Privacy Policy

1. Who we are

ovree is operated by ladata, s.r.o. ("we", "us", "our"). This policy explains what data we collect when you use ovree.app or our mobile app, why we collect it, and what rights you have over it.

Questions about this policy or your data can be sent to hello@ovree.app.

2. Data you give us

We collect the minimum needed to run the service:

• Account data — your email address and authentication identifiers, managed via Supabase.
• Photos you upload — the activity photo you choose to turn into an overlay.
• Preferences you set during generation — selected stats, style, and layout edits.

3. Data from Strava

If you connect your Strava account, we use Strava’s API to read your recent activities (type, distance, pace, elevation, time) so you can pick one and choose which stats to show.

This activity data is fetched on demand and held only in memory for the duration of your session — we do not store your Strava activity feed in our database. We never download or store photos from Strava; every photo used for generation is uploaded by you directly.

4. How your photo is processed

Your uploaded photo, and the overlay generated from it, are sent to Google Gemini (our AI image provider) to analyze the scene and produce the overlay artwork. Google processes this data as our sub-processor and does not use it to train models outside the terms of our agreement with them.

Generated files (original photo, analysis, overlay, composite) are stored on our servers under a folder scoped to your account so you can revisit, re-download or edit them later.

5. Why we process this data

We process your data to provide the core service (generating and delivering overlays), to operate your credit balance and job history, to secure your account, and to improve reliability. We do not sell your data or use it for ad targeting.

6. Who we share data with

We share data only with the processors needed to run ovree:

• Supabase — authentication and database hosting.
• Google Gemini — AI analysis and image generation.
• Strava — OAuth connection to read your activity list, at your request.
• Stripe — payment processing when you buy credits. Stripe receives your payment details directly; we never see or store your full card number.
• Our infrastructure provider — the VPS that hosts the API, workers and file storage.

7. International transfers

Some processors above (e.g. Google) may process data outside the EU/EEA. Where this happens, transfers rely on the provider’s standard contractual clauses or equivalent safeguards.

8. Cookies

We use essential cookies to keep you signed in. If you accept optional cookies via the banner on our landing page, we also use lightweight analytics to see which pages get used — no ad tracking, no data resale.

9. Data retention

Photos, overlays and job history are kept while your account is active so you can access your gallery. You can request deletion of your account and associated files at any time by contacting hello@ovree.app; we will delete them within 30 days except where we must retain records for legal or accounting reasons.

10. Your rights

Under GDPR you have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email hello@ovree.app — we will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11. Children

ovree is not directed at children under 16. We do not knowingly collect data from anyone under that age.

12. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected here with a new "last updated" date; we recommend checking back periodically.