authentication and is never shown to other users. Other members of your club see only your display name, your username and — if you set one — your profile picture.

A profile picture is optional. If you upload one, the image is stored in EU-hosted file storage and server-side rules allow it to be downloaded only by members of your own club; if you are in no club, only you can see it. You can replace or remove it at any time in your profile, and the previous image is deleted when you do.

Your training profile — age, height, playing hand and skill level — is stored in the EU-hosted Firestore database as part of your own account record, so that you keep it when you reinstall the app or change phone and are not asked for it twice. Server-side security rules allow only your own account to read that record: no other member, and no club admin, can see these details. A copy is kept on your device so the app works offline, and the whole record is deleted when you delete your account.

If you create or join a club, the following is stored in the EU-hosted Firestore database and is visible to the other members of that club: the club and its teams, who belongs to them and in which role, team chat messages (text and stickers), availability polls and their results, the season and match schedule including line-ups, and club news posts including any photos attached to them. Photos are stored in EU-hosted file storage and can only be retrieved by members of the same club.

Access is limited by server-side security rules: a member of one club can never read another club's data, and nobody can read your account record. Invitation links contain a randomly generated token; anyone who has such a link can join the club or team it belongs to until it expires or its usage limit is reached, so share it only with people who should have access.

Legal basis: Art. 6(1)(b) GDPR — the account and the club functions are necessary to perform the service you requested. Confirming your e-mail address and limiting invitations serve the security of processing under Art. 32 GDPR.

5. Optional AI features (OpenAI)

The AI Coach, AI follow-up chat, fitness trainer, frame coach and racket advisor are entirely optional and disabled until you enable them.

When you use them, the app sends the following directly from your device to OpenAI, authenticated with your own API key: your questions and notes, your profile details (age, height, skill level — your name is never included), session and analysis statistics derived from your videos, and — for the gear finder — the location and budget you enter.

Image transmission: in the Frame Analysis coach only, and only when you explicitly switch on "attach image", a single annotated still frame showing your body posture is transmitted together with the text. This image may show you and is therefore personal data. The option is off unless you turn it on, the app shows you a confirmation dialog with a cost estimate before every send, and no image is ever sent by any other AI feature. No video is ever transmitted.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent. You give it by entering your own OpenAI API key: the dialog that collects the key states, before you save it, exactly what will be sent and that it goes to the USA. There is no separate consent switch, because entering the key and agreeing to the transfer are the same decision. You withdraw it by removing the key in Profile → API key, at any time and without giving reasons (see section 11). Without a stored key no data is sent, and the app enforces that in the AI service itself as well as in the interface.

6. Transfer to a third country (USA)

Your account and MyClub data are stored in the European Union and are not transferred to a third country.

The optional AI features are different. OpenAI, L.L.C. is based in the United States, a country outside the EU/EEA. If you use those features, your data is therefore transferred to a third country within the meaning of Chapter V GDPR.

This transfer is based on your explicit consent under Art. 49(1)(a) GDPR. OpenAI additionally offers Standard Contractual Clauses under Art. 46(2)(c) GDPR as part of its API terms, and participates in the EU-U.S. Data Privacy Framework.

One further transfer is technical and narrow: the app-integrity check described in section 8 is answered by Google (on Android) or Apple (on iOS), which may process it outside the EU. It carries no content of yours — only a signed statement about the app and the device. Where these companies process data in the United States, they rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and participate in the EU-U.S. Data Privacy Framework.

You should be aware that US authorities may, under US law, have access rights to data held there, and that the level of protection may not fully correspond to that of the GDPR. Enforcing your rights may be more difficult than within the EU. If you do not wish to accept this, simply do not enable the AI features — all other app functions remain fully available.

7. Your OpenAI API key

Your API key is stored in encrypted storage on this device — Android's Keystore-backed encrypted preferences, or the iOS Keychain — and is used solely to authenticate your requests to OpenAI. It is never transmitted to us. You can remove it at any time in Profile → API key; doing so also withdraws your consent under section 5, and the AI features stop sending anything.

Legal basis: Art. 6(1)(b) GDPR.

8. Abuse prevention and app integrity

Before our server answers a request, the app proves that it really is Trainoro running on a genuine, unmodified device, using Firebase App Check. On Android that proof is issued by Google Play Integrity, on iOS by Apple's App Attest. The check transmits information about the app and the device to Google or Apple respectively — the app's identity and version and an assessment of the device's integrity. It transmits none of your content: no videos, no messages, no profile data.

Without it, anyone could take the app's (non-secret) configuration out of the installation file and address our database directly. Two further measures work the same way: joining a club requires a confirmed e-mail address, and invitation links expire and have a usage limit.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the service and its users from abuse — together with Art. 32 GDPR (security of processing).

9. Administrative access

We operate an internal administration tool for the Firebase backend. Through it, and through the Firebase console, a small number of named administrator accounts can see: your e-mail address, display name, username, which club you belong to, the details of your training profile (age, height, playing hand, skill level), and the dates of your sign-up and last sign-in. They can also disable an account and delete an account entirely.

We use this only to run the service: to answer support requests, to carry out GDPR requests you send us (for example an erasure request by e-mail), to investigate abuse, and to comply with legal obligations. The tool itself shows accounts and aggregate counts — how many accounts and clubs exist and how many sign-ups there were per day — and has no view into team chats, news posts or your videos, and no bulk export of your content. As the operator of the database we could technically reach club content; we confine ourselves to the purposes named here.

Administrative access requires a permission granted individually, by hand, to a specific account. It has nothing to do with roles inside a club: no club admin and no club moderator receives it. Every administrative action on an account is written to a server log with the acting administrator, the action and the account concerned — deliberately without e-mail addresses or profile details.

Legal basis: Art. 6(1)(b) GDPR where the action is part of performing the service you asked for, Art. 6(1)(f) GDPR (legitimate interest in a secure and supportable service), and Art. 6(1)(c) GDPR where we are legally obliged to act, in particular on requests under Chapter III GDPR.

10. Storage period

Data stored on your device is kept until you delete it or uninstall the app. We do not apply any automatic deletion periods to it, because we have no access to your device.

Your account and its MyClub data are kept until you delete your account (Profile → Delete account). Messages you have already sent remain in your teams' chats afterwards, because they are part of other members' conversations, but your name is removed from them and they can no longer be linked to you. Your profile picture is deleted with the account.

The administrative log entries described in section 9 are held in Google Cloud Logging and deleted automatically after 30 days.

If you received a time-limited test version of the app, the account issued to you for the test is erased after the test period ends, in exactly the same way as a deletion you request yourself.

The anonymous usage totals described in section 15 are kept indefinitely, because they are anonymous statistics and no longer personal data within the meaning of Art. 4(1) GDPR: they are sums, and there is no key anywhere that could break them back down into individual people.

Data you send to OpenAI is retained according to OpenAI's own retention policy — under the current API terms, typically up to 30 days for abuse monitoring, and not used to train their models by default. We have no influence over this.

11. Your rights

Under the GDPR you have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21).

For data held on your device you exercise most of these rights directly in the app: you can view, correct and delete it yourself at any time. For your account and MyClub data, "Delete account" in Profile erases the account, its club membership, its profile picture and its username; for access, rectification or portability please write to the e-mail address in the legal notice (Profile → Legal notice); such requests are answered using the administration tool described in section 9.

Right to withdraw consent (Art. 7(3) GDPR): you may withdraw your consent to the AI features (by removing your API key in Profile) and to the anonymous usage statistics (by switching them off in Profile → Settings) at any time with effect for the future, without giving reasons and without any disadvantage. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to lodge a complaint (Art. 77 GDPR): you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In Germany, supervision rests with the data protection authorities of the federal states; you may address the authority of the state in which you live or work.

12. No automated decision-making

The app does not carry out automated decision-making producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR. Analyses and AI suggestions are non-binding training recommendations. They are not medical advice and do not replace examination or treatment by a physician or physiotherapist.

13. Children

The app is not directed at children under 16. Where processing is based on consent, § 8 BDSG applies in Germany: for users under 16, the consent of the holder of parental responsibility is required, in particular for enabling the AI features.

14. Deleting your data

You can delete individual videos, analyses, sessions and chats from within the app, or erase everything held on this device at once using "Delete all data" in Profile → Settings — this also removes your API key, but leaves your account intact, so your training profile is restored from your account record the next time you use the app.

To erase your account as well, use "Delete account" in Profile. This deletes your account, your profile picture, your club membership, your username reservation and all data on this device, and cannot be undone. If you are the last admin of your club, the club is handed to its longest-standing member, or deleted if there is nobody left to hand it to. Uninstalling the app removes the local data but not your account.

You can also ask us to delete your account by e-mail (see Impressum). We then carry out exactly the same deletion through the administration tool described in section 9.

The anonymous usage statistics described in section 15 are not affected by any of this, and cannot be: they are pure totals with no identifier attached, so once a count has been added there is nothing in them that belongs to you or that could be found and removed. Switching the statistics off in Profile → Settings immediately discards the counts still waiting on your device and stops any further ones.

Data already sent to OpenAI is subject to OpenAI's retention policy and cannot be deleted from within this app. To exercise erasure rights against OpenAI, please contact OpenAI directly using the account whose API key you used.

15. Anonymous usage statistics

Off unless you switch it on. If you agree, the app counts how often each feature is opened and completed — for example how many times Ball Tracking was started, or a drill session finished — and sends those counts to our server about once a day.

What is sent is a list of numbers and nothing else: no user ID, no device ID, no session ID, no location, no timestamps of individual actions, no names of videos or clubs, and no free text. Your videos, analyses, chats and training statistics are not part of it and never leave your device. Nothing is read out of your phone for this: the app only counts its own screens, so the entire content of a transmission is a short list like “Ball Tracking opened 4 times, one drill session finished”. On the server the numbers are immediately added into a single running total shared by all users, so what is stored is “Ball Tracking was opened 138 times this month”, never “you opened it”. Two of the counts describe devices rather than actions — how many devices were active on a day, and how many distinct devices used a given feature in a month — but even those are produced by your own device declining to count itself twice; the server receives only the sum.

The result is anonymous within the meaning of Recital 26 GDPR: we hold no additional information that could break the totals back down into individual people, and no such information exists anywhere. We use it for one purpose only — deciding what to improve and what to retire.

Legal basis: Art. 6(1)(a) GDPR — your consent, asked once in a dialog and revocable at any time in Profile → Settings. Storing the counts on your device until they are sent additionally requires your consent under § 25(1) TDDDG, which is covered by the same dialog. Without consent nothing is counted, nothing is stored and nothing is sent; the app enforces this both in the interface and, independently, in the service that would do the sending.

16. Changes to this policy

We may update this policy to reflect changes to the app or to legal requirements. The current version is always available in the app under Profile → Privacy Policy. If changes materially affect processing based on your consent, we will ask for your consent again.