1. Who is responsible
Roven Digital Oy (business ID 3587482-4), Vehmaistenkatu 9, 38200 Sastamala, Finland, makes Dualform and is the controller of your personal data. Write to roope@dualform.app about anything in this policy.
2. What we collect
Your account
You sign in with your Google account. From it we receive and store its identifier, your email address and your first name. We never see your Google password.
Training you log
Your strength and endurance sessions, such as the exercises, sets, repetitions, weights, distances, durations, effort ratings, heart rate if you enter it, dates and times, and the notes you write.
Activities from Garmin, only if you connect Garmin
The activities that your Garmin device records. Section 4 lists what we receive and how we use it.
Settings and sync data
Your choices in the app, such as units, and the technical identifiers that keep your data in sync between the app and our servers.
Usage events
Records of what happens in the app, such as “session started”, “set added” or “Garmin connected”, with the app version. They are linked to a pseudonymous ID that only we can connect to your account, not to your name, email or Google account. They never contain your weights, repetitions, heart rate or other health data.
Crash reports
When the app or our server runs into an error, we receive a report with technical details, such as the error, the app version, the device model and the operating system version, and a pseudonymous ID. We remove email addresses, names, IP addresses and the contents of requests from every report. We do not record your screen.
The app also tells our crash reporting service when it starts and stops, with the app version and a pseudonymous ID, so that we can count how many app sessions end without a crash.
Messages you send us
If you email us or send feedback from the app, we keep your message, your email address if you used one, and technical details such as the app version.
3. How we use it, and why
To run Dualform for you
We create your account, store and sync your sessions, show your history and statistics, deliver app updates, and bring in your Garmin activities if you connect Garmin. Legal basis: our agreement with you (GDPR Article 6(1)(b)).
Health data, with your explicit consent
Training data, such as heart rate and the activities from your Garmin device, can reveal information about your health. The GDPR treats it as a special category of data. We process it only with your explicit consent (Article 9(2)(a)), which the app asks for before it stores any health data. Without it we cannot create your account, because Dualform cannot work without your training data.
You can withdraw your consent at any time in the app’s settings. Withdrawing deletes your account and your data, and the app tells you this before you confirm. It does not affect what we did before you withdrew. To stop the use of your Garmin data without deleting your account, disconnect Garmin and delete the sessions imported from it (section 4).
To keep Dualform reliable and make it better
We use crash reports to find and fix faults. We use usage events to see whether people find their way in the app, for example whether logging works as intended, and to make the app clearer and easier to use. Legal basis: our legitimate interest in a working, secure app that is easy to use (Article 6(1)(f)).
The app has no setting that turns crash reports off. You can object to this use of crash reports or usage events by email (section 10).
To answer you and to follow the law
We use your messages to answer you, and we keep a record of the requests you make about your data. Legal basis: our legal obligations and our legitimate interest in helping you (Article 6(1)(c) and (f)).
We do not sell your personal data, and we do not use it for advertising. We do not let software alone make decisions about you that have a legal or similarly significant effect on you.
4. Garmin
Connecting your Garmin Connect™ account is optional. You start it in the app and approve it on Garmin’s own page. We never see your Garmin password: Garmin gives us an authorization token instead.
What we receive
After you connect, Garmin sends us the activities that your Garmin device records and syncs to Garmin Connect. From each activity we store data such as:
- the activity type and name, its start time and duration
- distance, elevation gain, and average and maximum heart rate
- for strength activities, the exercises, sets, repetitions and weights that your device recorded
- the model of the Garmin device
- Garmin’s identifiers for your account and the activity
We keep the values we use, not the original activity files, and we do not store GPS routes. Dualform reads only activities. It does not read other Garmin data, such as sleep or daily steps, and it does not send anything to your Garmin account. If this changes, we will update this policy first.
How we use it
We use Garmin data to give you Dualform: to show your activities as sessions in your history and statistics, and to fill in the strength sessions that you log on your phone. A session from Garmin shows the Garmin device that recorded it. We also record usage events such as a new Garmin connection or an imported activity, without the activity’s contents, to see whether the connection works.
We do not sell Garmin data or use it for advertising. Only the service providers that run Dualform for us handle it (section 6).
Disconnecting
You can disconnect at any time, in the app or in Garmin Connect. We then stop receiving your activities and delete your Garmin authorization tokens. When you disconnect in the app, you can delete all the sessions imported from Garmin in the same step. You can also delete them one by one at any time (section 8 explains what our server keeps after a deletion), and deleting your account deletes all of them.
Garmin handles your data in Garmin Connect under its own privacy policy.
5. Artificial intelligence
Dualform does not use artificial intelligence (AI) systems to process your training data, including the data from Garmin, and we do not use your data to train AI models. Before we add a feature that does, we will update this policy, explain what the feature does and why, and ask for your explicit consent. You can withdraw that consent at any time.
7. Where it is stored
Your account and training data are stored in the European Union, at present in Frankfurt, Germany. They are also stored on your phone, so the app works without a connection. Dualform keeps its data out of Android’s cloud backup, so no copy stays in your Google account.
Some providers in section 6 are in the United States, or their staff can access data from there. These transfers rest on the EU–US Data Privacy Framework (GDPR Article 45) where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Article 46(2)(c)). Ask us for a copy.
8. How long we keep it
- Your account and training data, including the sessions from Garmin: until you delete your account. For a session you delete, see the next item.
- Deleted sessions: a deleted session disappears from the app. Our server can keep a session that you logged yourself, marked as deleted, until you delete your account, so that your devices stay in sync. When you delete a session with data from Garmin, we delete the data from Garmin at once and keep only Garmin’s identifier for the activity, so that it is not imported again.
- Garmin authorization tokens: until you disconnect Garmin or delete your account.
- Backups of our database: up to 30 days. Data that you delete can stay in a backup until the backup expires.
- Crash reports and app-session records: up to 90 days.
- Usage events: up to 24 months.
- Technical logs of our servers and this website: up to 30 days. Technical data of app update requests: as long as Expo needs it to deliver and secure the updates.
- Your messages and requests: as long as we need them to help you and to show how we handled a request, at most 3 years.
9. Delete your account and data
You can delete your Dualform account and its data yourself. Open the app’s settings and choose to delete your account.
Deletion is permanent. It removes your account and your training data from our servers and from the app, disconnects Garmin and deletes the sessions imported from Garmin. We also delete the usage events linked to your account. Crash reports carry only a pseudonymous ID. Once your account is deleted, nothing on our servers links that ID to you, except backups until they expire within 30 days. The reports themselves are deleted within 90 days.
If you cannot use the app, email roope@dualform.app from the email address of your Dualform account and ask us to delete your account. We confirm the request and delete your account and data within one month.
10. Your rights
Under the GDPR you can ask us to:
- give you a copy of your data
- correct data that is wrong
- delete your data
- restrict how we use your data
- stop a use that rests on our legitimate interest
- send your data to you in a machine-readable file
You can also withdraw your consent at any time (section 3).
Email roope@dualform.app. It is free. We answer within one month, and we can ask you to show that the account is yours.
If you think we handle your data wrongly, you can complain to a data protection authority. In Finland, it is the Data Protection Ombudsman, tietosuoja.fi. You can also complain in the country where you live or work.
11. Security
- Traffic between the app, this website and our servers is encrypted.
- Garmin authorization tokens are encrypted where we store them.
- Our server checks every request, so an account can reach only its own data.
- Only the people who run Dualform can access our servers.
- Our logs, usage events and crash reports do not contain your training data or other health data.
If a data breach puts your rights at risk, we will tell you and the authorities, as the law requires.
12. This website
This website, dualform.app, uses no cookies, no analytics and no content from other services. Its fonts are served from the site itself.
When you visit, our hosting provider handles your IP address, your browser details and the pages you request, to deliver the site and protect it. These go into technical logs (section 8). Legal basis: our legitimate interest in delivering this website and keeping it secure (Article 6(1)(f)). Sites that we link to, such as Garmin’s, have their own privacy policies.
13. Children
Dualform is not for children. You must be at least 16 years old to use it. If you think that a child has an account, email us and we will delete it.
14. Changes to this policy
We update this policy when Dualform or the law changes. The date at the top shows the latest version. If a change affects how we use your data, we will tell you in the app or by email before it takes effect, and we will ask for your consent again where it is needed.
15. Contact
Roven Digital Oy (business ID 3587482-4), Vehmaistenkatu 9, 38200 Sastamala, Finland. Email roope@dualform.app. Write to the same address to report a security problem or abuse of Dualform.