XMan Privacy Policy

Who is responsible

This policy covers XMan and its PZB-operated download, support and connected services. PZB, Prestolnica Zdravja Bled, d.o.o. (PZB d.o.o.), Ljubljanska cesta 8, 4260 Bled, Slovenia, is responsible for its own app-operation, support and commercial records. Registration number: 6305733000. VAT ID: SI74779931. For business apps, the organisation using the service can be the controller of its customer, staff or guest records; the relevant distinction is explained below.

For privacy questions, access or deletion requests, email info@pzb.si and mention XMan. You can also write to our postal address above. This app policy is separate from the pzb.si website privacy policy.

Activity data and permissions

Local activity records can contain sport type, timestamps, GPS coordinates, distance, speed, route and connected sensor readings such as heart rate, cadence or power. Precise/coarse location supports recording and live rider maps. A foreground location service allows an active recording to continue with the screen off. Stop recording or revoke the relevant permission to stop that feature.

Bluetooth permissions support sensors and supported device connections. Wear OS can exchange activity information with the paired phone. Network-state and internet permissions support updates, groups, maps and service requests; notifications show recording/service status. Direct builds can request Android approval to install an update. Fitness readings are activity measurements, not medical advice.

Private groups and connected uploads

When you join a private activity group, position and activity information needed for its rider map and time/distance gaps is shared with participating members. The published release uses authenticated encrypted peer communication and a relay fallback. Encryption does not prevent an authorised group member from viewing, recording or redistributing information they receive. Treat an invitation as sensitive access information and leave the group when sharing is no longer wanted.

Connecting a ShadoU.top account can associate uploads with that account and your installation ID. Authentication and portal activity records then exist outside the phone; local recording is not the same as portal sharing. Map and location providers, including Google services where used, receive service requests under their own policies.

Automatic diagnostics and feedback

XMan sends app-operation and recording events and error reports to its configured report endpoint. Reports include a generated installation identifier, package/build/version, device manufacturer/model, Android version, timestamps, report source, event/error output and context. Crash information can include stack traces. These reports are automatic and are not necessarily anonymous.

Feedback or screenshot submissions additionally contain what you choose to send. Screenshots and logs can reveal route or account details; do not include unnecessary private activities, passwords or payment information. Downloads, report submissions and other network requests expose ordinary IP address and request metadata.

Purposes, recipients and legal bases

PZB uses service/account information to provide the requested feature or contract, diagnostic and connection information for its legitimate interests in maintaining a working and secure service, and required commercial records for legal obligations. Sharing is directed by the group or upload action you choose. Where health data requires explicit consent for a hosted feature, the relevant disclosure and consent are required before that processing; a sensor permission alone is not blanket upload permission.

Recipients can include selected group members, relay/hosting and support providers, connected portal services and map/platform providers. Optional hosted Pro/payment services process the order and entitlement information supplied in their checkout; the payment provider handles payment details under its own policy. PZB does not sell personal data. Third-party services can operate outside the EEA; applicable GDPR safeguards are required for restricted transfers by PZB.

Retention, deletion and security

Remove local sessions in the app or clear app-owned storage. Exports, watch copies, recipient copies and uploaded records are separate; uninstalling does not remove them. Contact info@pzb.si with the app name and installation/account reference to request deletion of hosted reports or activity/account records. Required transaction and dispute records may need separate retention.

The current services do not promise a universal automatic expiry for activity or diagnostic records. We explain any legally necessary retention when responding. Use device security, check recipients and take particular care with routes revealing your home or routine. HTTPS and group encryption protect their respective transport channels, not every copy of a record.

Your rights and how to contact us

Under the GDPR, where applicable, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time; this does not undo processing that was lawful before withdrawal.

Contact info@pzb.si with the app name and enough information to locate your records, such as the email used for a purchase, order reference or installation identifier. Do not send passwords, payment-card details or unnecessary activity files. We may ask for proportionate verification and normally respond within one month, subject to lawful extensions. We explain any records we must retain.

You can complain to Slovenia's Information Commissioner or your local data-protection authority.

Changes to this policy

The date above identifies the current policy. We will update it when app features or data handling change. A policy update alone does not authorize a new use of sensitive data: where required, the app must explain the change and request permission or consent before that processing begins.