Privacy Policy

Movement Assessment and Health Data

During the movement assessment, your camera images are analyzed directly on your device and never uploaded. From these recordings we calculate movement metrics, scores, and your movement age. With an account, we store these values along with your year of birth in our database (Supabase, server location Frankfurt). Without an account, the full measurement data remains in your browser's local storage (localStorage) for up to 7 days; when you create an account, it is transferred into your account.

Waitlist Registration

When you register for our waitlist, we collect your email address. This data is used exclusively to inform you about the launch of our application. Emails are sent via our email service provider Resend.

Server Log Files

Our hosting provider (Cloudflare, server location: Germany/Frankfurt) automatically collects information in server log files (e.g. IP address, browser type, access time). This data is not merged with other data sources.

Campaign Measurement for Visits from Our Ads

If you reach our website through one of our ads (e.g. on Instagram or Facebook), the link contains campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). They state which campaign and ad the click came from. We keep these parameters in your browser's sessionStorage for as long as the browser tab is open, and we use utm_content to show the start page that matches the ad. In our database (Supabase, Frankfurt) we record which steps follow the click: opening the page, starting the test, allowing or denying the camera, completing the test, and switching from the in-app browser to your default browser. For each step we store only the campaign parameters, the page opened, the operating system (Android, iOS or other), the in-app browser (Facebook, Instagram or TikTok) and, if the camera was denied, the technical type of error. These entries contain no IP address, no device or user identifier and no test results. If you sign in with a newly created account in the same tab, we link the campaign to that account once; this link is deleted together with your account. We do not send any of this data to advertising platforms such as Meta. The purpose is to measure which ads lead to completed tests. The legal basis is our legitimate interest (Art. 6 para. 1 lit. f GDPR). You can object to this processing at any time by email.

Email Delivery (Resend)

For sending emails, we use the Resend service. This includes waitlist communication as well as purchase confirmation emails; the latter contain a link to your report.

Sign-in with Google or Apple

Instead of email and password, you can sign in with your Google or Apple account. You are redirected to the provider's sign-in page for this. After a successful sign-in, the provider sends us a unique user identifier, your email address and, where applicable, your name (with Google, also a link to your profile picture). With Apple, you can use a forwarding address generated by Apple instead of your real address ("Hide My Email"); Apple forwards emails sent to this address to you. We use this data solely to create your account and sign you in. The legal basis is Art. 6(1)(b) GDPR. Processing on the provider's sign-in page is governed by the provider's own privacy policy.

AI Report (Google Cloud Vertex AI)

To generate your personal report, we transmit your calculated movement metrics, scores, and age to Google Cloud (Vertex AI). We currently cannot rule out processing outside the EU. If generation fails, the same data is transmitted again on retry.

Payment Processing (Stripe)

Payments are processed by the payment provider Stripe. Your payment details (e.g. card data) are processed directly by Stripe and never reach our systems. To match the purchase, we transmit a reference to your test result (test result ID) to Stripe.

Hosting (Cloudflare)

Our website is delivered via Cloudflare. In doing so, Cloudflare processes technical connection data (see Server Log Files and Geo-Localization).

Own Usage Analytics

We measure ourselves how our website and the movement test are used, to improve both and to understand which ads and content lead to completed tests and purchases. We record: pages viewed, scroll depth, sections seen and elements clicked; the steps of the test (e.g. start, the request for and the granting or refusal of camera and motion sensor access, progress within each exercise, abandonment or completion) with their times and durations; the purchase steps (the price variant shown, the confirmation dialog, the redirect to the payment provider, the return, a cancellation or an error code); the sign-in steps (the method chosen, a code sent or confirmed, errors as codes); your age group in ten-year steps; technical data such as load times and error messages; device type, operating system and browser in coarse categories, language, country and, for visits from the US, the state (determined by Cloudflare, without your IP address); where the visit came from (campaign parameters, domain of the referring page) and, for a purchase, its link to the visit. Your measurements and results (angles, scores, movement age) are not part of this analysis; they stay with your test results. To connect your visits we store a random, pseudonymous identifier in your browser's localStorage and a session identifier in its sessionStorage. If you sign in, we link your visits to your account. The data is kept in our database (Supabase, Frankfurt); we do not pass it on to third parties or to advertising platforms such as Meta. The legal basis is our legitimate interest in improving our service and measuring our advertising (Art. 6(1)(f) GDPR). You can object at any time: with "Decline" in the cookie notice, in the cookie settings in the footer, with your browser's Global Privacy Control signal, or by email. After an objection we delete the identifiers in your browser and remove all identifiers and links of your earlier visits from our database; from then on we only count individual events such as page views or test starts without any identifier. Until the switch-over is complete, our previous analytics also runs; it only records after your consent in the cookie notice and also stores the overall score of the test.

Geo-Localization for Privacy Compliance

We use Cloudflare's geolocation service to determine which country you are visiting our website from. We use it to show you the withdrawal-right notice that applies to your country when you buy. We ask every visitor for cookie consent in the same way, regardless of country.

Important: Cloudflare processes your IP address temporarily to determine the country code. We ourselves only receive and store the country code (e.g. "DE"), not your IP address. The country code is stored in your browser's sessionStorage (deleted when closing the tab). It reaches our database together with the usage data (see "Own Usage Analytics").

Legal basis: Legitimate interest (Art. 6 para. 1 lit. f GDPR) to comply with legal obligations in different jurisdictions.

Cookies and Local Storage

Our website does not use cookies for marketing or tracking purposes. We use local storage (localStorage, sessionStorage) for the functionality of the website (e.g. language setting, cookie consent, temporary session data), for campaign measurement on visits from our ads (see section 3) and for our own usage analytics with pseudonymous identifiers (see section 4).