Legal · Draft
Privacy policy
What personal data ReadMyMove collects through the website, the waitlist, the app and the pods, why, where it is stored, how long we keep it and your rights.
Version 1.1-draft · 1 November 2026 · All legal pages
Draft — pending lawyer review
This text describes how ReadMyMove works today, but a lawyer has not reviewed it yet. It may change before the public launch.
Draft — pending lawyer review. This text describes how ReadMyMove works today and during the beta. It has not yet been reviewed by a lawyer and may change before public launch. If something here is unclear, email hello@readmymove.com.
1. Who we are
ReadMyMove is a product of Profit Flow Ltd., a company registered in Bulgaria (EU) [company number and registered address — to be added]. Profit Flow Ltd. is the controller of the personal data described here.
Contact for anything about privacy: hello@readmymove.com. We have not appointed a data protection officer yet [to be confirmed in legal review].
2. The short version
- Your movement recordings are private by default. Nobody else sees them unless you share them.
- We treat movement data as special-category data under GDPR Article 9 and process it only with your explicit consent.
- Everything is stored in the EU (Frankfurt, Germany).
- We don't sell your data and we don't use advertising trackers.
- Using your recordings to improve our analysis models is a separate, optional consent, off by default.
- You can get a copy of your data or delete it at any time.
3. What we collect and why
3.1 Website and waitlist (readmymove.com)
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email address, consent time and consent text version | Email you about the launch and pre-orders | Your consent (Art. 6(1)(a)) | Until you unsubscribe, or 24 months without an order |
| Optional answers: main sport, role, kit of interest | Decide which sports to support first | Your consent | Same as above |
Page the form was on, campaign tags in the link (utm_*) | Know which posts brought people to us | Legitimate interest (Art. 6(1)(f)) | Same as above |
| IP address in server logs | Stop abuse of the forms (rate limiting) | Legitimate interest | 5 days |
The website sets no cookies and uses no third-party trackers. If we add privacy-friendly, cookieless visitor statistics, we will list the tool in Sub-processors and it will not identify you.
3.2 Your account (app.readmymove.com)
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email, password (stored only as a secure hash), name (optional) | Create and secure your account | Contract (Art. 6(1)(b)) | Until you delete your account |
| Year of birth | Confirm you are 14 or older (required at sign-up) | Contract and legal obligation (age of digital consent) | Until you delete your account |
| Optional body details: height, leg length, weight | Improve the analysis (for example, stride and pace estimates) | Your explicit consent (Art. 9(2)(a)) | Until you remove them or delete your account |
| Settings and preferences | Make the app work the way you chose | Contract | Until you delete your account |
| Your consents and their history | Prove what you agreed to and when | Legal obligation (Art. 6(1)(c), Art. 7(1)) | 6 years after the record, then anonymised |
| Optional app usage statistics: which screens and buttons you use, whether actions worked, rough timings (for example "under 30 seconds"), with a pseudonymous id. Never recordings, results, notes, body details, email or location | Find what is confusing or broken in the app and improve it | Your consent (Art. 6(1)(a)), off by default; switch it on or off in Settings → Privacy & data | Up to 12 months; deleted when you withdraw or delete your account |
| Feedback you send from the app (your message, the page you were on, an activity id if you report a result) | Fix problems and improve the app | Legitimate interest (Art. 6(1)(f)) | Until you delete your account |
| Data exports you request | Give you a copy of your data | Legal obligation (Art. 15, 20) | Download link 24 hours, then the file is deleted |
3.3 Pods and recordings
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Pod serial numbers, names, colours, placements, firmware version, battery level | Connect and manage your pods | Contract | Until you remove the pod or delete your account |
| Motion recordings (accelerometer and gyroscope data from the pods or your phone, 100 samples per second), with time, activity type and your notes | Record and analyse how you move, and show you the results | Explicit consent (Art. 9(2)(a)) plus contract | Until you delete the recording or your account |
| Analysis results (for example steps per minute, contact time, angles, your Running Form score) | Show your results and progress | Explicit consent plus contract | Same as the recording |
Why we treat motion data as special-category data. Raw movement recordings could, in theory, reveal something about a person's health. We think the careful approach is to protect them like health data: explicit consent, EU storage, access only by you and the people you choose, and strict limits on staff access.
On your device. The web app first saves recordings in your browser's storage (IndexedDB), then uploads them to your account when you are online. If you sign out, synced recordings are removed from that browser; recordings that have not uploaded yet stay on the device until they upload.
ReadMyMove does not diagnose or assess injuries or health. The results describe movement and technique only.
3.4 Optional: helping improve the analysis (research consent)
If you switch this on, we may use your pseudonymised recordings to develop and test our analysis models (for example, better step detection or dance recognition). This is a separate, explicit consent, off by default, and you can withdraw it at any time. Details: Research consent.
3.5 Support and diagnostics
When you email us, we keep the conversation to help you (legitimate interest; contract). If you choose to send a diagnostics report from the app (Help → Send diagnostics), it contains technical details only (browser, app and firmware versions, Bluetooth availability, your pods' serial numbers, battery and connection state, sync status and the last 200 warning and error log lines). The app shows you the full report before it is sent. It never contains movement data, notes or body details; if you tick "attach this activity", it adds only the activity's id so support can open it. Diagnostics are deleted after 90 days.
3.6 Orders (from public launch)
When the shop opens, we will process your name, delivery address, order details and payment status to deliver your order and meet tax law. Card details go directly to our payment provider; we never see them. Invoices are kept for 10 years under Bulgarian accounting law. This section will be completed before the shop opens.
4. Who can see your data
- You.
- People you choose. Coach sharing (coming later) is opt-in, limited to the scope you pick, and you can revoke it at any time.
- ReadMyMove staff, only when needed to help you or keep the service running. Viewing raw movement data needs a written reason and is logged.
- Our service providers (sub-processors) that host and run the service for us, under data processing agreements. The full list, with what each does and where: Sub-processors.
- Authorities, only when the law requires it.
We do not sell personal data and we do not share it for advertising.
5. Where your data is stored
Our database and files are on servers in Frankfurt, Germany (DigitalOcean, FRA1). If a provider processes data outside the EU/EEA (for example, an email delivery service), we use the European Commission's Standard Contractual Clauses or an adequacy decision, as listed on the Sub-processors page.
6. How long we keep data
| Data | How long |
|---|---|
| Account | Until you delete it. After a deletion request we revoke access at once and erase everything within 14 days |
| Recordings and results | Until you delete them or your account |
| Accounts never verified | 30 days |
| Waitlist | Until you unsubscribe, or 24 months without an order |
| Consent and audit records | 6 years (to show what was agreed), anonymised after your account is erased |
| Diagnostics reports | 90 days |
| Server logs with IP addresses | 5 days (website), up to 30 days (app server) [to be confirmed] |
| Orders and invoices (from launch) | 10 years (Bulgarian accounting law) |
| Backups | Up to 6 months. Deleted data disappears from backups as they expire; we never restore deleted data into the live service |
7. Your rights
Under the GDPR you can:
- access your data and get a copy;
- export it in a machine-readable format (portability);
- correct it;
- delete it;
- restrict or object to some uses;
- withdraw any consent at any time. Withdrawing is as easy as giving it, and doesn't affect what was done before.
How: email hello@readmymove.com from the address on your account. We reply within one month (we may extend by two more months for complex requests, and will tell you why). In the app, under Settings → Privacy & data, you can change every consent, export all your data as one ZIP file (ready in minutes), and delete your account (you are signed out everywhere at once; everything is erased after 14 days unless you sign in and keep the account).
Data from the pods (EU Data Act). You can get the data your pods generate, in a readable format, and ask us to share it with a third party of your choice. Email us; a self-service option is planned.
Complaints. You can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority where you live or work. We'd appreciate the chance to fix it first.
8. Age
ReadMyMove accounts are for people aged 14 or older. Schools and clubs will be able to add younger members later, only with a parent's or guardian's consent.
9. Security
HTTPS everywhere, passwords stored as secure hashes, access rules so that each account can only read its own data, staff access logged, and encrypted backups. If a personal-data breach is likely to put you at risk, we will tell you and the authority as the law requires.
10. Automated decisions
The app automatically calculates movement results and suggestions (for example, "your focus for the next run"). These are suggestions only. They have no legal or similarly significant effect on you, and nothing changes in your plan unless you choose it.
11. Changes
We will post every new version here with its date. If a change is material (for example, a new use of your movement data), we will ask for your consent again in the app before it applies.
Version history
| Version | Date | Change |
|---|---|---|
| 1.1-draft | 2026-11-01 | Year of birth required at sign-up for the 14+ check; optional app usage statistics (consent, off by default), in-app feedback, diagnostics reports, self-service export and account deletion |
| 1.0-draft | 2026-11-01 | Full draft for the beta (accounts, pods, recordings, research consent). Replaces the waitlist-only notice of 31 October 2026 |