Privacy Policy

Last updated: 20 August 2026

Short version: We keep only what we need to run the service — your account email (if you sign up), your subscription tier, and a count of the analyses you run. Your uploaded video or photo is processed and then automatically deleted; it is never sold or handed to an advertiser. Only anonymous numeric measurements go to the AI that writes your coaching notes. If you buy an Expert Review, a real person reviews your clip. We run no advertising trackers.

Flapp is a product operated by Clariva ("we", "us", "our"), a business based in Nanaimo, British Columbia, Canada. Flapp analyzes side-view running and cycling technique from a short video or a single photo. This page explains what personal information we collect, why, who processes it, how long we keep it, and the rights you have over it. It is written to describe how the service actually behaves. Clariva is the data controller for the information described here. Payments are processed by Stripe and appear on your statement as Clariva.

1. What we collect

If you use Flapp without an account

• The video or photo you upload for analysis.
• The sport and position you select (e.g. cycling, TT/Tri).
• Your IP address, which reaches our server automatically with any web request.

If you create an account

• Your email address and a password (we store only a salted one-way hash of the password — never the password itself).
• Your subscription tier and account creation date.
• A usage record: one row per analysis (timestamp and whether it was a video or a photo), used to enforce your plan's quota. It does not contain the media or the results.

If you buy a paid plan

• Payments are handled by a third-party payment processor. We do not receive or store your full card number. We receive only what the processor returns to us — such as a subscription status and a customer/transaction reference — so we can activate your plan.

We do not ask for your name, address, phone number, or date of birth, and we do not build advertising or behavioural profiles.

2. What we do with your media

• Your clip or photo is processed on our server to detect body pose and measure joint angles.
• For video, we optionally render an annotated "overlay" copy with the skeleton drawn on it, so you can review and download it.
• The uploaded file and any overlay are stored on our processing infrastructure and deleted automatically at the end of a fixed retention period: 7 days on the free plan and 30 days on a paid plan, counted from the analysis. Keeping them that long is what lets your saved history refer back to real footage, and what lets a human reviewer actually watch the clip you bought a review for. We do not keep a copy for our own marketing or for training models.
• You can delete a clip earlier at any time by deleting the saved analysis it belongs to, or your whole account — in both cases the footage is removed along with the record.
• Your video or photo is never uploaded to any third-party AI service. Only anonymous numerical measurements (joint angles, scores, detected issues) are sent to Google's Gemini API to generate the written coaching notes — no images, and nothing that identifies you.

3. Expert Review — when a person sees your clip

If you purchase an Expert Review, your video is reviewed by a real human reviewer (not only the automated system) who writes a manual assessment. For this feature only:

• Your clip is retained until the review is delivered even if its normal retention period would have ended first, so the reviewer can watch it.
• It is accessed solely to produce your review, is not shared further, and is deleted within 7 days of the review being delivered — the short window exists so the reviewer can correct something they wrote about footage that would otherwise already be gone.

If you do not buy an Expert Review, no human reviews your footage — it is only processed automatically as described above.

4. Feedback on your results

Under every report there's a "Does this match what you see?" prompt. Rating a result is entirely optional; nothing changes about your analysis if you skip it. When you do send feedback, we store:

• Your rating, any reasons you picked, and anything you type in the comment box.
• The technical context of that analysis — sport, riding position, score, how confident the analyzer was, how well it tracked you, browser and build version. This is what lets us find out which kinds of analysis go wrong.
• Your account email, if you're signed in, so we can follow up if a report needs a question answered. Feedback sent without an account carries no email.
• Only if you tick the box: the annotated still image from that analysis — the frame with the skeleton drawn on it. This is a photo of you, so it is never attached unless you explicitly choose to. It exists so we can see what the analyzer saw when it got something wrong.

Feedback is private: it is never shown to other users, published, or used for marketing. It is read only by us, and only to fix and improve the analyzer. You can ask us to delete any feedback you've sent at any time (see Your rights below).

5. Why we're allowed to use your data (legal basis)

For visitors in regions with data-protection laws such as the EU/UK GDPR, our legal bases are:

• Performing the service you asked for (a contract): analyzing your upload, running your account, and delivering a paid plan or Expert Review.
• Our legitimate interests: keeping the service secure, preventing abuse, enforcing free-tier limits, and using your feedback to correct the analyzer — balanced against your privacy.
• Our legitimate interests, again, for the product analytics in section 7: understanding which parts of the app are used and where they fail. It is limited to what that question needs, it excludes your media entirely, and you can switch it off for your browser at any time.
• Your consent: attaching the annotated still image to a piece of feedback. You give it by ticking the box, and you can withdraw it by asking us to delete that feedback.
• Legal obligation: keeping limited billing records where tax or accounting law requires it.

6. Your IP address

For anonymous visitors, we use the IP address for two purposes: to enforce the free-tier limit (a small number of analyses per day), and to limit how much feedback a single client can send.

For the analysis limit, IP addresses are kept in the server's memory on a rolling 24-hour window and cleared automatically — they are not written to a database, linked to your media, or shared. For feedback, we store a one-way salted hash of the IP alongside the feedback record — never the address itself — so that re-rating the same analysis updates your own entry instead of creating a duplicate. The hash cannot be used to contact you or to look you up elsewhere.

7. Cookies and product analytics

Flapp runs no advertising trackers, and nothing here is shared with an ad network or sold. We do use one product analytics tool — PostHog — to see how the app is actually used: which pages get opened, whether an analysis was started and whether it finished, when someone reaches a paywall, and when a purchase completes. It is what tells us which parts of the product are working, and we have no other way to know.

What it records:

• Page and screen views, clicks on buttons and links, and the browser/device type and approximate location (country/region, derived from your IP by PostHog — we do not store your address for this).
• Product events: an analysis started, completed or failed, the sport, the score and grade, whether a result was locked behind a plan, checkout started, purchase completed. None of these contain your media, your filename, or anything you typed.
• If you're signed in, your account id and email, so the same person is not counted as several — and so we can delete your analytics history along with your account if you ask.

What it does not record: your video or photo, the annotated frames, the coaching text, your password, your card details, or the message you write in a feedback box. Session replay is turned off.

PostHog stores a cookie and a browser-local id to recognise a returning visit. We honour your browser's "Do Not Track" setting: with it on, nothing is collected. You can also turn analytics off for this browser here:

Turn off analytics on this device

If you sign in, we also use a token stored in your browser to keep you logged in — this is required for the service to work, not for tracking. Your remaining daily quota (for anonymous use) is stored in your own browser's local storage, on your device — not on our server.

8. Who processes your data (third parties)

We do not sell, rent, or share your personal information with anyone else, and we do not use it for third-party advertising.

9. International transfers

Clariva operates Flapp from Canada, and our providers (above) may process data on servers in Canada, the United States, or elsewhere. If you access Flapp from the EU/UK, this means your data may be transferred outside your country. We rely on the providers' own safeguards (such as standard contractual clauses) for these transfers, and we keep the personal data involved to the minimum described here.

10. How long we keep it

11. Your rights

Depending on where you live (including under Canada's PIPEDA and the EU/UK GDPR), you can:

• Access the personal information we hold about you.
• Correct it if it's wrong.
• Delete your account and associated data ("right to be forgotten").
• Export your data in a portable form.
• Object to or restrict certain processing, and withdraw consent where we relied on it.
• Complain to your data-protection authority (in Canada, the Office of the Privacy Commissioner).

Deletion is self-serve: open Dashboard → Delete account, confirm with your password, and your account, saved analyses (and their annotated stills and stored footage), usage records, feedback and order history are erased immediately. It cannot be undone, and it does not cancel an active subscription — cancel that first under Manage subscription. For anything else on this list, email us (below) and we'll respond within a reasonable time — and within any period the law requires.

12. Security

We use HTTPS in transit, store passwords only as salted hashes, keep media on storage that deletes itself on a schedule rather than in a permanent database. No system is perfectly secure, so we cannot give an absolute guarantee — but we keep the personal data we hold deliberately minimal to limit the impact if something goes wrong. If a breach ever affects your data, we will notify you and the relevant authority as required by law.

13. Children

Flapp is not intended for children under 16. Please don't create an account for, or upload footage of, a minor without the consent of a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes

This is an evolving product, and this policy may change as the service grows. We'll update the "last updated" date above when it does, and for material changes affecting account holders we'll make a reasonable effort to let you know.