Privacy Policy

Last updated: October 11, 2026

This privacy policy explains what personal data Experioo processes when you use the Experioo mobile app or visit experioo.com, why we process it, how long we keep it, and the choices and rights you have. We've tried to keep it readable. If something is unclear, please email us at info@a-t.design.

1. Who we are (the data controller)

The controller for the processing described in this policy is:

AT-Design GbR
Steinbahn 91
53721 Siegburg
Germany

Email (privacy questions and general contact): info@a-t.design

We are not currently required by GDPR to appoint a data protection officer (DPO); privacy questions are handled directly by the team and answered from the address above.

2. What personal data we process

When you create an account

• Email address (used to identify your account and to communicate with you)
• Authentication identifier issued by our authentication service provider
• Optional: display name and profile picture

When you record activities

• GPS tracks: time-stamped location points captured while the app detects movement
• Motion-sensor signals (accelerometer, gyroscope) used to detect that you are moving
• Derived metrics: distance, duration, average pace, elevation gain
• Activity classification result (hike, ride, walk, run, city trip, flight, commute) and the model's confidence score

When you connect a third-party service (optional)

• An OAuth 2.0 access token and refresh token for the connected service, encrypted at rest with AES-256-GCM and stored on our servers; the activities, routes, and heart-rate data imported from your account with that service

When you use social features (optional)

• Connections (mutual links to other Experioo users)
• Audience groups you create
• Blocks
• Comments and reactions, if you make them

When Together-Mode is enabled (optional, opt-in)

When Together-Mode is on, summary information about where and when each activity took place is compared with that of your connections to find shared trips. Together-Mode is off by default and can be turned off again at any time.

When you receive push notifications (optional)

A push registration token tied to your installation of the app. This token is generated by the push-notification delivery service.

Device and diagnostic data

• App version, operating system, OS version
• Crash reports — only if you opt in

Website

• Server-side access logs (IP address, user agent, requested URL, timestamp) — kept for up to 30 days for security and abuse prevention
• Cookieless, self-hosted visitor statistics without storing IP addresses — see section 11
• No advertising trackers, no third-party analytics, no cookies that are not strictly necessary

3. Why we process this data and on which legal basis

• Provide the Experioo service (record, sync, classify, and display your activities) — account, activity, and device data. Art. 6(1)(b) GDPR — performance of contract.
• Account creation and login — email, authentication identifier. Art. 6(1)(b) GDPR — performance of contract.
• Service security, abuse prevention, and diagnostics — device data, server logs, and crash reports if opted in. Art. 6(1)(f) GDPR — legitimate interests.
• Push notifications — push registration token. Art. 6(1)(a) GDPR — your consent (you can withdraw at any time in your OS or in the app).
• Connected third-party services — OAuth tokens and imported data. Art. 6(1)(a) GDPR — your consent (revocable at any time).
• Social features and Together-Mode — connections, audience groups, summary information about each activity's place and time. Art. 6(1)(a) GDPR — consent; Art. 6(1)(b) GDPR for processing necessary to provide the connected experience to the other user.
• Activity classification (machine-learning model) — GPS and motion signals from your activity. Art. 6(1)(b) GDPR — performance of contract.
• AI-generated activity summaries — the activity for which the summary is generated. Art. 6(1)(a) GDPR — your consent.
• Compliance with legal obligations — identifying records as required by law. Art. 6(1)(c) GDPR.

We do not run advertising, do not sell personal data, and do not process your activity data for advertising profiling.

4. Where the data is processed

Experioo's application servers and primary databases are operated in Germany. Activity content lives in databases inside this infrastructure.

Some processing involves third-party processors:

• Authentication service provider — sign-in and account authentication. The tenant we use is hosted in the EU. The provider sees your email address and the fact that you sign in.
• Push-notification delivery service — delivers push notifications, if you enable them. The service sees the push registration token associated with your installation, the notification payload (which contains only minimal context, e.g. "your activity has been finalised"), and connection metadata for delivery. It is provided by the EU subsidiary of a US-based company; the US parent company may also be involved in processing (see section 5).
• Connected fitness services (e.g. the provider of your sports watch) — only if you connect such an account. The connection is initiated by you. The provider sends activities to us via webhooks; we never send your Experioo data to it. You can revoke the connection at any time from inside the app.

We do not use third-party advertising or marketing-analytics services. We have no advertising partners.

5. International transfers

Where a processor or its parent company is located outside the EU/EEA, we use the safeguards permitted by GDPR (typically Standard Contractual Clauses) and rely on European subsidiaries where possible — for example, push notifications are delivered through the provider's EU subsidiary. The EU-hosted tenant of our authentication service provider ensures that authentication is processed in the EU.

6. How long we keep your data

• Account data (email, authentication ID, profile): while your account exists.
• Activity data (GPS tracks, derived metrics): while your account exists, or until you delete the activity individually.
• Server logs (web and API): up to 30 days.
• Crash reports (if opted in): up to 90 days.
• OAuth tokens (connected services): while the integration is active; revoked tokens are deleted within 7 days.
• Backups: rolled over on the next scheduled rotation, typically within 30 days of the source change.

When you delete your account, account and activity data are deleted or anonymised within 30 days, and backups containing the data are overwritten on the next scheduled rotation. Some records may be retained longer where required by law (for example, accounting documents).

7. Disclosures

We do not sell, rent, or license personal data. We disclose data only:

• to the processors listed in Section 4, under data-processing agreements as required by Art. 28 GDPR;
• to other Experioo users only with your active choice — when you set an activity's visibility, accept a connection, or opt in to Together-Mode;
• where required by enforceable legal process (court order, data-protection authority request, etc.); we will, where lawful, inform you of such requests.

8. Security

Personal data is protected by technical and organisational measures including:

• TLS encryption in transit between the app and our servers
• Encryption at rest for sensitive credentials (e.g. AES-256-GCM for OAuth tokens of connected services)
• Access controls and audit logging on production systems
• Regular dependency and security updates
• Authentication via our authentication service provider; passwords are not stored on our servers
• Application-level isolation between user accounts so that one user's data is not accessible from another's session

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the competent supervisory authority as required by Art. 33–34 GDPR.

9. Your rights under GDPR

You have the following rights regarding your personal data, free of charge:

• Access (Art. 15) — receive a copy of the data we hold about you.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17) — delete your account and associated data.
• Restriction (Art. 18) — limit how we process your data in specific situations.
• Portability (Art. 20) — receive your data in a structured, machine-readable format. A copy is always available free of charge on request via info@a-t.design. GPX/FIT export from inside the app is additionally available as part of the optional Pro upgrade.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — for any consent-based processing (push notifications, AI summaries, integrations); withdrawal does not affect the lawfulness of past processing.
• Lodge a complaint with a data-protection supervisory authority. The competent authority for AT-Design GbR is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), but you may also complain to the authority of your habitual residence.

To exercise these rights, email info@a-t.design from the address associated with your account, or use the in-app controls (Settings → Privacy / Data). Account deletion is also covered on the delete-account page.

We may need to verify your identity before responding to a request, particularly for access and erasure requests. We respond within one month, with a possible extension of two further months for complex requests (Art. 12(3) GDPR).

10. Children

Experioo is not directed to children under the age at which consent is required by local law (Art. 8 GDPR; 16 in Germany). We do not knowingly create accounts for, or process personal data of, children below the applicable age. If you become aware of such an account, please contact us so we can remove it.

11. Cookies and tracking on this website

The Experioo website (experioo.com) sets no cookies, embeds no third-party advertising scripts, and uses no cross-site tracking pixels. Only if you actively switch the language does your browser remember that choice in its local storage; this value stays on your device and is not sent to us.

To understand how the website is used, we run an open-source statistics tool on our own server in Germany (stats.experioo.com). No data is passed to third parties. Per page view, the tool records the page address, the referring website, browser, operating system, device type, screen size, language, the country/region/city derived from your IP address, and how you interact with the page: clicked links and buttons (e.g. app-store links, navigation, FAQ questions, language switch), which sections were viewed, and how far the page was scrolled. Your IP address itself is not stored, and visits are grouped by a pseudonymous identifier that is recalculated at least monthly — no profile across longer periods, no tracking across other websites. If your browser sends a "Do Not Track" signal, no statistics are collected. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in an anonymous, privacy-friendly evaluation of our website. You can object at any time, e.g. by enabling "Do Not Track" or by writing to us.

Apart from this statistics service, all scripts, stylesheets, fonts, and images are served from the same origin as the page itself. No external CDN or font provider is contacted when you load this site.

12. Changes to this policy

We may update this policy as the product evolves or as legal requirements change. The "Last updated" date at the top reflects the current version. Material changes that affect your rights will be highlighted in-app or by email before they take effect.

13. Contact

For any privacy-related question, request, or complaint: info@a-t.design