Privacy Policy

Last updated: October 28, 2026

This privacy policy explains what personal data Experioo processes when you use the Experioo mobile app or visit experioo.com, why we process it, how long we keep it, and the choices and rights you have. We've tried to keep it readable. If something is unclear, please email us at info@a-t.design.

1. Who we are (the data controller)

The controller for the processing described in this policy is:

AT-Design GbR
Steinbahn 91
53721 Siegburg
Germany

Email (privacy questions and general contact): info@a-t.design

We are not currently required by GDPR to appoint a data protection officer (DPO); privacy questions are handled directly by the team and answered from the address above.

2. What personal data we process

When you use Experioo without an account

You can use Experioo without creating an account (local mode). The app then creates a device-bound profile with a random identifier and a device secret; no email address is collected. Your activities are still synced to and processed on our servers so that recording, classification, and display work. Resetting the local account in the app deletes it in the same way as an account deletion (see section 6).

When you create an account (optional)

• Email address (used to identify your account and to communicate with you)
• Authentication identifier issued by our authentication service provider
• Optional: display name and profile picture

When you record activities

• GPS tracks: time-stamped location points captured while the app detects movement
• Motion-sensor signals (accelerometer, gyroscope) used to detect that you are moving
• Derived metrics: distance, duration, average speed and pace, elevation gain
• Activity classification result (hike, ride, walk, run, city trip, flight, commute) and the model's confidence score

When you connect a third-party service (optional)

• An OAuth 2.0 access token and refresh token for the connected service, encrypted at rest with AES-256-GCM and stored on our servers; the activities and routes imported from your account with that service

When you use social features (optional)

• Connections (mutual links to other Experioo users)
• Audience groups you create
• Blocks
• Comments and reactions, if you make them

When Together-Mode is enabled (optional, opt-in)

When Together-Mode is on, summary information about where and when each activity took place is compared with that of your connections to find shared trips. Together-Mode is off by default and can be turned off again at any time.

When you receive push notifications (optional)

A push registration token tied to your installation of the app. This token is generated by Firebase Cloud Messaging and, on Apple devices, the Apple Push Notification service.

When you view maps

Some map layers (raster map tiles) are loaded by the app directly from Mapbox. In doing so, your device transmits your IP address and the requested map area to Mapbox.

Weather for your activities

To show the weather for an activity, our server sends the activity's coordinates and time range to the weather service Open-Meteo. No account details and no IP address of your device are transmitted.

When you buy Pro (optional)

In-app purchases are processed by Apple (App Store) or Google (Google Play). We receive confirmation of the purchase and your subscription status, but no payment details.

Device and diagnostic data

• App version, operating system, OS version
• Crash and error reports, including sampled performance traces, from the store versions of the app and from our production server (e.g. error message, technical stack trace, app version, device and OS information) — processed via Sentry, see section 4

Website

• Server-side access logs (IP address, user agent, requested URL, timestamp) — kept for up to 30 days for security and abuse prevention
• Cookieless, self-hosted visitor statistics without storing IP addresses — see section 11
• No advertising trackers, no third-party analytics, no cookies that are not strictly necessary

3. Why we process this data and on which legal basis

• Provide the Experioo service (record, sync, classify, and display your activities) — account, activity, and device data. Art. 6(1)(b) GDPR — performance of contract.
• Account creation and login — email, authentication identifier. Art. 6(1)(b) GDPR — performance of contract.
• Service security, abuse prevention, and diagnostics — device data, server logs, crash and error reports including sampled performance traces (Sentry). Art. 6(1)(f) GDPR — our legitimate interest in a stable, secure service. You can object to this (Art. 21 GDPR, see section 9).
• Map display — IP address and requested map area (Mapbox). Art. 6(1)(b) GDPR — performance of contract.
• Weather for activities — coordinates and time range of an activity (Open-Meteo). Art. 6(1)(b) GDPR — performance of contract.
• Pro purchases — purchase confirmation and subscription status. Art. 6(1)(b) GDPR — performance of contract.
• Push notifications — push registration token. Art. 6(1)(a) GDPR — your consent (you can withdraw at any time in your OS or in the app).
• Connected third-party services — OAuth tokens and imported data. Art. 6(1)(a) GDPR — your consent (revocable at any time).
• Social features and Together-Mode — connections, audience groups, summary information about each activity's place and time. Art. 6(1)(a) GDPR — consent; Art. 6(1)(b) GDPR for processing necessary to provide the connected experience to the other user.
• Activity classification (machine-learning model) — GPS and motion signals from your activity. Art. 6(1)(b) GDPR — performance of contract.
• Compliance with legal obligations — identifying records as required by law. Art. 6(1)(c) GDPR.

We do not run advertising, do not sell personal data, and do not process your activity data for advertising profiling.

Is providing your data required?

You are not legally or contractually obliged to provide your data. However, Experioo cannot record activities without access to your location; without it, the core functions of the app do not work. Creating an account is optional — you can use Experioo without one (see section 2). Optional features such as connected services, social features, Together-Mode, push notifications, and Pro only process the data listed above if you use them.

No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automatic recognition of the activity type (e.g. hike or ride) only labels your activity and is not such a decision.

Storage on and access to your device (app)

The app only stores information on your device or reads information from it where this is strictly necessary to provide a function you have explicitly requested (Section 25(2) No. 2 TDDDG). Access to location, motion and activity data, notifications and the camera additionally requires your permission in the operating system's dialog, which you can withdraw at any time in your device settings.

• Login: the device secret and the identifier of your profile (local mode) and your login tokens, kept in the device's secure storage (iOS Keychain, Android Keystore).
• App operation: your app settings, cached data and map data, and the offline areas you download.
• Automatic recording: location (also in the background) and the operating system's motion and activity recognition, to detect movement and record your activities.
• Push notifications: once you enable notifications, the push registration token (including the associated Firebase installation identifier).
• Camera: only if you take a profile picture.
• Crash reports: the store versions of the app read technical device information (e.g. device model, OS version) for error reports and may hold a report on the device until it is sent; legal basis as described above for Sentry.

The app uses no advertising identifiers and no advertising or tracking SDKs; Firebase is used only for push notifications, and its analytics collection is turned off.

4. Where the data is processed

Experioo's application servers and primary databases are operated by a hosting provider with data centers in Germany. Activity content lives in databases inside this infrastructure.

Some processing involves third-party service providers (processors) and other recipients:

• Auth0 (Okta, Inc., USA) — sign-in and account authentication. We use a tenant in the EU region; the service is operated by Okta, Inc. (see section 5). The provider sees your email address and the fact that you sign in.
• Firebase Cloud Messaging (Google Ireland Ltd., Ireland, and Google LLC, USA) and Apple Push Notification service (Apple) — deliver push notifications, if you enable them. These services see the push registration token associated with your installation, the notification payload (which contains only minimal context, e.g. “your activity has been finalised”), and connection metadata for delivery.
• Sentry (Functional Software, Inc., USA) — receives crash and error reports, including sampled performance traces, from the store versions of the app and from our production server. The data is stored in Sentry's EU region (Germany).
• Mapbox (Mapbox, Inc., USA) — delivers raster map tiles to the app. Mapbox receives your IP address and the requested map area.
• Open-Meteo (OpenMeteo GmbH, Switzerland) — weather data for your activities. Our server sends only the coordinates and time range of an activity.
• Connected fitness services (e.g. the provider of your sports watch) — only if you connect such an account. The connection is initiated by you. The provider sends activities to us via webhooks; we never send your Experioo data to it. You can revoke the connection at any time from inside the app.

For in-app purchases (Pro), Apple (App Store) and Google (Google Play) act as independent controllers; their own privacy policies apply to the purchase and payment processing.

We do not use third-party advertising or marketing-analytics services. We have no advertising partners.

5. International transfers

Some of the providers named in section 4 are located in the USA or belong to US companies: Okta, Inc. (Auth0), Functional Software, Inc. (Sentry), Mapbox, Inc., Google LLC (Firebase Cloud Messaging), and Apple Inc. (Apple Push Notification service). Transfers to these providers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the provider is certified under it, and/or on Standard Contractual Clauses (Art. 46(2)(c) GDPR). Where available, we use EU regions: our Auth0 tenant is in the EU region, and Sentry stores data in its EU region in Germany; access from the USA can nevertheless not be ruled out. Open-Meteo is based in Switzerland, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

6. How long we keep your data

• Account data (email, authentication ID, profile): while your account exists.
• Activity data (GPS tracks, derived metrics): while your account exists, or until you delete the activity individually.
• Server logs (web and API): up to 30 days.
• Crash and error reports (Sentry): up to 90 days.
• OAuth tokens (connected services): while the integration is active; revoked tokens are deleted within 7 days.
• Backups: rolled over on the next scheduled rotation, typically within 30 days of the source change.

When you delete your account, or reset your local profile if you use Experioo without an account, account and activity data are deleted or anonymized within 30 days, and backups containing the data are overwritten on the next scheduled rotation. Some records may be retained longer where required by law (for example, accounting documents).

7. Disclosures

We do not sell, rent, or license personal data. We disclose data only:

• to the processors and recipients listed in Section 4 — processors under data-processing agreements as required by Art. 28 GDPR;
• to other Experioo users only with your active choice — when you set an activity's visibility, accept a connection, or opt in to Together-Mode;
• where required by enforceable legal process (court order, data-protection authority request, etc.); we will, where lawful, inform you of such requests.

8. Security

Personal data is protected by technical and organizational measures including:

• TLS encryption in transit between the app and our servers
• Encryption at rest for sensitive credentials (e.g. AES-256-GCM for OAuth tokens of connected services)
• Access controls and audit logging on production systems
• Regular dependency and security updates
• Authentication via our authentication service provider; passwords are not stored on our servers
• Application-level isolation between user accounts so that one user's data is not accessible from another's session

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the competent supervisory authority as required by Art. 33–34 GDPR.

9. Your rights under GDPR

You have the following rights regarding your personal data, free of charge:

• Access (Art. 15) — receive a copy of the data we hold about you.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17) — delete your account and associated data.
• Restriction (Art. 18) — limit how we process your data in specific situations.
• Portability (Art. 20) — receive your data in a structured, machine-readable format. A copy is always available free of charge on request via info@a-t.design. GPX/FIT export from inside the app is additionally available as part of the optional Pro upgrade.
• Objection (Art. 21) — object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (e.g. crash and error reports via Sentry, website statistics).
• Withdraw consent (Art. 7(3)) — for any consent-based processing (push notifications, integrations, social features); withdrawal does not affect the lawfulness of past processing.
• Lodge a complaint (Art. 77) with a data-protection supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement. The competent authority for AT-Design GbR (Siegburg, North Rhine-Westphalia) is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

To exercise these rights, email info@a-t.design from the address associated with your account, or use the in-app controls (Settings → Privacy / Data). If you use Experioo without an account, no email address is linked to your profile; you can still contact us, and we will identify your profile with your help. Account deletion is also covered on the delete-account page.

We may need to verify your identity before responding to a request, particularly for access and erasure requests. We respond within one month, with a possible extension of two further months for complex requests (Art. 12(3) GDPR).

10. Children

Experioo is not directed to children under the age at which consent is required by local law (Art. 8 GDPR; 16 in Germany). We do not knowingly create accounts for, or process personal data of, children below the applicable age. If you become aware of such an account, please contact us so we can remove it.

11. Cookies and tracking on this website

The Experioo website (experioo.com) embeds no third-party advertising scripts and uses no cross-site tracking pixels. It opens in the language your browser prefers. It sets exactly one cookie, and only if you actively switch the language: "lang" holds just "en" or "de", keeps your choice for one year and is strictly necessary for that function (Section 25(2) No. 2 TDDDG). Nothing else is stored on your device.

To understand how the website is used, we run an open-source statistics tool on our own server in Germany (stats.experioo.com). No data is passed to third parties. Per page view, the tool records the page address, the referring website, browser, operating system, device type, screen size, language, the country/region/city derived from your IP address, and how you interact with the page: clicked links and buttons (e.g. app-store links, navigation, FAQ questions, language switch), which sections were viewed, and how far the page was scrolled. Your IP address itself is not stored, and visits are grouped by a pseudonymous identifier that is recalculated at least monthly — no profile across longer periods, no tracking across other websites. If your browser sends a "Do Not Track" signal, no statistics are collected. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a pseudonymous, privacy-friendly evaluation of our website. You can object at any time, e.g. by enabling "Do Not Track" or by writing to us.

Apart from this statistics service, all scripts, stylesheets, fonts, and images are served from the same origin as the page itself. No external CDN or font provider is contacted when you load this site.

12. Changes to this policy

We may update this policy as the product evolves or as legal requirements change. The "Last updated" date at the top reflects the current version. Material changes that affect your rights will be highlighted in-app or by email before they take effect.

13. Contact

For any privacy-related question, request, or complaint: info@a-t.design