Privacy Policy
Last updated: July 2026
This Privacy Policy explains how COMOVO ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the COMOVO mobile application and website.
1. Data Controller
The data controller responsible for your personal data is:
Rincon sp. z o.o.
ul. Spacerowa 9, 10-687 Klewki, Poland
NIP 7394035448 · KRS 0001242776 · REGON 544828315
hello@comovo.eu
COMOVO is a social fitness application that connects people through workouts, GPS tracking, and local training events.
2. Who Can Use COMOVO
COMOVO is intended for people aged 16 and over. We do not knowingly collect data from anyone under 16. If we learn that we hold data about a person under 16, we will delete it and terminate the account. If you believe a child has provided us data, contact us and we will delete it.
3. What Data We Collect
We only collect what we need to run the service. The table below lists the categories of personal data the app processes.
| Category | Examples | Why |
|---|---|---|
| Account identity | email, name, date of birth, gender (optional) | create your account, sign you in, confirm you meet the minimum age |
| Profile | photo, "about me", city/country, chosen sports, optional weight/height, unit preferences | show your profile and personalise the experience |
| Location | your approximate location and, during a workout, precise GPS | nearby discovery and route tracking (see Section 6) |
| Workout & event activity | workouts (name, place, duration, distance, pace, etc.), events you create or join, routes | the core product: tracking and the social feed |
| Goals & achievements | fitness goals you set, workout streaks, badges you earn | track your progress and keep you motivated |
| Media | photos and, where supported, videos you add | illustrate your workouts and events |
| Social & messaging | friends, follows, blocks, comments, likes, chat messages | social features and direct messaging |
| Notifications | in-app notification records | tell you about activity relevant to you |
| On-device data | a local copy of your synced data, app settings, sign-in tokens, cached media and route files | let the app work offline and load quickly |
We do not collect: advertising identifiers, analytics or usage-tracking events, crash diagnostics, your contacts, browsing history, financial data, or sensor biometrics such as heart rate.
If you do not provide the data required for an account (email and sign-in credentials), you will not be able to create one. Optional data can be skipped without affecting core app functionality, but some features (e.g., calorie estimation, nearby user matching) may be limited.
4. How We Use Your Data
We use your data to provide and operate COMOVO:
- Create and manage your account
- Track and display your workouts, routes, and fitness statistics
- Connect you with nearby users who share your sports interests
- Enable social features: messaging, comments, likes, friend connections
- Organize and display local fitness events
- Send notifications about friend requests, messages, event updates, and workout activity
- Generate workout maps and route visualizations
- Calculate calories, pace, and other fitness metrics
- Keep the service secure and reliable
We do not use your data for advertising, we do not profile you for marketing, and we do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
5. Legal Bases (GDPR)
- Performance of a contract (Art. 6(1)(b)) — to provide the features you ask for, such as your account, workouts, events, and messaging.
- Consent (Art. 6(1)(a)) — for optional data such as precise location, optional profile fields (e.g. weight/height), and the pre-launch waitlist. You can withdraw consent at any time (see Section 9).
- Legitimate interests (Art. 6(1)(f)) — to keep the service secure and prevent abuse, balanced against your rights. You have the right to object to processing based on legitimate interests.
6. Location and Background Tracking
Location is used in two ways:
- Approximate location to show nearby people, workouts and events.
- Precise GPS, including in the background, only while you are running an active workout you started. On Android this uses a foreground service with a visible notification; on iOS it uses the background-location capability. Tracking stops when you end the workout.
You control this: location requires your device permission, which you can revoke at any time. To protect your privacy, you can define privacy zones that hide chosen areas (for example, around your home) from shared routes, and per-workout visibility settings (public, friends, or private) control who can see your activity at all.
7. Who We Share Data With
We share data only with service providers that help us run COMOVO, and only as needed:
| Provider | Role | What they receive |
|---|---|---|
| Supabase | hosting (database, authentication, storage, realtime) | the data described above, hosted in the EU (Ireland) |
| "Sign in with Google" (optional) | your sign-in identity, if you use it | |
| Apple | "Sign in with Apple" (optional) | your sign-in identity, if you use it |
| Mapbox | maps, map tiles and static workout-map images | your IP address, the map area you view and, for static workout-map images, the geometry of the route being rendered |
| Thunderforest, OpenStreetMap | maps and map tiles | your IP address and the map area you view |
| Apple / Google location services | turning coordinates into place names | coordinates being looked up |
These providers are bound by their own terms and act as our processors where applicable. We do not use any third-party analytics, advertising, or tracking SDKs. We do not share your data with advertising networks or data brokers, and we do not "sell" or "share" personal data in the sense used by US privacy laws.
8. Storage, Retention and Deletion
Your data is hosted by Supabase in the European Union (Ireland) and protected in transit (TLS) and at rest. Access is controlled by row-level security so you only reach your own data and what others have chosen to share with you. Passwords are stored only in hashed form, sign-in tokens are kept in encrypted device storage (iOS Keychain / Android Keystore), and media files are stored in access-controlled storage buckets.
While your account is active
We keep your data for as long as your account exists.
When you delete content
You can delete individual workouts, events, and other content at any time within the app. Deleted items are marked for removal and fully erased by a scheduled clean-up within 30 days, so the change reaches all your devices.
When you delete your account
You can delete your account from within the app. Deletion begins promptly: we create a durable server-side deletion job that retries interrupted storage and database steps until your personal content, photos, route files and sign-in identity have been removed, even if you close or uninstall the app. During completion, narrowly scoped deletion control records may temporarily retain your account identifier solely to retry the job and prevent a still-valid sign-in token from recreating data; they are removed after that bounded containment period. For a short period (up to 30 days) non-identifying technical records (anonymous identifiers and timestamps, containing no personal data) remain so the deletion propagates to other users' devices; these are then permanently removed. Encrypted backups roll over on a short cycle (about 7 days) and are never used to restore a deleted account.
One narrow exception: if your account was involved in a safety report (a report you filed, or one filed about you), we keep a minimal record of that report with your identifiers replaced by coded values (pseudonymised — re-identifying you would require a separately stored key, which we use only where the law requires it), for up to 12 months after the report is closed. We keep it only to establish, exercise or defend legal claims (GDPR Art. 17(3)(e)); it is accessible only to authorised staff, is never used for any other purpose, and is then permanently deleted.
The app also keeps a local copy of your data on your device (an SQLite database) so it can work offline; it is not accessible to other apps and is cleared when you log out or delete your account.
9. Your Rights
Under the GDPR (and, where applicable, equivalent US state laws) you have the right to:
- Access your data — you can view it in the app.
- Rectify it — edit your profile and content in the app.
- Erase it — delete your account in the app (see Section 8).
- Data portability — request a copy of your data in a portable format.
- Withdraw consent — for example, by turning off location permission, or by contacting us.
- Object or restrict certain processing.
To exercise any right, contact hello@comovo.eu. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. In Poland, the relevant authority is the President of the Personal Data Protection Office (UODO): uodo.gov.pl. If you reside in another EU/EEA country, you may contact your local data protection authority.
10. International Transfers
COMOVO is hosted in the European Union (Ireland). If you use COMOVO from outside the EU (for example, the United States), your data is stored on EU servers. Some of our providers (Mapbox, Google, Apple) may process limited data outside the EEA, including in the United States. Where personal data is transferred internationally, those transfers are governed by appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission under our providers' data-processing agreements
- EU-U.S. Data Privacy Framework, where applicable
11. Washington State Residents
If you live in Washington State, certain fitness and location data may be "consumer health data" under the My Health My Data Act. Our Consumer Health Data Privacy Policy explains what we collect, how we use it, the consent we obtain, and how you can withdraw consent or delete this data.
12. Automated Decision-Making
COMOVO does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Features such as nearby user matching and calorie estimation are based on simple calculations and do not constitute profiling under GDPR.
13. Cookies
The COMOVO website may use basic cookies necessary for its operation (e.g., language preferences). We do not use cookies for advertising or behavioral tracking.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. If changes are significant, we will notify you through the app or via email.
15. Contact
If you have any questions or concerns about this Privacy Policy or your personal data, please contact us at:
hello@comovo.eu