Privacy Policy

Last updated: 18 October 2026

This Privacy Policy explains how Trainoro processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data-protection law.

It covers the Android and iOS versions of Trainoro. Where the versions differ, this policy says so.

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

Hassan Haroon, Ossweiler Weg 36, 71334 Waiblingen, Germany

E-mail: info@trainoro.com

Trainoro is operated by this individual. There is no separate company behind the app.

For app-account data, Trainoro uses Google services, including Firebase, as service providers/processors where applicable. The applicable contractual data-processing arrangements and Google's current privacy documentation govern Google's processing.

2. What Trainoro keeps on your device

Trainoro is designed to keep as much data as possible on your device.

The following data is stored in the app's private storage and, according to the current app architecture, is not uploaded to Trainoro's servers:

• your profile: the name you enter, your training profile (age, height, playing hand and skill level) and your profile picture, if you add one;
• recorded training videos and captured frames;
• on-device video-analysis results, including pose and biomechanics measurements;
• drill and fitness sessions;
• racket configurations;
• Game Zone scores and progress;
• Scorecard matches and point-by-point scores;
• My Matches entries, including results, self-assessments and opponent names/notes entered by you;
• language and consent settings; and
• AI chat history stored locally.

The legal basis for processing data that is necessary to provide requested app functions is generally Article 6(1)(b) GDPR.

3. Camera, microphone and photo/video library

The camera and microphone are used to record training videos and capture individual frames.

Access to your photo/video library is used only when you actively select a file, for example:

• a video for analysis; or
• a profile picture.

Trainoro does not intentionally scan your photo or video library in the background.

Video analysis, including pose estimation, ball tracking, table detection and biomechanical measurement, runs on the device according to the current Android implementation. No training footage is sent to Trainoro's servers by those analysis functions.

On iOS, the availability of video-analysis features may differ from Android.

Device permissions are controlled by the operating system. Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR, and permission can be withdrawn through the relevant device settings. Withdrawal does not affect processing already carried out lawfully before withdrawal.

If other identifiable people appear or can be heard in a recording, you are responsible for obtaining any permissions required by applicable law.

4. App account

Trainoro has no login. You do not create an account, and Trainoro does not ask for your name, e-mail address or a password.

When you first open the app, it automatically creates an app account for this installation, using the anonymous sign-in of Firebase Authentication. This app account stores:

• a random technical account ID;
• a random internal identifier that is never shown;
• technical timestamps, such as when the account was created and last used; and
• your purchase and access status (see section 11).

Your name, training profile and profile picture are not part of the app account; they stay on your device (see below and section 2).

The app account belongs to this installation of the app. Trainoro does not know which person it belongs to. If you uninstall the app without deleting the account first, the account can no longer be reached from any device; it is then deleted automatically after 24 months without use (see section 12).

The legal basis is Article 6(1)(b) GDPR: the app account is needed to provide the app's functions, in particular paid access.

Training profile

Your training profile may contain:

• age;
• height;
• playing hand; and
• skill level.

It is stored only on your device, together with the name you enter in the app and any profile picture you add, so that the app can tailor analyses and AI prompts to you. It is not uploaded to Trainoro's servers. Earlier versions of the app also stored the training profile, a placeholder name and the profile picture with the app account; those copies were deleted from Trainoro's servers on 18 October 2026.

Reporting AI replies

You can report a reply of the optional AI features with the flag next to it. A report stores your technical account ID, the reason you chose, any note you add and a copy of up to 500 characters of the AI reply, so that the report can be assessed. Reports can be read only by the Trainoro operator. A report is deleted six months after it has been dealt with. If your app account is deleted earlier, your account ID, your note and the copied reply are removed from the report. The legal basis is Article 6(1)(c) and (f) GDPR: handling reports of unlawful or harmful content and protecting users.

5. Push notifications

Trainoro does not send push notifications and does not store push tokens.

While a video analysis keeps running in the background, Android shows a progress notification. It is created on your device and involves no server.

6. Optional AI features

The following AI features are optional:

• AI Coach;
• AI follow-up chat;
• AI Fitness Coach;
• Stroke Analysis coach;
• My Matches coach;
• Training Plans coach (review of your own plan);
• Racket Advisor AI Racket Review; and
• AI Shop Finder.

They are disabled unless you choose to use them.

You choose between OpenAI and Anthropic in the app and use your own account/API key with the provider you select.

You enable them by saving your own API key. Before you save it, the app tells you what will be sent and that the provider is based in the USA; saving the key is your explicit consent to that (Article 6(1)(a) GDPR). You withdraw the consent by removing the key.

What is sent

Depending on the feature you use, the app may send directly from your device to the selected provider:

• your questions and notes;
• selected training-profile information such as age, height and skill level;
• statistics and measurements derived from your on-device analysis;
• for My Matches, match scores and self-assessment information;
• for the Training Plans coach, your training days, targets, plan and comments, and numbers from your training log (how often you did a drill and your ratings, benchmark results, serve accuracy) — not your private session notes;
• an anonymised description of an opponent based on the fixed characteristics you select, rather than the opponent's name;
• for the AI Shop Finder, the location and budget you enter.

The app does not send training videos or analysis images to the AI provider as part of these features. The AI features send text and numerical information according to the feature you use.

The app displays information about the data to be sent and, where applicable, an estimated provider cost before the request is submitted.

Your API key

Your API key is stored locally in encrypted platform storage, such as Android Keystore-backed storage or the iOS Keychain, according to the platform implementation.

The API key is used only to authenticate requests to the AI provider to which it belongs. It is not transmitted to Trainoro.

You can remove the key at any time. Once removed, Trainoro's AI features will no longer send requests using that key.

Trainoro's role in direct AI requests

Under the current architecture described above, the AI request is sent directly from your device to the AI provider using your own API key. Trainoro does not receive the request content or your API key.

The selected AI provider therefore processes the information under the account, API arrangement and terms applicable to your relationship with that provider. You should review the provider's current privacy and API terms before using the feature.

Trainoro does not control the provider's independent processing, retention periods or international transfers.

7. International processing by AI providers

The AI providers may process data outside the EU/EEA.

Because the AI request is sent directly from your device to the provider under your own provider account/API key, Trainoro does not receive that AI request and does not itself carry out the provider's subsequent international transfer.

The provider's own transfer mechanisms, contractual terms and privacy documentation apply to that processing. For example, OpenAI's current API documentation describes international processing and transfer safeguards, while Anthropic's current API documentation describes processing and retention for its API services.

Before using an AI feature, you should review the current terms and privacy information of the provider you select.

If Trainoro itself later changes the architecture so that AI requests are routed through Trainoro servers, this Privacy Policy will be updated before that change is introduced where required by law.

8. Account storage and Firebase

Your app account (section 4) is stored using Google Firebase services configured by Trainoro.

The current configuration uses EU data locations for the Firestore database.

Google may nevertheless process certain technical data through infrastructure or services located outside the EU/EEA, including services used for security, app integrity or logging.

Trainoro uses the applicable Google contractual data-protection documentation and safeguards for such processing.

9. App integrity and abuse prevention

Before certain requests are accepted by Trainoro's server, the app may be required to prove that it is a genuine, unmodified installation.

The current implementation uses Firebase App Check together with platform integrity services, including Google Play Integrity on Android and Apple's App Attest on iOS where applicable.

This process can involve technical information about the app and device and an assessment of device/app integrity.

It is used to protect Trainoro's servers and users against abuse, tampering and unauthorised access.

The legal basis is Article 6(1)(f) GDPR where applicable: Trainoro has a legitimate interest in maintaining the security and integrity of its service.

10. Administrative access

The Trainoro operator may have limited administrative access to app-account information needed to operate and support the service.

Depending on the support or legal issue, this can include:

• the technical account ID;
• purchase and access status;
• the date the account was created; and
• the date it was last used.

Administrative access may be used to:

• answer support requests;
• fulfil data-protection requests;
• investigate abuse;
• grant or revoke access, disable or delete accounts; and
• comply with legal obligations.

Administrative access is restricted to authorised administrator accounts.

Administrative actions may be recorded in security logs.

The legal basis may be Article 6(1)(b), 6(1)(c) or 6(1)(f) GDPR, depending on the purpose of the particular action.

11. Purchase and payment

Trainoro's optional paid plans — a monthly or yearly subscription, and the lifetime unlock, a one-time purchase — are bought through Google Play.

Trainoro does not receive your payment-card or bank-account details.

To provide access to paid features, Trainoro may receive technical confirmation from Google that the purchase or subscription exists and may store a one-way cryptographic digest or other technical identifier associated with it, together with information such as the purchase date, the purchase status and, for a subscription, the plan (monthly or yearly), its status and until when it is paid.

This information is used to determine whether your app account has access to the paid features and to update that access when Google reports that a payment has been completed, that a subscription has been renewed, cancelled, put on hold or paused, or that a payment has been refunded.

The legal basis for Trainoro's processing of purchase-access information is Article 6(1)(b) GDPR where necessary to provide the purchased functionality.

To provide any access granted by voucher, Trainoro stores with your account until when granted access runs. The free preview is not counted. If an earlier version of the app counted free analyses for your account, that number may still be stored with it; it is no longer used. When you redeem a voucher code, Trainoro records that your account redeemed that code and when, so that a code cannot be used twice by the same account, and briefly counts redemption attempts to prevent guessing. Granted days belong to the app account of this installation and are lost if the app is uninstalled without them being used up. These records are deleted when the app account is deleted. The legal basis is Article 6(1)(b) GDPR and, for the protection against guessing, Article 6(1)(f) GDPR.

Google processes payment and transaction information under Google's own terms and privacy documentation.

If you reinstall the app or use a new device, you can restore the purchase or subscription with the same Google account. It then moves to the app account of the new installation and is removed from the previous one; Trainoro updates the link between the purchase and the app account for this purpose.

When an app account is deleted, Trainoro asks Google Play to cancel the automatic renewal of a running subscription, and the records linking purchases to the account are deleted. Nothing is refunded; purchases and subscriptions remain associated with your Google account at Google Play.

12. Storage periods and deletion

Local data

Data stored only on your device remains there until you delete it or uninstall the app, subject to the normal operation of the operating system and device.

Trainoro cannot apply a server-side deletion period to data that it never receives.

App account

Your app account is kept until you delete it with “Delete account” in the app. An app account that has not been used for 24 months — for example because the app was uninstalled without deleting the account — is deleted automatically, in the same way. A longer retention applies only where required or permitted by law.

When an app account is deleted:

• the account record is deleted;
• the link between your purchase and the account is deleted;
• voucher redemption records are deleted;
• your account ID, notes and copied replies are removed from reports you filed; and
• when you use “Delete account”, local data — including your profile — is also removed from the device as described in the app.

Security or administrative logs may be retained for a limited period where necessary for security, abuse prevention or legal purposes; administrative actions are recorded in Google Cloud's logging service and are deleted automatically when the retention period set there ends; Google's standard period is 30 days.

Anonymous aggregate usage statistics may be retained after account deletion if they genuinely no longer constitute personal data.

Data already sent directly to an AI provider is subject to that provider's retention rules and must be addressed with that provider where the provider is independently responsible for the processing.

13. Your GDPR rights

Subject to the statutory requirements and limitations, you have rights including:

• access under Article 15 GDPR;
• rectification under Article 16;
• erasure under Article 17;
• restriction of processing under Article 18;
• data portability under Article 20; and
• objection under Article 21 where applicable.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Many rights can be exercised directly in the app: your training profile can be viewed and corrected under Profile, and “Delete account” erases your app account.

You can also contact info@trainoro.com. Because your app account is not linked to your name or e-mail address, Trainoro can usually not tell from a message alone which account is yours (Article 11 GDPR); it is therefore easiest to use the functions in the app.

You also have the right to lodge a complaint with a competent data-protection supervisory authority under Article 77 GDPR.

14. Automated decision-making

Trainoro does not use automated decision-making that produces legal effects or similarly significant effects on users within the meaning of Article 22 GDPR.

AI suggestions and training analyses are informational and are not binding decisions about you.

They are not intended as medical diagnosis or treatment.

15. Children

Trainoro is not designed as a service specifically directed at children.

Where processing is based on consent and Article 8 GDPR applies, the applicable rules concerning children's consent and parental responsibility must be observed; in Germany, users under 16 need the consent of a person with parental responsibility.

Trainoro does not knowingly use children's personal data for purposes for which valid consent has not been obtained where such consent is legally required.

16. Deleting your data and account

You can delete local content such as videos, analyses, sessions, scorecards and match-log entries through the app.

The app also provides a “Delete all data” function for local data.

Deleting local data does not delete your app account on the server.

To delete the app account and the associated server-side data, use “Delete account” in the app. Afterwards the app starts again with a new, empty app account.

If you uninstall the app without deleting the account first, the app account is deleted automatically after 24 months without use (section 12).

Deleting your account does not refund the lifetime unlock. The purchase remains associated with your Google account at Google Play.

17. Optional anonymous usage statistics

Anonymous usage statistics are disabled unless you actively enable them.

If enabled, the app may count how often certain features are opened or completed, such as a test being started or a drill session being completed.

The intended statistics are aggregate counts rather than individual activity records. Trainoro does not intentionally attach a user ID, account ID, name, video name or free-text content to these statistics.

Where the resulting data is genuinely anonymous and Trainoro has no reasonable means of linking it back to an individual, it is no longer personal data within the meaning of Article 4(1) GDPR.

If the statistics feature uses information stored on the device or accesses storage that requires consent under applicable law, the relevant consent is requested before the feature is enabled.

You can switch the optional statistics off at any time in the app.

18. Security

Trainoro uses technical and organisational measures appropriate to the risks of the processing, including access controls, platform security mechanisms, encrypted credential storage where applicable, server-side access rules and restricted administrative access.

No internet-based service can guarantee absolute security.

19. Changes to this Privacy Policy

Trainoro may update this Privacy Policy when the app, its processing activities or applicable legal requirements change.

The current version is made available in the app and on the Trainoro website.

If a change materially affects processing that requires renewed consent, Trainoro will request that consent where required by law.

20. Contact

For privacy questions or to exercise your rights: info@trainoro.com

Controller: Hassan Haroon, Ossweiler Weg 36, 71334 Waiblingen, Germany