Rideo Privacy Policy - tooocycling

1. Key points at a glance

Question	Short answer
What we collect	Email address, nickname and profile photo; your precise location track and workout data while you record; health data you choose to import (heart rate, power, etc.); activity photos you choose to add (we upload only a reduced-size copy); works you publish.
Why we collect it	To provide recording, cloud backup, poster / video / 3D work creation, and publishing and browsing in Explore.
Ads or third-party analytics?	There are no ads in the app, no advertising identifiers, and no cross-app tracking. We have not added any analytics or crash-reporting tools ourselves; the component from our map provider Mapbox automatically sends usage statistics, see Section 5.
Is anything uploaded automatically?	Yes. Once you sign in, every activity you save or import is automatically uploaded to the cloud as a backup, and the app currently has no switch to turn this automatic sync off. See Section 3.3.
Who can see it	By default, only you. Works you publish to Explore are public; for activities where you turn on a share link, anyone with the link can view them.
Who we share it with	Our cloud provider (Google Cloud), map services (OpenFreeMap, Mapbox), Apple / Google sign-in, our verification-code email provider, and public geographic data services used when creating 3D works. We do not sell personal information. See Section 5.
Where it is stored	Our servers are in Japan (Google Cloud Tokyo), and 3D works are created there too. Our operations team is in mainland China and may remotely access this data when maintaining the Service. See Section 9.
How to delete it	Request account deletion in the app; you can cancel within 30 days, after which we delete your cloud data. You can also request deletion by email. See Sections 10 and 11.
Cost	The app is currently completely free, with no in-app purchases.

2. Scope and who we are

2.1 This policy applies to the Rideo app we provide (iOS and Android, the "Service"). The Service is for recording, reviewing and creating from cycling and other workouts.

2.2 For the processing of personal information described in this policy, we are the "personal information handler / data controller" and are responsible for your personal information.

2.3 The Service is currently available in app stores in the following countries / regions: mainland China, South Korea, the European Union, the United Kingdom, the United States, and other countries and regions.

2.4 Website: Our website is a purely static site. It has no accounts or forms, uses no cookies, and loads no third-party analytics, advertising or external font scripts. Each language version of the website has its own web address, and the website does not store your language choice or any other information in your browser. The website is hosted on servers in the Tencent Cloud Hong Kong region. The servers do not record visitors' IP addresses; they record only the access time, the requested URL and the browser type, which are used for troubleshooting and are automatically deleted after 30 days.

2.5 Hardware products: The Tail01 Max tail light, the DVR80 V2 rear-view recorder and the SIGHT 01 camera currently have no features that connect to Rideo or to our servers, and we do not receive any of your personal information through this hardware. If we later add connection, locating or similar features, we will update this policy before those features launch.

3. Information we collect

3.1 Overview

The "Legal basis" column uses the terms of the EU GDPR: Contract = we cannot provide the feature you want without it; Consent = you actively authorize it or take the action; Explicit consent = a separate authorization you give specifically for this type of sensitive data; Legitimate interests = our reasonable interests, such as keeping the Service secure, that do not override your rights.

Category: Account and sign-in
What we collect: Email; when you sign in with Apple / Google, the account identifier and the email they provide (which may be an Apple relay email); nickname, profile photo; user ID; unit preference (metric / imperial)
Purpose: Signing in, identifying your account, showing your profile
Legal basis: Contract
Where it is stored: Cloud database and storage (Japan)
How long we keep it: While your account exists; after account deletion, see Section 10
Public?: Your nickname and profile photo can be seen by others when you publish a work or turn on a share link; your user ID also becomes public when you publish a work

Category: Sign-in credentials
What we collect: Sign-in token (the server stores only its hash); a device number randomly generated the first time you sign in to the app (not your phone's real device ID, and it contains no model or similar information)
Purpose: Keeping you signed in, telling your signed-in devices apart
Legal basis: Contract
Where it is stored: On your phone (system Keychain / Keystore) + cloud database
How long we keep it: The token expires 30 days after it was last used (it renews automatically when used); it is revoked when you sign out or delete your account
Public?: No

Category: Email verification codes
What we collect: Email address, the verification code (stored as a hash), when it was sent, the number of wrong attempts; a per-email count of codes sent that day (used to limit how many codes can be sent per day)
Purpose: Verifying your identity for email sign-in and account deletion; preventing verification codes from being sent abusively
Legal basis: Contract; preventing abuse is a legitimate interest
Where it is stored: Cloud database (Japan); emails are sent via the email sending service of Amazon Web Services (Amazon SES, Tokyo region)
How long we keep it: A code is valid for 10 minutes; it is deleted immediately after successful verification or 5 wrong attempts; an expired, unused record is replaced by a new one the next time you request a code, or deleted when you delete your account; if no account was ever created with that email (for example, you mistyped it), that record is currently kept indefinitely. The daily send count expires automatically after 24 hours
Public?: No

Category: Precise location and track
What we collect: GPS points while you record (time, latitude and longitude, altitude, speed); a simplified route with points thinned out
Purpose: Recording your track, cloud backup and restoring on a new phone, creating works
Legal basis: Consent (system location permission); recording and backup are also needed under the contract
Where it is stored: On your phone; automatically uploaded to the cloud once you sign in (full track file and simplified route)
How long we keep it: While your account exists; for deleting a single activity, see Section 10.3
Public?: No by default; see Sections 6 and 8

Category: Location in Explore
What we collect: Your current location when you turn on location in Explore (used only to move the map near you); the map area you are viewing
Purpose: Showing public works in that area
Legal basis: Consent (location permission); legitimate interests (providing the browsing you requested)
Where it is stored: Your current location is used only on your phone; the map area is sent to the server with each request and may appear in server access logs (see the "Network and access logs" row)
How long we keep it: Same as access logs
Public?: No

Category: Workout statistics
What we collect: Distance, moving time, total time, climb, average speed, max speed, average power; functional threshold power (FTP, set by you); the activity's time zone; the name of the device an import came from and a fingerprint of the imported file (used to detect duplicate imports)
Purpose: Showing statistics, overlays on works and videos, duplicate checks
Legal basis: Contract
Where it is stored: On your phone + cloud database (Japan)
How long we keep it: While your account exists
Public?: Some statistics become public when you publish a work or turn on a share link (see Section 8)

Category: Health data (imported)
What we collect: With your permission, cycling workout records, routes, heart rate, power and distance read from Apple Health / Health Connect; heart rate, power, cadence and temperature contained in FIT / GPX files you import
Purpose: Importing the workout records or files you choose as activities
Legal basis: Explicit consent
Where it is stored: After import, written into that activity's track file, then stored and uploaded to the cloud together with your other activity data
How long we keep it: Same as activity data
Public?: Average power becomes public when you publish a work; heart rate is not among the statistics attached to a work, but if you choose to show heart rate on screen in a data video and publish that video, your heart rate becomes public as part of the video (see Section 7.4)

Category: Activity photos
What we collect: Photos you add to an activity: we upload only a reduced-size copy with a long edge of about 1,200 pixels; the capture time; the position and distance on the track matched from the capture time
Purpose: The photo strip on the activity detail page, posters, restoring on a new phone
Legal basis: Consent (you choose to add them)
Where it is stored: Cloud storage (Japan)
How long we keep it: While your account exists; deleted when you remove the photo or delete the activity
Public?: No by default; once you publish a work, all of that activity's photos (including ones added later) and their capture times become public (see Section 8.1); anyone with a share link you turn on can also see the photos

Category: User content
What we collect: Activity titles; posters, videos and 3D works you create and their covers
Purpose: Displaying, restoring 3D works from the cloud, publishing to Explore
Legal basis: Contract
Where it is stored: Activity titles are stored with the activity in the cloud database (Japan); 3D works are stored in cloud storage (Japan); posters and data videos are created and saved on your phone, and are uploaded to cloud storage (Japan) only when you publish them to Explore
How long we keep it: While your account exists
Public?: Only the parts you publish / share are public

Category: Reports and blocks
What we collect: Reporter, reported work, reason, notes; block relationships (both IDs and the time)
Purpose: Handling content that breaks the rules, letting you stop seeing a particular author
Legal basis: Legitimate interests (protecting users and the platform)
Where it is stored: Cloud database (Japan); new reports are emailed to our operations mailbox (the email does not include the reporter's identity)
How long we keep it: Kept until the reporter or the author of the reported work deletes their account; for report notification emails in our operations mailbox, see the next row
Public?: No

Category: Emails between you and us
What we collect: Emails and attachments you send to support@tooo.live (for example, identity information and files you provide when asking to delete your account, export your data, appeal or complain) and our replies; report notification emails
Purpose: Handling your requests, appeals, complaints and reports
Legal basis: Contract; handling appeals, complaints and reports is a legitimate interest
Where it is stored: Our support mailbox
How long we keep it: Kept for 3 years after the last exchange and deleted when that period ends; deleting your account does not automatically delete these emails
Public?: No

Category: Network and access logs
What we collect: When you access our servers: your IP address, the requested URL (Explore requests include the map area), the request time, and request headers such as the browser or app identifier (fields such as sign-in tokens are masked; verification codes and sign-in credentials in the request body are not logged)
Purpose: Preventing abuse (rate limiting by IP or by account, for example public endpoints by IP and GPX downloads by account), troubleshooting, security
Legal basis: Legitimate interests
Where it is stored: Rate-limit counters are kept in a cache; access logs are kept on the server
How long we keep it: Rate-limit counters kept by IP or by account expire after at most 2 days; server access logs and runtime logs are kept for 30 days
Public?: No

Category: 3D rendering data
What we collect: The job input when creating a 3D work (track file, selected photos) and the 3D scene data generated from the track
Purpose: Creating the 3D work you requested
Legal basis: Contract
Where it is stored: Our rendering server in Google Cloud Tokyo
How long we keep it: See Section 9.2
Public?: No

3.2 Phone permissions

Permission: Location (precise / approximate); iOS "While Using the App" location and background location mode
When we ask: When you start recording; when you tap "Turn on location" in Explore
What it is for: Recording your track; moving the map near you in Explore

Permission: Foreground service (location type, Android)
When we ask: When you start recording
What it is for: Keeping an ongoing notification during recording so the system does not interrupt it

Permission: Notifications (iOS / Android)
When we ask: When you start recording
What it is for: Reminding you when you have been paused for too long

Permission: Physical activity / Motion & Fitness (Android activity recognition, iOS Motion & Fitness)
When we ask: When you start recording
What it is for: Telling riding from standing still, for auto-pause. This data is used only on your phone to make that call and is not uploaded (on Android, the recognition result is provided by the system's Google Play services).

Permission: Run at startup (Android)
When we ask: After installation
What it is for: Restoring the pause reminder notification after your phone restarts

Permission: Photos (read images / videos; on iOS, read and add)
When we ask: When you choose photos / videos, save a finished work, or change your profile photo
What it is for: Listing photos and videos taken around the time of the activity for you to choose from; saving the works you create. We read the original files directly from your photo library and do not copy them; videos are not uploaded (when you choose to publish a data video work, what is uploaded is the finished video). When you change your profile photo, the image you pick from your photo library is uploaded as your profile photo (this uses the system photo picker and does not need photo library permission).

Permission: Health data read (Apple Health, Health Connect)
When we ask: When you choose to import
What it is for: See Section 7

You can turn off any permission at any time in your system settings. The related feature will then be unavailable; other features are not affected.

3.3 Automatic cloud sync

Once you sign in, every activity you save or import is automatically uploaded to the cloud (full track file, simplified route and statistics) for backup and restoring on a new phone. The app currently has no switch to turn automatic sync off.
Activities saved while you are not signed in are first stored on your phone, and are uploaded automatically once you sign in.
If you do not want a particular activity uploaded, please do not sign in, or delete it from the app before you sign in. Without signing in, you can still record, save on your phone and browse Explore.
Automatically uploaded activities are visible only to you by default; uploading does not make them public.

3.4 What we do not collect

We do not use advertising, crash-reporting or push-notification SDKs, do not use advertising identifiers, do not read your phone's real device ID, and do not do cross-app tracking. We have not added any third-party analytics tools ourselves; the only exception is that the component from our map provider Mapbox automatically sends usage statistics (see Section 5).
We do not upload original videos or full-size photos from your photo library.
We do not collect contacts, microphone, camera or Bluetooth data.
The Service does not currently connect to any Bluetooth sensor, bike computer or our hardware. Heart rate and power come only from files or health data you choose to import.
The Service does not track your activity across websites, so it does not respond to browser "Do Not Track" signals.

4. How we use information

We use your information only for the following purposes:

Providing core features: sign-in, recording tracks, cloud backup and restoring on a new phone, creating posters / videos / 3D works.
Explore: showing works you publish (Section 8).
Security and abuse prevention: rate limiting, handling reports, taking down content that breaks the rules.
Maintenance and troubleshooting: reviewing runtime logs, fixing faults.
Meeting legal obligations and responding to lawful requests from competent authorities.

We do not use your information for advertising, we do not sell it, and we do not use it for purposes unrelated to those above. We do not use your information for automated decision-making or profiling; works in Explore are ordered by publication time, with no personalized recommendations.

5. Third parties and processors

We do not sell personal information. The table below lists the third parties that come into contact with data and their roles. For providers that process data on our behalf (marked "Processor" in the table), we require by contract that they process it only on our instructions and provide protection no lower than this policy. Other service providers handle the data they receive under their own privacy policies; we only choose service providers that publish a privacy policy and commit to protecting user data, and we try to give them only the data needed for the feature (the usage statistics that the Mapbox component sends automatically are currently outside our control, see the table below).

Recipient: Google Cloud, Tokyo region
Role: Processor: runs our servers, database, file storage and 3D work rendering
What they receive: All cloud data of the Service (see Section 3)
When: Continuously, once you sign in or sync
Location: Japan

Recipient: Verification-code email provider: Amazon Web Services (Amazon SES), Tokyo region
Role: Processor: sends verification-code emails and report notification emails
What they receive: Email address and the content of the verification-code email; report notification emails (work title, work type, work ID, author ID, reason for the report, additional notes written by the reporter, preview image link), which are sent to our operations mailbox
When: During email sign-in or verification for account deletion; when someone reports a work
Location: Japan

Recipient: OpenFreeMap (Hyperknot Software Kft.)
Role: Provider of map tiles and fonts
What they receive: Your IP address, the map area you are viewing (which tiles were requested), the request time, the app identifier
When: When you view a map
Location: Operator based in Hungary, delivered via Cloudflare. Privacy policy: https://openfreemap.org/privacy/

Recipient: Mapbox (Mapbox, Inc.)
Role: Maps (the mini map in data videos, including preview and export)
What they receive: The map area (that is, the area your track passes through), IP address, app identifier; the Mapbox SDK also automatically sends usage statistics (telemetry) under Mapbox's policy, which may include location information if you have granted location permission. We have not currently turned off this telemetry in the app.
When: When you use the feature above
Location: United States. Privacy policy: https://www.mapbox.com/legal/privacy

Recipient: Apple (via Sign in with Apple)
Role: Sign-in service
What they receive: Your sign-in process with Apple is handled by Apple; we only receive and verify the identity credential Apple returns (for verification, we only download public keys from Apple)
When: When you use Sign in with Apple
Location: As set out in Apple's privacy policy

Recipient: Google (via Sign in with Google)
Role: Sign-in service
What they receive: Same as above
When: When you use Sign in with Google
Location: As set out in Google's privacy policy

Recipient: Google Play services (Android system component)
Role: System location and activity recognition
What they receive: Device location and activity recognition requests, handled by the Android system component
When: While recording
Location: As set out in Google's privacy policy

Recipient: Public geographic data services: the OpenStreetMap Overpass service, AWS open terrain datasets, EOX satellite imagery, etc.
Role: Sources of terrain, building and imagery data
What they receive: Requests are sent by our rendering server and contain only the coordinate bounds of the area your track covers, with no information about your identity, and do not come from your phone
When: When creating a 3D work
Location: Public services outside China

Recipient: Our operations team in mainland China
Role: Us (not a third party)
What they receive: Server data accessible during operations work. See Section 9.3
When: During operations access
Location: Mainland China

Recipient: Apple App Store / Google Play
Role: App stores
What they receive: The store handles your download information under its own policies; the Service has no paid items and we do not receive your payment information
When: When you download and install
Location: —

We may also disclose information in the following situations: under the law, a court order or a lawful request from a competent authority; to protect the personal safety of you or others; and in a merger, acquisition or asset transfer of the company (in which case we will notify you and require the recipient to continue to follow this policy).

6. Location data

Location is our most sensitive data, and we handle it as sensitive personal information. Processing it is necessary: without location we cannot record your track or create route works. If it leaks, it may reveal your home address, the places you often go and your movement patterns, so it is not public by default, and when it is made public the start and end are cut off (Section 8).

6.1 When we get it:

Foreground: after you tap "Start" on the "Record" tab, the app continuously gets your location while in use. In Explore, the first time you open it, the app does not prompt you for permission on its own; it only asks after you tap "Turn on location", and once allowed, uses it to move the map near you.
Background: while a recording is in progress, the app keeps getting your location in the background even if you lock the screen or switch to another app, so your track is not interrupted (iOS uses background location mode; Android uses a foreground service with an ongoing notification). Once recording ends, the app no longer gets your location in the background.
When you are not recording and not using location in Explore, the app does not get your location.

6.2 How we use it: recording your track; automatically syncing it to the cloud once you sign in (Section 3.3); creating works; locating you in Explore. Location is not used for advertising and is not sold.

6.3 Who can see it: by default, only you. Only when you publish a work or turn on a share link is a processed route made public (with 500 m cut from both the start and the end; see Section 8 for details).

6.4 How to turn it off: turn off location permission in your system settings at any time, or end the recording. Recorded tracks can be deleted in the app; deleting your account deletes your track data in the cloud (Section 10).

7. Heart rate, power and other health data

Heart rate and power are sensitive personal information. We process them to import the workout records you choose in full and to use them for statistics, works and video overlays; if you do not import them, other features still work normally. If they leak, they may reveal your physical condition and fitness level, so we read them only when you choose to import, and the statistics attached to a work make public only average power, not heart rate (see Section 7.4).

7.1 What we read: we read only after you choose "Import from Apple Health" or "Import from Health Connect" and grant permission in the system prompt. We read cycling workout records and their route, heart rate, power and distance. The specific permissions are: on Android, read exercise, exercise routes, heart rate, power and distance; on iOS, read cycling workouts and their routes, heart rate, power and distance.

In addition, if a FIT / GPX activity you import from a file contains heart rate, power, cadence or temperature, this data is likewise written into that activity's track file and uploaded with the activity; the purpose limits and publication rules in 7.3 and 7.4 of this section also apply to it.

7.2 Read-only: we only read. We do not write to Apple Health or Health Connect, and do not change your health data.

7.3 Purpose: used only to import the workout records you choose as activities in Rideo, for statistics, creating works and video overlays. After import, heart rate and power are written into that activity's track file, automatically uploaded to the cloud with the activity (Section 3.3), and, when you create a 3D work, also sent to the rendering server as part of the track file (Section 9.2).

7.4 Our commitments:

We do not use health data for advertising, marketing or data mining, we do not sell it, and we do not provide it to any third party for these purposes.
Health data is used only to provide the features above to you.
We do not store health data in iCloud.
Imported data is stored and deleted in the same way as your other activity data (Section 10).
What becomes public: when you publish a work, the statistics attached to the work become public, and these include average power (if the activity has power data) but do not include heart rate. However, you choose what appears on screen in a data video: if you have the video show your heart rate and then publish that video to Explore, your heart rate becomes public as part of the video. The share link page shows duration, distance, average speed and climb, and does not show heart rate or power.

7.5 Withdrawal: you can revoke permission at any time in the Apple Health or Health Connect settings; after that we no longer read new data. Imported activities can be deleted in the app.

8. Public content

8.1 Works in Explore (public as soon as published): once you publish a work to Explore, anyone (including visitors who are not signed in) can see:

the work itself (poster / video / 3D work and cover) and its title;
the route: the line after 500 m has been cut from both the start and the end (up to 500 points), and the elevation profile;
a snapshot of statistics (distance, duration, climb, speed, and average power, if any);
all photos of this activity (reduced-size copies) and their capture times; photos you add to the activity after publishing will also appear;
the publication time and sport type;
your nickname, profile photo and user ID;
the work's location point on the map (the start of the trimmed route).

Signed-in users can also download a GPX file of this route (likewise with 500 m cut from both the start and the end), with a daily download limit per user.

8.2 No human pre-review: works go live as soon as they are published. Other users can report them, and we handle reports manually once received; you can also block an author so you no longer see their works.

8.3 Unpublishing: you can tap "Unpublish" on your published works in the app at any time. Once unpublished, the work immediately stops being shown and its public images and videos are deleted right away. The GPX file is no longer available for download but is kept in private storage and deleted when you delete your account. The work's record (title, statistics snapshot, route) stays in the database, no longer shown publicly, for handling reports related to it, and is deleted together with your account. Note: deleting an activity does not automatically unpublish works published from it; you need to unpublish them separately. If you remove a photo from the activity or delete the activity, the photo also disappears from the work. When you delete your account, all works you have published are deleted. We cannot retrieve works that others have downloaded or saved as screenshots.

8.4 Share links: you can turn on a "share link" for an activity. Anyone with the link (no sign-in needed) can see the activity's route (likewise with 500 m cut from both the start and the end), photos, date, title, duration, distance, average speed, climb, and your nickname and profile photo. You can tap "Stop sharing" at any time, after which the link stops working; the share link also stops working when you delete the activity.

8.5 Use your own judgment before publishing: trimming only hides the areas near the start and end. The middle part of the route, the content of photos and the title may still reveal where you are active or your daily patterns.

9. International transfers

9.1 Our servers are in Japan: the Service's servers, database and file storage are in the Google Cloud Tokyo region. Wherever you are, data you upload after signing in is transferred to and stored in Japan.

9.2 3D works are also created in Japan: when you create a 3D flyover video or a 3D terrain poster, the rendering job is processed by a rendering server we rent in the Google Cloud Tokyo region. It fetches the job input from the server (the activity's full track file, including heart rate, power and similar data if present; for a 3D terrain poster, also the reduced-size copies of the photos you chose), and when finished uploads the result back to storage. Data on the rendering server is handled as follows:

after a job succeeds, the job input files are deleted immediately;
when a job fails, the files of failed jobs are kept for troubleshooting; only the 10 most recent are kept, and older ones are deleted automatically;
to produce results faster next time, 3D scene data generated from the track (terrain, buildings, imagery and route) is cached. When the cache reaches its size limit, the oldest entries are cleared automatically; there is no fixed time limit. When you delete your account, these cache entries are not deleted immediately with it, but are cleared under this rule.

Ordinary posters and data videos are created on your phone and do not go through the rendering server.

9.3 Operations are in mainland China: our operations team is in mainland China and may remotely access data on the servers in Japan to maintain the Service. Operations staff access only the minimum data needed, and only when troubleshooting, keeping the Service secure or handling your requests; they will not look at your heart rate, power or other health data unless you explicitly agree in order to resolve an issue, or the law requires it.

9.4 Other transfers: sign-in, map, email and geographic data services (Section 5) may be located outside where you are.

9.5 Safeguards: For technical and organizational measures, see Section 12. For safeguards and legal procedures for international transfers that apply in your region, see Section 16.

How to refuse: you can choose not to sign in (your data stays only on your phone, but viewing maps still connects to the map services), or delete your account. If you refuse, features that need our servers, such as cloud backup, restoring on a new phone, publishing to Explore, share links and 3D works, will not be available.

10. Retention and deletion

10.1 General principle: we keep data only as long as needed for its purpose. See the overview table in Section 3 for the specific periods for each type of data; where that table notes an exception (currently, verification-code records for emails never used to create an account are kept indefinitely), the table applies.

10.2 Account deletion:

You can request account deletion under "Me" in the app (you will need to verify your identity again). After you request it, your account enters a 30-day waiting period, during which you can cancel the deletion by signing in and tapping "Cancel deletion".
During the waiting period, works you have published and share links you have turned on remain public, and the app cannot "Unpublish" or "Stop sharing" during this time. If you want them taken down right away, unpublish your works and stop sharing your links before you request deletion.
You can also request deletion by emailing support@tooo.live from the email linked to your account. After verifying your identity, we will submit the deletion request for you, with the same 30-day waiting period. If you signed in with Apple and chose Hide My Email, you may not be able to email us from the linked relay address; please request deletion in the app first (the app will ask you to verify again with Apple). If you cannot use the app, email us to explain and we will agree on another way to verify your identity.
After the waiting period ends, our background job deletes: from storage, the original track files, works you created, reduced-size photo copies, profile photo, published public works and GPX files; from the database, the account itself and all associated data, including activities, photo records, share links, verification-code records, sign-in identifiers and sign-in tokens, and report and block records.
Sign in with Apple authorization: If your account is linked to Sign in with Apple, we will revoke the authorization Rideo obtained from Apple when you request deletion. You can remove Sign in with Google authorization yourself in your Google Account settings.
Exceptions: data in backups is cleared when the backups expire, under Section 10.4; scene cache on the rendering server is cleared under Section 9.2; emails between you and us are kept under Section 3.1 and are not deleted automatically when you delete your account.

10.3 Deleting individual content:

Deleting an activity: its original track file, photos and share link are deleted; the rest of the activity's record (title, statistics, route data (including a more detailed route without the start and end cut off, used to detect duplicate activities), time zone, the name of the device it was imported from and the imported file fingerprint) is marked as deleted, is no longer shown to you or anyone else, and is fully cleared when you delete your account. 3D work files generated from it, and works published from it, are not deleted along with it (please unpublish published works separately; see Section 8.3).
3D work files: the app cannot yet delete a generated 3D work file on its own. If you want one deleted, email us and we will delete it for you; it is also deleted when you delete your account.
You can also remove activity photos, unpublish published works and stop sharing links in the app.
When you sign out, synced activities on your phone are cleared from the device; the cloud backup remains, and you can restore it by signing in again.

10.4 Backups: The database and file storage are both backed up automatically; backups are stored in the Google Cloud Tokyo region and kept for up to 30 days. Data in backups is cleared together with the backup when its retention period ends.

10.5 Legal requirements: information we are required by law to keep is kept for the legally required period.

10.6 How data is destroyed: we keep your personal information only in electronic form and keep no paper records. When the retention period ends, or when you ask us to delete it, we delete the relevant data from the database and file storage, after which it can no longer be restored through the Service; copies in backups are cleared when the backups expire, under Section 10.4.

11. Your rights

Depending on the laws where you live, you have the following rights.

Right	How to exercise it
Access: find out what information we hold about you	You can see most of your information directly in the app; for a complete copy, email support@tooo.live
Correction: fix inaccurate information	Change your nickname, profile photo, units, FTP and other profile details under "Me" in the app; activity information can be edited within the activity
Deletion	Delete individual activities, photos and other content in the app, or request account deletion (Section 10); 3D work files currently require an email request for deletion (Section 10.3); you can also request deletion of other content by email
Export / portability: take your data with you	The app does not yet have an "Export my data" option. Email us to request it, and we will send you your activity tracks (FIT files) and account details (in a common spreadsheet or JSON format)
Withdraw consent	Turn off location, photos, health data and other permissions in system settings; stop sharing or unpublish published works in the app; or delete your account. Withdrawal does not affect processing carried out before it
Restrict or object to processing	Email us with your reasons and we will assess them (especially for processing based on legitimate interests, such as report records, IP rate limiting and access logs)
Complain	You have the right to complain to the data protection authority where you live; see below

Response time: we will reply within 15 days of receiving your request (the time limit is shorter in some regions; see Section 16). To protect your account, we may first verify your identity (usually by asking you to email us from the email linked to your account; if you signed in with Apple and used Hide My Email, see Section 10.2). If there is a legitimate reason we need to extend the time or refuse, we will tell you the reason within the period above, along with how you can appeal.

Supervisory authorities: you can also complain to the personal information protection authority where you live; for authorities by region, see Section 16.

12. Security measures

Our measures include: the app and servers communicate only over HTTPS encryption; uploads and downloads of private files use temporary links that expire; public files are stored separately from private original track files, and GPX downloads require sign-in and a temporary link issued by the server; sign-in tokens are stored as hashes, and the whole set is revoked if misuse is detected; verification codes are stored as hashes; fields such as sign-in tokens are masked in logs; rendering input is deleted after a job succeeds.

No system is completely secure. If a security incident occurs that may affect your personal information, we will take remedial action immediately; report to the supervisory authorities as required by applicable law (some regions set a reporting deadline; see Section 16); and, without undue delay, tell you if you are affected, by email or other means: what happened, what information is involved, what we have done, how you can reduce the impact, and how to contact us.

13. Children

The Service is for users aged 16 and over and is not intended for anyone under 16; we do not offer any features designed specifically for people under 16. The app currently has no age-confirmation step, and we do not knowingly collect personal information from users under 16. If you are a parent or guardian and believe your child has given us personal information, please contact support@tooo.live, and after verification we will delete their account and data.

14. Changes to this policy

We may update this policy and will update the version and effective date at the top. For major changes (for example, collecting new categories of data, adding new data recipients, or changing where data is stored), we will notify you by email at least 7 days before they take effect and post a notice on our website; if we cannot reach you by email (for example, you signed in with Apple and did not provide an email), the notice on our website applies; in some regions the notice period for changes that are unfavorable to you is longer; see Section 16. Where the law requires your consent for a change, we will ask for your consent again. After each update, previous versions are archived on our website for you to consult.

15. Contact us

Email: support@tooo.live
Operator: Shenzhen Rantu Technology Co., Ltd (深圳燃途科技有限公司), registered address: Room 2801, Block B, Building 7, Hongxiang Garden, Luohu District, Shenzhen, Guangdong, China
Person responsible for personal information protection: Chen Dong, support@tooo.live, phone: +86 755 2215 4356, +86 138 2312 6510
Regional representatives, where applicable: see Section 16.

16. Region-specific supplements

16.1 EU / European Economic Area and UK

If you are in the EU, the European Economic Area or the UK, this subsection applies in addition to the sections above.

Supervisory authorities:

EU / European Economic Area: the data protection authority of your member state (list on the European Data Protection Board website, https://www.edpb.europa.eu ).
UK: the Information Commissioner's Office, ICO (https://ico.org.uk ).

Security incident reporting: we report to the supervisory authorities as required by applicable law (for example, within 72 hours of becoming aware of it in the situations specified by the EU and UK).

EU / UK representative: The EU representative under Article 27 of the GDPR and the UK representative under the UK GDPR will be named in this section, with contact details, once appointed. Until then, users and supervisory authorities in the EU and the UK can contact us directly at support@tooo.live.

Safeguards: Japan is recognized by the EU and the UK as providing adequate protection. As a data controller, we are directly subject to the GDPR / UK GDPR, and our operations in mainland China are our own processing activities, handled in line with this policy and the requirements of both laws. Our data processing terms with Google Cloud include the standard contractual clauses approved by the European Commission.

16.2 South Korea

If you are in South Korea, this subsection applies in addition to the sections above.

Response time: we will reply within 10 days of receiving your request.

Supervisory authorities: the Personal Information Protection Commission (https://www.pipc.go.kr ); the Personal Information Infringement Report Center (https://privacy.kisa.or.kr , phone 118); the Personal Information Dispute Mediation Committee (https://www.kopico.go.kr ).

Changes to this policy: we will notify you of changes that are unfavorable to you at least 30 days before they take effect.

Information on overseas transfers for users in South Korea (under Article 28-8 of Korea's Personal Information Protection Act (PIPA)):

Recipient (contact): Google Cloud (Google LLC; privacy notice and contact details: https://cloud.google.com/terms/cloud-privacy-notice )
Country: Japan
Items transferred: All cloud data listed in Section 3.1
When and how: When you use the Service after signing in, transmitted over an encrypted network
Purpose: Storing and running the Service, creating 3D works
Retention period: Same as Section 3.1

Recipient (contact): Our own operations team (support@tooo.live)
Country: Mainland China
Items transferred: Server data accessible during operations work
When and how: During operations access, transmitted over an encrypted network
Purpose: Maintaining the Service
Retention period: Same as Section 3.1

Recipient (contact): Verification-code email provider: Amazon SES (Amazon Web Services, Inc.; privacy notice and contact details: https://aws.amazon.com/privacy/ )
Country: Japan
Items transferred: Email address, content of the verification-code email; report notification emails (work title, work type, work ID, author ID, reason for the report, additional notes written by the reporter, preview image link)
When and how: When you request a verification code and when someone reports a work, transmitted over the network
Purpose: Sending verification-code emails and report notification emails
Retention period: As set by the provider's rules

Recipient (contact): Mapbox, Inc. (https://www.mapbox.com/legal/privacy)
Country: United States
Items transferred: Map area (that is, the area your track passes through), IP address, app identifier, usage statistics (which may include location information if you have granted location permission)
When and how: When you use the mini map in data videos, transmitted over an encrypted network
Purpose: Displaying maps
Retention period: As set out in Mapbox's privacy policy

Recipient (contact): OpenFreeMap (Hyperknot Software Kft., https://openfreemap.org/privacy/)
Country: Hungary (delivered via Cloudflare)
Items transferred: IP address, the map area you are viewing, request time, app identifier
When and how: When you view a map, transmitted over an encrypted network
Purpose: Displaying maps
Retention period: As set out in its privacy policy

Recipient (contact): Public geographic data services: the OpenStreetMap Overpass service, AWS open terrain datasets, EOX satellite imagery, etc.
Country: Varies by service
Items transferred: Coordinate bounds of the area your track covers (no information about your identity)
When and how: When you create a 3D work, requests are sent by our rendering server over the network
Purpose: Obtaining terrain, building and imagery data
Retention period: As set by each service's rules

To refuse these transfers, see "How to refuse" in Section 9.

16.3 Mainland China

If you are in mainland China, this subsection applies in addition to the sections above.

Supervisory authorities: the national cyberspace administration authorities.

Safeguards:

When you use the Service in mainland China, data you upload after signing in is transferred to and stored on servers in Japan (Section 9.1), and 3D works are also created in Japan (Section 9.2); verification-code emails are sent through an email sending service in Japan; when you view maps, some data also goes to map service providers outside China. All of this counts as providing personal information outside China; see the "Notice of outbound transfers for users in mainland China" table at the end of this section for each overseas recipient. The corresponding legal procedures: we enter into the standard contract for outbound transfer of personal information under the Measures on the Standard Contract for Outbound Transfer of Personal Information and file it with the provincial cyberspace administration; when you first open the App in mainland China, we will separately ask for your consent to the outbound transfer of your personal information.
Operations carried out in mainland China are handled in line with the requirements of China's Personal Information Protection Law (PIPL).

Notice of outbound transfers for users in mainland China (under Article 39 of China's Personal Information Protection Law):

Overseas recipient: Google Cloud (Google LLC), Tokyo region
Contact: https://cloud.google.com/terms/cloud-privacy-notice
Location: Japan
Purpose: Storing and running the Service, creating 3D works
How it processes the data: Hosts our servers, database and file storage for us, runs 3D work rendering, and processes data only on our instructions; our operations team in mainland China may access it remotely to maintain the Service (Section 9.3)
Types of personal information: All cloud data listed in Section 3.1: account and sign-in information, precise location and tracks, workout statistics, imported health data such as heart rate and power, reduced-size copies of activity photos, works you create, rendering input and scene data from creating 3D works, report and block records, access logs. Of these, precise location and tracks, heart rate and power are sensitive personal information
How to exercise your rights: Google Cloud processes data for us; please exercise your rights in Section 11 with us (support@tooo.live)

Overseas recipient: Amazon SES (Amazon Web Services, Inc.), Tokyo region
Contact: https://aws.amazon.com/privacy/
Location: Japan
Purpose: Sending verification-code emails and report notification emails
How it processes the data: Sends emails for us
Types of personal information: Email address, content of the verification-code email; the work title, work ID, author ID, reason for the report and additional notes written by the reporter in report notification emails
How to exercise your rights: This provider processes data for us; please exercise your rights in Section 11 with us

Overseas recipient: Mapbox, Inc.
Contact: https://www.mapbox.com/legal/privacy
Location: United States
Purpose: Displaying the mini map in data videos
How it processes the data: Provides maps; its component also automatically sends usage statistics under Mapbox's policy (Section 5)
Types of personal information: Map area (that is, the area your track passes through), IP address, app identifier, usage statistics; if you have granted location permission, the usage statistics may include location information (sensitive personal information)
How to exercise your rights: Contact Mapbox directly under its privacy policy, or contact us

Overseas recipient: OpenFreeMap (Hyperknot Software Kft.)
Contact: https://openfreemap.org/privacy/
Location: Hungary (delivered via Cloudflare)
Purpose: Displaying maps
How it processes the data: Provides map tiles and fonts
Types of personal information: IP address, the map area you are viewing, request time, app identifier
How to exercise your rights: Contact OpenFreeMap directly under its privacy policy, or contact us