Privacy

1. Controller

Christopher Haase, handelnd unter orgendo
Albgaustraße 1D
76337 Waldbronn
Germany
Email: support@rydereal.com

2. Core principle of the app

Raw videos, previews, project files and finished reels are processed locally on the iPhone in the mobile workflow. They are not uploaded to the RydeReal connector or analytics backend.

3. Visiting this website

The website is published through OpenAI Sites and delivered using Cloudflare infrastructure. IONOS SE manages the domain, DNS and email. Technically necessary access data may be processed to deliver the site securely and reliably, including the requested page or file, browser and device type, operating system, time, referrer and IP address. The legal basis is Article 6(1)(f) GDPR.

We do not use our own cookies, web analytics, advertising trackers, embedded social-media pixels or external fonts. Automatic language selection only evaluates the country code supplied by the delivery infrastructure; it does not create a user profile or store location data in the browser.

4. Contact by email

When you email us, we process the sender address, content, time and technical message headers to handle your request. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters and otherwise Article 6(1)(f) GDPR. Messages are deleted when no longer needed unless statutory retention obligations apply.

5. Photos and Apple Health

RydeReal accesses Photos and Apple Health only after iOS permission is granted. Data is used to match footage to an activity and create a video requested by the user. Processing is based on Article 6(1)(b) GDPR and, where health data is involved, explicit consent under Article 9(2)(a) GDPR. Permissions can be changed in iOS at any time.

6. Optional Strava connection

If you voluntarily connect Strava, RydeReal processes a technical user ID, displayed athlete name, permissions, encrypted OAuth tokens and the activity and telemetry data you request. This is used solely for requested app functions under Article 6(1)(b) GDPR and, where health data is involved, explicit consent under Article 9(2)(a) GDPR. Strava data is not used for optional product analytics. You can disconnect at any time.

7. Apple subscriptions

Purchases are handled by Apple; RydeReal does not receive payment details. For entitlement, restoration and status checks, the backend processes only pseudonymous technical account and app-account tokens, product and transaction identifiers, term, grace period, renewal, revocation or refund status and Apple notification type. Apple-signed data is checked for authenticity but not stored as a complete receipt. The legal bases are Article 6(1)(b), and where required Article 6(1)(c) and (f), GDPR.

8. Optional pseudonymous product analytics

Only after explicit consent does RydeReal transmit a small number of usage events, such as starting, completing or failing a set of variations, selecting a variation, saving a video or opening the prepared social workflow. App version, build, creation style and a random ride-session ID may also be included.

Raw or finished videos, photos, file or activity names, GPS, telemetry, Health or Strava data, hooks, captions, hashtags and free text are not transmitted. Processing is based on consent under Article 6(1)(a) GDPR. Consent is optional, not required for the app and can be withdrawn at any time. Pseudonymous beta events are kept for no more than twelve months and then deleted or fully aggregated.

9. Optional in-app feedback

When you deliberately submit feedback, we process the topic, optional sentiment, entered text, app version, build and iOS version. An email address is transmitted only if you request a reply. Videos, photos, ride, location, Health, Strava or telemetry data are not included. Processing is based on Article 6(1)(b) GDPR for handling your request or Article 6(1)(f) GDPR for general product improvement. Feedback is retained for no more than 24 months; an optional contact address only as long as needed.

10. Recipients

Where necessary, data may be processed by:

• OpenAI and Cloudflare for website publishing and technical delivery,
• IONOS SE for domain, DNS and email services,
• Supabase for the app backend, authentication, subscription status, optional feedback and, only with consent, product analytics,
• Apple for App Store purchases, TestFlight and server notifications,
• Strava only when voluntarily connected.

The primary Supabase database is operated in Central EU (Frankfurt), AWS region eu-central-1. This does not always exclude technically necessary processing outside the EU by service providers or subprocessors. Providers are contractually bound under data-protection law, and applicable safeguards are used for necessary third-country transfers.

11. Deletion and your rights

Subject to applicable law, you may request access, rectification, deletion, restriction, portability and object to processing, and withdraw consent for the future. Local projects remain stored until you delete them. In the app, you can delete local projects or all local and attributable RydeReal data and connections. Videos already saved to Photos and Apple Health permissions remain managed through iOS.

To exercise your rights, email support@rydereal.com. You also have the right to complain to a data-protection supervisory authority.

12. Updates

This policy will be updated when functions, providers or legal requirements change. The version published on this page applies.