ShadoU Privacy Policy

Who is responsible

This policy covers ShadoU and its PZB-operated download, support and connected services. PZB, Prestolnica Zdravja Bled, d.o.o. (PZB d.o.o.), Ljubljanska cesta 8, 4260 Bled, Slovenia, is responsible for its own app-operation, support and commercial records. Registration number: 6305733000. VAT ID: SI74779931. For business apps, the organisation using the service can be the controller of its customer, staff or guest records; the relevant distinction is explained below.

For privacy questions, access or deletion requests, email info@pzb.si and mention ShadoU. You can also write to our postal address above. This app policy is separate from the pzb.si website privacy policy.

Activity, location and sensor data

Depending on your platform, permissions and connected devices, ShadoU handles activity type, start/end times, duration, distance, route points (latitude, longitude, altitude, accuracy and speed), and sensor readings such as heart rate, cadence or power. Session identifiers associate these records with an activity. Local settings and an installation identifier support app operation.

Location is used to record and display your route and calculate activity measurements. When you start an activity and permit background location, recording can continue while the screen is off or the app is not in the foreground. Stop the activity to stop recording, or revoke the relevant permission in device settings. Revoking location can prevent route recording.

Heart rate and other fitness readings are used for the activity features you enable, not as a medical diagnosis. Bluetooth, ANT+, motion and supported platform health permissions are relevant to the associated sensor or integration. Wear OS can exchange activity and sensor information with the paired phone. Available integrations differ between Android, Wear OS and iOS; grant only permissions for features you intend to use.

Microphone permission supports voice commands and explicitly recorded voice notes in messaging or group rides. Audio you choose to send is shared with its recipients. Android's speech-recognition provider may process command audio, including through its online service; its own policy applies. Turning off microphone permission prevents these features, not ordinary GPS recording.

Backups, restore and sharing

ShadoU includes hosted activity-backup and restore functionality. When a backup is uploaded, it can contain complete sessions, route coordinates and timestamps, heart-rate samples and other included sensor readings, plus your installation identifier and app version/build. This is a transfer to a server, not merely local storage. Some builds use ShadoU.top archive services; endpoint availability and backup controls vary by build.

A route can reveal your home, workplace and daily routine even without your name. Check the backup/restore settings in your installed build before recording sensitive activities. Exporting or sharing an activity gives its recipient the included route and measurements; PZB cannot delete a copy already obtained by that recipient.

Support, licensing and service connections

The Android app sends operational events, errors and crash diagnostics automatically to its configured report service. Reports can include the installation identifier, app version/build, device description, timestamps, error output, stack traces and event context. Pending fatal reports can be stored locally and retried on startup. This is not limited to messages you manually submit and is not anonymous. Feedback you send is also processed to resolve issues. Do not include private routes or health readings in a support message unless needed for the issue and you intend to share them.

Downloads, update checks, hosted backups and licensing requests expose ordinary network information such as IP address, requested URL and request time. Hosted Pro orders process the name, email, installation/user ID, payment method, order/transaction references and entitlement status needed to fulfil and administer the purchase. An external checkout provider handles payment details under its own privacy policy.

ShadoU.top accounts, social features and integrations

If you register or sign in to ShadoU.top through the app, the portal processes your email, username, display name, authentication credentials and session tokens. Installation/device identifiers, device label and app version may be linked to your account. A signed-in account is not an anonymous installation.

Uploads can associate activities and their detailed routes with that account. Profile information, posts, comments, messages, relationships, groups, challenges and workout records are processed when you use those features. Visibility and detail-visibility settings determine which activity information other users can see; check those settings before publishing a route. Group-ride features can share your position and messages with participating riders. Recipients can retain content they receive.

Supported external integrations include Strava, Smashrun and Concept2. Connecting one uses authorization tokens and transfers the activity information needed for the import or sync you choose. Google Maps and Google's location services process requests under Google's privacy policy. Disconnect an integration when you no longer want it to access data.

Where you use portal wallet, rewards or marketplace features, the service processes the associated balance, transaction and activity-scoring records. Google Play Pro purchases use Play billing and purchase tokens to recognize or restore entitlement; Google handles checkout, not PZB's app. These are separate from hosted license purchases.

To request deletion of your portal account and associated personal data, email info@pzb.si from the registered email and identify the account. Account deletion and hosted-backup deletion are separate requests if your backup is associated only with an installation ID. Uninstalling does not delete either.

Purposes and legal bases

Activity data is used to provide recording, review and restore functionality that you request. Service and purchase data supports the requested service or contract (GDPR Article 6(1)(b)); necessary diagnostic and security information supports our legitimate interests in operating the service (Article 6(1)(f)); and accounting records are processed to meet legal obligations (Article 6(1)(c)). Where health data requires an Article 9 condition, explicit consent is required before PZB processes it through an optional hosted feature. Permission to read a sensor must not be treated as blanket permission to upload health data.

You may stop recording, disconnect sensors, withdraw permissions and disable optional features. Withdrawing consent does not invalidate earlier lawful processing. It may make the related feature unavailable.

Recipients and security

Data is received by the hosted service used for backup, restore or support, infrastructure providers needed to run it, payment services you choose and anyone you choose to share an activity with. Connected platform health services and device providers have their own policies. We do not sell personal data. Data may also be disclosed where legally required.

Network services can involve providers outside the EEA. Applicable GDPR safeguards are required for restricted transfers undertaken by PZB; an independently selected platform's own policy describes its transfers. HTTPS protects transport to PZB's service endpoints, but it is not a guarantee of anonymity, end-to-end encrypted backup or absolute security. Protect your device and take care when exporting routes.

Retention and deletion

Local activities remain until removed through the app or app storage is cleared. Uninstalling can remove app-owned local storage; exports, watch copies, device backups and hosted archives are separate copies.

To request deletion of hosted activities or backups, email info@pzb.si, identify ShadoU and supply the installation identifier or other record reference if available. You can also request deletion of support and licensing information. Do not send an entire private route just to identify your request.

The current backup service does not promise automatic expiry of older archives. Removing a local activity must not be assumed to remove its hosted copies. Server records are retained for the service purpose until deletion is carried out, subject to legally necessary records; transaction information may need to be kept for accounting/tax obligations. We explain any lawful exception when responding to your request.

Children

ShadoU is not designed specifically for children. Parents and guardians should be particularly careful about sharing a child's route or health readings. Contact us if a child has submitted personal information that should be deleted.

Your rights and how to contact us

Under the GDPR, where applicable, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time; this does not undo processing that was lawful before withdrawal.

Contact info@pzb.si with the app name and enough information to locate your records, such as the email used for a purchase, order reference or installation identifier. Do not send passwords, payment-card details or unnecessary activity files. We may ask for proportionate verification and normally respond within one month, subject to lawful extensions. We explain any records we must retain.

You can complain to Slovenia's Information Commissioner or your local data-protection authority.

Changes to this policy

The date above identifies the current policy. We will update it when app features or data handling change. A policy update alone does not authorize a new use of sensitive data: where required, the app must explain the change and request permission or consent before that processing begins.