Privacy policy

BambooRoll — Privacy Policy
Last updated: 14 September 2026

BambooRoll ApS ("BambooRoll", "we", "us", "our") operates the BambooRoll mobile app for iPhone and Android (the "App") and the online shop at bambooroll.org (the "Shop"). This policy explains what personal data we collect, how we use it, who we share it with, and your rights. We collect the minimum needed to run our services, and we never sell your data or use it for advertising.

We are the data controller responsible for your personal data:
BambooRoll ApS, CVR 46568788, Falkoner Allé 67, 2000 Copenhagen, Denmark.
Contact: support@bambooroll.org

1. INFORMATION WE COLLECT

App:
• Account: your email address and a user ID when you create an account (via email, Sign in with Apple, or Sign in with Google). With Sign in with Apple you may use Apple's private email relay.
• Recovery profile: information you enter — such as sport, training load, goals, problem areas, and daily readiness check-ins — used to personalize your sessions.
• Activity in the App: your completed sessions and streak history.
• Health & fitness data (optional): if you connect Apple Health (iPhone only), we read only your recent workouts and heart rate, and only after you grant permission. If you connect Strava or WHOOP, we access your recent activity and recovery data. These connections are optional, you control them, and you can disconnect at any time. We never write data back to Apple Health.
• Purchases: your subscription status, processed through Apple's In-App Purchase or Google Play Billing and our provider RevenueCat. We never receive your payment card details.
• Feedback board: if you post or vote on the in-app feedback board, your post, display name and votes are visible to other users of the App.
• Usage statistics (optional): if you allow it, which features of the App you use. See section 4.
• Referrals: a referral code and who invited you, if you use the invite feature.

Shop (bambooroll.org):
• Order data: your name, email, shipping and billing address, and the contents of your order.
• Payment: processed securely by our payment providers via Shopify; we do not receive or store your full card details.
• Website usage: our shop runs on Shopify, which uses cookies and similar technologies to operate the store, remember your cart, and understand site usage.

2. HOW WE USE YOUR DATA, AND OUR LEGAL BASES (GDPR)
• To provide and personalize the App (build your recovery plan, adapt sessions, track progress) — legal basis: performance of a contract, and your consent for health data and the AI coach.
• To understand how the App is used and improve it, through optional usage statistics — legal basis: your consent.
• To process and deliver Shop orders, handle returns, and provide support — legal basis: performance of a contract.
• To manage subscriptions and purchases — legal basis: performance of a contract.
• To meet legal obligations, such as accounting and tax record-keeping — legal basis: legal obligation.
• To keep our services secure and improve them — legal basis: our legitimate interests.
Special category (health) data is processed only on the basis of your explicit consent, which you can withdraw at any time.

3. THE AI COACH (OPTIONAL)
If you turn on the AI coach, a pseudonymous summary of your recovery context (such as sport, soreness, sleep, recent sessions, and injury areas) is sent to our AI provider, Anthropic, in the United States, to generate guidance. We never send your name or email. The AI coach requires your explicit consent and can be turned off at any time in Settings → Data & Privacy. Its output is general guidance, not medical advice.

4. USAGE STATISTICS (OPTIONAL)
If you allow usage statistics, the App sends our analytics provider, PostHog, a record of which features you use — for example that the App was opened, that a session was started or completed, which routine or exercise was opened, how long a session lasted, whether the paywall was shown, your sport, whether you are on a trial or subscription, and whether you use iPhone or Android. These records are linked to a random user ID.
We never send your name, email address, injuries, soreness, readiness answers, or any other health data, and we do not record your screen or what you type. PostHog stores this data in the European Union and is configured not to store your IP address.
Usage statistics are only collected if you choose them, and you can turn them off at any time in Settings → Data & Privacy. Collection stops immediately.

5. WHO WE SHARE DATA WITH
We do not sell your data and do not use it for advertising or cross-app tracking. We share data only with service providers ("processors") who help us run our services, and only as needed:
• Supabase — app data storage (hosted in the European Union)
• Anthropic — the optional AI coach (United States)
• PostHog — optional usage statistics (hosted in the European Union)
• RevenueCat, Apple and Google — subscriptions and purchases
• Apple and Google — sign-in, if you choose to use it
• Shopify — our online shop and website
• Payment and shipping providers — to process payments and deliver orders
We may also disclose data where required by law.

6. INTERNATIONAL TRANSFERS
Most data is stored in the EU. Some optional features process data in the United States (the AI coach via Anthropic), and some of our providers are based in the United States. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. DATA RETENTION
We keep your data for as long as your account is active or as needed to provide our services. When you delete your account, we delete your account, profile, recovery and health data, session history, connected-app access, AI coach history, and feedback board posts from our systems; backup copies are overwritten within 30 days. Records of subscription purchases are kept by Apple, Google and RevenueCat as needed for billing and accounting, and Shop order and transaction records are kept as long as required by law (for example, Danish accounting rules).

8. YOUR RIGHTS
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). You can export your data, change your consent choices, and delete your account at any time in the App under Settings → Data & Privacy. You can also request deletion without the App — see bambooroll.org/pages/delete-account. To exercise any right, contact us at support@bambooroll.org.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) or your local supervisory authority.

9. SECURITY
We use technical and organizational measures to protect your data, including encryption in transit, encryption of sensitive tokens, and access controls. No system is perfectly secure, but we work to keep your data safe.

10. CHILDREN
BambooRoll is not intended for children under 16, and we do not knowingly collect data from children.

11. CHANGES
We may update this policy from time to time. The current version will always be posted on this page with an updated date.

12. CONTACT
BambooRoll ApS
Falkoner Allé 67, 2000 Copenhagen, Denmark
CVR: 46568788
Email: support@bambooroll.org