Privacy policy.

drivven is operated by tekknative s.r.o., Blatná 13, 946 51 Nesvady, Slovakia. We are the controller responsible for the personal information described in this policy.

For privacy questions or requests, use our contact form. Please mention “Privacy” and use the email associated with your account where possible.

This policy covers our website, pre-launch username reservations, and communications. The mobile app is in development. We will provide information about any additional data use when those features become available.

• Account information: your email address, account identifier, sign-in method, and authentication records. If you register with a password, our authentication provider handles it. If you choose Google sign-in, we receive the identity information Google shares for authentication, which may include your name and profile image. Apple sign-in provides an account identifier and email address, which may be a private relay address if you hide your email. This Apple sign-in flow does not provide your full name. We do not receive your Google or Apple password.
• Your reservation: the username you choose, the time it was saved, and your answers about training types, training frequency, whether you train alone or with friends, and what you want from the community.
• Messages: your name, email address, message, and any information you choose to include when contacting us. Please avoid sending sensitive health information, passwords, or unnecessary identity documents.
• Technical and usage information: page visits, interactions, referring pages, browser and device information, cookie or session identifiers, errors, and diagnostic events. Our infrastructure providers may process IP addresses and request logs to deliver and protect the website.
• Delivery and abuse-prevention records: email delivery status, submission identifiers, timestamps, and keyed hashes derived from contact submissions and their source IP addresses to limit spam and prevent duplicate messages.

Account details and a valid username are needed to make a reservation. The reservation flow also asks for training preferences. Contact details and a message are needed if you want us to respond to an inquiry. You can browse the public website without creating an account.

• Provide the service: create and authenticate your account, save your reservation, and send confirmation or essential account messages. The legal basis is taking steps at your request and performing our agreement with you.
• Support and security: answer questions, investigate problems, prevent fraud and spam, and enforce our username policy. We rely on our legitimate interests in running a reliable service and protecting users, or on our agreement with you when handling a service request.
• Product planning: use training preferences and usage information to understand interest in drivven and improve the website. Our legitimate interest is developing a useful service, subject to your rights and any consent requirements that apply to the collection method.
• Updates and analytics: send launch and product news, measure website usage, and diagnose issues. Consent is required for optional marketing and non-essential tracking where applicable law requires it. Accepting our Terms or reading this policy does not, by itself, provide that consent.
• Legal obligations: respond to valid legal requests and keep records where the law requires us to do so.

We do not use the reservation questionnaire to make decisions that have legal or similarly significant effects on you solely by automated means.

Service storage. We use browser storage to maintain sign-in sessions and recover an unfinished username reservation. Reservation drafts stop being used after seven days; a draft used to complete Google or Apple sign-in stops being used after 30 minutes. These limits do not automatically erase an expired draft from your device. Drafts are cleared after a successful claim, and you can clear browser storage yourself.

Analytics. The website uses Google Analytics and, when configured, PostHog. These tools can use cookies and local storage to measure visits, referring pages, interactions, and errors. PostHog events may be linked to your account identifier and email when you sign in, so this information is not necessarily anonymous. Page addresses may contain the username you are trying to reserve. PostHog may also record a replay of website interactions if session replay is enabled.

Current controls. Analytics currently initialize when the website loads; the site does not yet provide an analytics consent or preference control. Browser settings can block or clear cookies and local storage, and you can use Google’s Analytics opt-out browser add-on. These controls may not stop every type of collection, and clearing essential storage can sign you out or remove your draft. This policy describes the current setup and does not replace any consent required by law.

For more information about Google’s processing, see how Google uses information from partner sites. For PostHog, see its privacy notice.

When your username is saved, we use Loops to send the confirmation email with your username. The claim process also adds new email addresses to our drivven email audience for launch and product updates. It does not automatically reverse an existing unsubscribe preference.

You can unsubscribe from promotional messages using their unsubscribe link or by contacting us. Essential account or reservation messages may still be sent where needed to provide the service. Sending a message through the contact form does not add you to the marketing audience.

We use service providers to operate drivven. They receive information needed for the services they provide:

• Supabase: account authentication, reservation storage, and backend functions.
• Google: optional Google sign-in and website analytics.
• Apple: optional Apple sign-in and private email relay if you choose to hide your email.
• PostHog: product analytics and error diagnostics.
• Loops: account emails, launch and product communications, and delivery of contact messages to our team.
• Hosting and email providers: delivering the website, keeping operational logs, and receiving and responding to your messages.

Other visitors can check whether a particular username is available. That check does not reveal your email address or training answers. We may also disclose information where legally required or necessary to establish, exercise, or defend legal claims.

Providers may process information outside Slovakia and the European Economic Area, including in the United States. Where such a transfer requires safeguards, applicable data-protection law requires an approved transfer mechanism, such as an adequacy decision or Standard Contractual Clauses. Contact us for details of the locations and safeguards applicable to your information.

Account and reservation records do not currently expire automatically. We retain them to maintain your account and reservation, including through the pre-launch period. You can request deletion at any time.

We keep support correspondence while needed to address your request, follow up on an unresolved matter, and meet legal obligations. Delivery records and contact submission identifiers are retained to prevent duplicate emails and investigate delivery problems; they currently have no automatic expiry. Contact abuse-prevention records contain keyed hashes rather than the raw message or raw IP address.

Analytics, email-provider records, operational logs, and backups have separate retention settings. Retention depends on the purpose, whether an account or inquiry remains active, security needs, and applicable legal requirements. Contact us for information about a particular record or to request deletion; deleting an account does not instantly remove every provider record or backup.

Subject to applicable law, you can ask to access, correct, or delete your information, restrict processing, receive a portable copy, or object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Send requests through our contact form. We may need to verify that the request comes from the account holder. We will respond within the time required by law, normally within one month under the GDPR, and explain any lawful extension or reason we cannot fully carry out a request.

You can complain to the Office for Personal Data Protection of the Slovak Republic or the supervisory authority where you live, work, or believe an infringement occurred. You do not have to contact us first.

We use access controls and other technical measures to protect information. Reservation records are restricted to the account that owns them, and privileged backend functions handle email delivery. No online service can guarantee absolute security.

The pre-launch service is not directed at children who cannot lawfully use it without parental permission. If you believe a child has provided information without the permission required by applicable law, contact us so we can review and address it.

We will update this policy when our services or data practices change and revise the date at the top of the page. Where required, we will give you additional notice or seek consent before making a change.

For questions about a reservation or how usernames can be reassigned, see our username policy.