Privacy Policy

Last updated: 23 August 2026

Who we are

URU provides the URU app, the URU Tag training device, and the uru.zone website. This policy explains how personal data is handled across those services.

The URU app is published on Google Play by Jón Friðrik Sigurðarson. The data controller for the service is URU zone ehf., company registration number (kennitala) 5003230860, Árleyni 8, 113 Reykjavík, Iceland.

What we collect

  • Account and profile data. This includes your email address, authentication credentials, and details you enter, such as your name, training profile, units, and preferences.
  • Training data. This includes workouts, programs, exercises, sets, reps, weights, timestamps, and scores derived from your training.
  • Sensor-derived movement data. The URU Tag captures high-frequency motion measurements during a set. URU also stores per-rep summaries computed from those measurements.
  • Device data. This includes your URU Tag identifier, firmware version, pairing and connection diagnostics, and battery telemetry.
  • App and diagnostic data. This includes app version, device model, operating system version, and crash or error reports.
  • Billing data. We store subscription and order status and, for physical orders, the shipping address you provide. Card details are entered with our payment provider and do not reach URU servers.
  • Optional inputs. The camera is used only to scan a class join code, and no image is stored. The microphone is used only for in-set voice commands. Android uses on-device voice recognition when available and can fall back to the operating system speech service. iOS requests on-device recognition.

What we do not collect

URU does not collect location data. Bluetooth is declared as never used for location, and the app requests no location permission. URU does not use advertising identifiers, ad networks, or third-party analytics SDKs.

Cookies

The website uses strictly necessary cookies for access control and to keep you signed in. It uses no advertising or tracking cookies.

How we use your data

We use data to deliver training features, calculate movement quality metrics, keep your URU Tag working, provide support, diagnose problems, manage billing, and send product email that you can opt out of.

AI features

AI coaching, program generation, and feedback features send a summary of training context to the model provider listed below. The summary can include exercises, sets, reps, weights, computed scores, and free-text notes you write. Raw sensor signals and URU scoring formulas are never sent to an external model provider.

Who we share data with

  • Supabase provides database, authentication, file storage, and serverless function services.
  • Mollie processes payments and subscriptions.
  • Sentry receives crash and error reports from the mobile app. Email addresses, tokens, and raw signal arrays are scrubbed before reports are sent. Crash and error reports remain under Sentry's own retention window, independently of your URU account.
  • Mistral at api.mistral.ai generates text for the AI features described above from the limited training summary.
  • Expo and EAS support app builds and over-the-air app updates.
  • Vercel hosts the uru.zone website.
  • Resend delivers sign-in codes, account email, and product email.

URU does not sell personal data.

Other people who can see your data

If you join a coach's class, your training results are shared with that coach. Results can also be visible to other class members where a class feature displays them. Authorised URU personnel may access training and sensor-derived data for support and quality review.

Where data is processed

The production Supabase project is in the EU, and the website is hosted on Vercel. Primary storage and processing of account, training, and sensor-derived data happens in the EU/EEA. Some processors are established outside the EEA. Those transfers rely on the safeguards in each provider's data processing agreement.

How long we keep data

We keep personal data for as long as your account exists. There is no separate expiry schedule. Deleting your account removes your personal data, apart from the two exceptions below.

  • Order records remain after account deletion with the shipping address removed. These anonymised records are kept only as long as accounting law requires.
  • Crash and error reports remain under the crash reporting provider's own retention window, independently of your account.

Your rights

Under GDPR, you have the right to access your data, rectify it, erase it, restrict its processing, object to its processing, and receive it in a portable format. In the app, open Settings and choose Download My Data for a full export. Choose Delete Account to delete your account and associated data. If you cannot reach the app, you can delete your account through the web request path. Every marketing email also includes an unsubscribe link. You can also exercise your rights using the privacy contact address below.

You may lodge a complaint with Persónuvernd, the Icelandic Data Protection Authority.

Security

Data is encrypted in transit. Stored data is access controlled with row-level security. Diagnostic reports are scrubbed before they leave the device as described above.

Children

You must be at least 16 to use URU. The service is not directed to children, and URU does not knowingly collect personal data from anyone under 16.

Changes to this policy

If this policy changes materially, URU will announce the change in the app or by email and update the date at the top of this page.

Contact

The data controller is URU zone ehf., Company registration number (kennitala): 5003230860, Árleyni 8, 113 Reykjavík, Iceland. For privacy requests, email contact@uru.zone.