BambooRoll — Privacy Policy
Last updated: 28 July 2026
BambooRoll ApS ("BambooRoll", "we", "us", "our") operates the BambooRoll mobile app (the "App") and the online shop at bambooroll.org (the "Shop"). This policy explains what personal data we collect, how we use it, who we share it with, and your rights. We collect the minimum needed to run our services, and we never sell your data or use it for advertising.
We are the data controller responsible for your personal data:
BambooRoll ApS, CVR 46568788, Falkoner Allé 67, 2000 Copenhagen, Denmark.
Contact: support@bambooroll.org
1. INFORMATION WE COLLECT
App:
• Account: your email address and a user ID when you create an account (via email, Sign in with Apple, or Google). With Sign in with Apple you may use Apple's private email relay.
• Recovery profile: information you enter — such as sport, training load, goals, problem areas, and daily readiness check-ins — used to personalize your sessions.
• Activity in the App: your completed sessions and streak history.
• Health & fitness data (optional): if you connect Apple Health, we read only your recent workouts and heart rate, and only after you grant permission. If you connect Strava or WHOOP, we access your recent activity and recovery data. These connections are optional, you control them, and you can disconnect at any time. We never write data back to Apple Health.
• Purchases: your subscription status, processed through Apple's In-App Purchase and our provider RevenueCat. We never receive your payment card details.
• Referrals: a referral code and who invited you, if you use the invite feature.
Shop (bambooroll.org):
• Order data: your name, email, shipping and billing address, and the contents of your order.
• Payment: processed securely by our payment providers via Shopify; we do not receive or store your full card details.
• Website usage: our shop runs on Shopify, which uses cookies and similar technologies to operate the store, remember your cart, and understand site usage.
2. HOW WE USE YOUR DATA, AND OUR LEGAL BASES (GDPR)
• To provide and personalize the App (build your recovery plan, adapt sessions, track progress) — legal basis: performance of a contract, and your consent for health data and the AI coach.
• To process and deliver Shop orders, handle returns, and provide support — legal basis: performance of a contract.
• To manage subscriptions and purchases — legal basis: performance of a contract.
• To meet legal obligations, such as accounting and tax record-keeping — legal basis: legal obligation.
• To keep our services secure and improve them — legal basis: our legitimate interests.
Special category (health) data is processed only on the basis of your explicit consent, which you can withdraw at any time.
3. THE AI COACH (OPTIONAL)
If you turn on the AI coach, a pseudonymous summary of your recovery context (such as sport, soreness, sleep, recent sessions, and injury areas) is sent to our AI provider, Anthropic, in the United States, to generate guidance. We never send your name or email. The AI coach is off by default, requires your explicit consent, and can be turned off at any time in Settings. Its output is general guidance, not medical advice.
4. WHO WE SHARE DATA WITH
We do not sell your data and do not use it for advertising or cross-app tracking. We share data only with service providers ("processors") who help us run our services, and only as needed:
• Supabase — app data storage (hosted in the European Union)
• Anthropic — the optional AI coach (United States)
• RevenueCat and Apple — subscriptions and purchases
• Shopify — our online shop and website
• Payment and shipping providers — to process payments and deliver orders
We may also disclose data where required by law.
5. INTERNATIONAL TRANSFERS
Most data is stored in the EU. Some optional features process data in the United States (the AI coach via Anthropic). Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. DATA RETENTION
We keep your data for as long as your account is active or as needed to provide our services. Order and transaction records are kept as long as required by law (for example, Danish accounting rules). When you delete your account, we remove your associated app data from our systems.
7. YOUR RIGHTS
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). You can delete your account and associated data at any time in the App under Settings → Data & Privacy. To exercise any right, contact us at support@bambooroll.org.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) or your local supervisory authority.
8. SECURITY
We use technical and organizational measures to protect your data, including encryption of sensitive tokens and access controls. No system is perfectly secure, but we work to keep your data safe.
9. CHILDREN
BambooRoll is not intended for children under 16, and we do not knowingly collect data from children.
10. CHANGES
We may update this policy from time to time. The current version will always be posted on this page with an updated date.
11. CONTACT
BambooRoll ApS
Falkoner Allé 67, 2000 Copenhagen, Denmark
CVR: 46568788
Email: support@bambooroll.org