Privacy Policy

Last updated: 15 July 2026

Short version: We keep only what we need to run the service — your account email (if you sign up), your subscription tier, and a count of the analyses you run. Your uploaded video or photo is processed and then automatically deleted; it is never sold or handed to an advertiser. Only anonymous numeric measurements go to the AI that writes your coaching notes. If you buy an Expert Review, a real person reviews your clip. We run no advertising trackers.

Flapp ("we", "us", "our") analyzes side-view running and cycling technique from a short video or a single photo. This page explains what personal information we collect, why, who processes it, how long we keep it, and the rights you have over it. It is written to describe how the service actually behaves. Flapp is operated from British Columbia, Canada.

1. What we collect

If you use Flapp without an account

• The video or photo you upload for analysis.
• The sport and position you select (e.g. cycling, TT/Tri).
• Your IP address, which reaches our server automatically with any web request.

If you create an account

• Your email address and a password (we store only a salted one-way hash of the password — never the password itself).
• Your subscription tier and account creation date.
• A usage record: one row per analysis (timestamp and whether it was a video or a photo), used to enforce your plan's quota. It does not contain the media or the results.

If you buy a paid plan

• Payments are handled by a third-party payment processor. We do not receive or store your full card number. We receive only what the processor returns to us — such as a subscription status and a customer/transaction reference — so we can activate your plan.

We do not ask for your name, address, phone number, or date of birth, and we do not build advertising or behavioural profiles.

2. What we do with your media

• Your clip or photo is processed on our server to detect body pose and measure joint angles.
• For video, we optionally render an annotated "overlay" copy with the skeleton drawn on it, so you can review and download it.
• The uploaded file and any overlay are written to temporary storage on the processing server and are not stored in a database or long-term storage. They are discarded automatically (at the latest when the server instance restarts or redeploys, which happens frequently), and results are not persisted after you leave the page. We do not keep a copy for our own marketing or training.
• Your video or photo is never uploaded to any third-party AI service. Only anonymous numerical measurements (joint angles, scores, detected issues) are sent to Google's Gemini API to generate the written coaching notes — no images, and nothing that identifies you.

3. Expert Review — when a person sees your clip

If you purchase an Expert Review, your video is reviewed by a real human reviewer (not only the automated system) who writes a manual assessment. For this feature only:

• Your clip is retained until the review is delivered, so the reviewer can watch it — rather than being discarded immediately.
• It is accessed solely to produce your review, is not shared further, and is deleted once the review is complete (and in any case within a short period after delivery).

If you do not buy an Expert Review, no human reviews your footage — it is only processed automatically as described above.

4. Why we're allowed to use your data (legal basis)

For visitors in regions with data-protection laws such as the EU/UK GDPR, our legal bases are:

• Performing the service you asked for (a contract): analyzing your upload, running your account, and delivering a paid plan or Expert Review.
• Our legitimate interests: keeping the service secure, preventing abuse, and enforcing free-tier limits — balanced against your privacy.
• Legal obligation: keeping limited billing records where tax or accounting law requires it.

5. Your IP address

For anonymous visitors, we use the IP address for one purpose: to enforce the free-tier limit (a small number of analyses per day). Anonymous IP addresses are kept in the server's memory on a rolling 24-hour window and are cleared automatically — they are not written to a database, linked to your media, or shared.

6. Cookies and tracking

Flapp runs no analytics or advertising trackers. If you sign in, we use a token stored in your browser to keep you logged in — this is required for the service to work, not for tracking. Your remaining daily quota (for anonymous use) is stored in your own browser's local storage, on your device — not on our server.

7. Who processes your data (third parties)

We do not sell, rent, or share your personal information with anyone else, and we do not use it for third-party advertising.

8. International transfers

Flapp is operated from Canada, and our providers (above) may process data on servers in Canada, the United States, or elsewhere. If you access Flapp from the EU/UK, this means your data may be transferred outside your country. We rely on the providers' own safeguards (such as standard contractual clauses) for these transfers, and we keep the personal data involved to the minimum described here.

9. How long we keep it

10. Your rights

Depending on where you live (including under Canada's PIPEDA and the EU/UK GDPR), you can:

• Access the personal information we hold about you.
• Correct it if it's wrong.
• Delete your account and associated data ("right to be forgotten").
• Export your data in a portable form.
• Object to or restrict certain processing, and withdraw consent where we relied on it.
• Complain to your data-protection authority (in Canada, the Office of the Privacy Commissioner).

Because your media is not stored, most of these rights concern your account. To exercise any of them, email us (below) and we'll respond within a reasonable time — and within any period the law requires.

11. Security

We use HTTPS in transit, store passwords only as salted hashes, and keep media in temporary storage rather than a permanent database. No system is perfectly secure, so we cannot give an absolute guarantee — but we keep the personal data we hold deliberately minimal to limit the impact if something goes wrong. If a breach ever affects your data, we will notify you and the relevant authority as required by law.

12. Children

Flapp is not intended for children under 16. Please don't create an account for, or upload footage of, a minor without the consent of a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes

This is an evolving product, and this policy may change as the service grows. We'll update the "last updated" date above when it does, and for material changes affecting account holders we'll make a reasonable effort to let you know.