Privacy Policy

1. Website and beta waitlist

When you join the waitlist we collect your email, your name (optional), your device type, which services hold your rides and your language. We use them only to invite you to the beta and tell you about it, on the basis of your consent (LGPD art. 7, I).

The form is processed by Formspree, Inc., in the United States, which stores submissions on our behalf with security safeguards; this is an international transfer under LGPD art. 33. We keep this data until the beta ends or you ask us to delete it, and we never sell it or use it for advertising.

2. In the app

Account: your sign-in identifier and email. Training and health data you choose to connect or record: workouts, routes and location during rides, heart rate, heart-rate variability, sleep, steps and calories, plus information you enter such as goals, bikes and components.

Health data is sensitive personal data (LGPD art. 5, II). We process it only with your specific consent (art. 11, I), which you give when you authorise each source and accept these terms in the app, and only to provide Derny's features to you.

Location is used while you record a ride, to draw the route and warn you about places you pinned. It is not tracked in the background outside a ride.

3. Where data is stored and who processes it

Your data is stored in your own account on Google Firebase (Google LLC), with access restricted to you. Text briefings are written by Apple Intelligence on your device, not on a server. Connected services (Apple, Strava, Garmin, Polar) send data to Derny only after you authorise them, under their own policies.

We do not sell personal data, show ads, or share data with third parties for marketing.

4. Security and retention

Data is transmitted over encrypted connections and protected by access rules tied to your account. Connection tokens are kept in your device's Keychain. We keep your data while your account is active, and delete it when you ask, except where the law requires otherwise.

5. Your rights

Under LGPD art. 18 you can ask for confirmation and access, correction, anonymisation, portability or deletion of your data, information about sharing, and withdraw consent at any time. You can disconnect any source in the app, and you can complain to the Brazilian Data Protection Authority (ANPD).

To exercise your rights, contact us through the form on this site.

6. Children

Derny is not directed at children under 18 and does not knowingly collect their data without a guardian's consent.

7. Changes

We will update this policy when our practices change and show significant changes in the app.