Privacy Policy

Tremo — mobile app and tremocoach.com

Last updated: 16 August 2026

This privacy policy explains how personal data is processed within the Tremo mobile app (iOS and Android) and on the website tremocoach.com, in accordance with the EU General Data Protection Regulation (GDPR / DSGVO).

1. Controller

The controller responsible for data processing is:

Mucha Solutions UG (haftungsbeschränkt) (trading as Tremo)
Zwillingstrasse 4, 80807 München, Germany
Represented by the Geschäftsführer (managing director): Adrian Malucha
Amtsgericht München, HRB 315278
Email: muchasolutions.info@gmail.com
Phone: +420 601 359 752

We have not appointed a Data Protection Officer, as we are not legally required to do so. For any privacy questions, contact us at the address above.

Where a coach uses Tremo to manage their own clients (for example client notes and records), the coach is a separate controller for the personal data they enter about their clients. In that relationship, Tremo processes the data on the coach's behalf as a processor, under the terms of the Coach Terms and the data processing agreement referred to there.

2. Overview of what we collect

Depending on whether you use Tremo as a coach or a client, we process:

• Account & profile data: name, email address, phone number (optional), role (coach/client), profile photo, date of birth.
• Body metrics (clients): weight, height, and similar training-related figures you choose to enter.
• Booking & session data: sessions, bookings, attendance, credits, referral connections between coach and client.
• Payment data: processed via Stripe (see § 5). We do not store full card numbers on our servers.
• Communication data: messages, group chats, and in-app notifications ("Updates").
• Technical data: device information, IP address, app/version, crash and diagnostic logs.

Because weight, height and similar training data can qualify as health-related data under Art. 9 GDPR, these fields are optional and are processed only on the basis of your explicit consent (Art. 9(2)(a) GDPR), given when you choose to enter them.

3. When you visit the website

When you access tremocoach.com, our hosting provider automatically processes server log data (IP address, date/time, requested page, referrer, browser/OS) for the purpose of delivering the site and ensuring security and stability.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).
Hosting/CDN: Vercel Inc. (see § 6).

Waitlist sign-up. If you join the waitlist, we process the email address (and any other details you submit) to contact you about launch.
Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw at any time via the unsubscribe link or by emailing us.

Cookies / tracking. See our Cookie Policy for full details. In short: tremocoach.com and the app currently use only strictly necessary cookies (login, payment security). If we introduce analytics or other non-essential tracking in the future, we will update the Cookie Policy and, where required by law (§ 25 TDDDG), obtain your consent through a cookie banner before any such tool is activated.

4. When you use the app

4.1 Account creation & login. We use email-based sign-in. You can sign in with a one-time code sent to your email address, or set a password and sign in with that. Passwords are handled by our authentication provider (Supabase) and are stored only as salted cryptographic hashes; we never see or store your password in plain text. We process your email address, account identifiers and session tokens to authenticate you and secure your account.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract — providing the service you signed up for).

4.2 Profile & role. Completing a profile (name, role, and optional details) is required to use core features.
Legal basis: Art. 6(1)(b) GDPR. Optional/special fields (body metrics): Art. 6(1)(a) / Art. 9(2)(a) GDPR (consent).

4.3 Coach–client connection. Clients connect to a coach using a referral code. This creates a relationship record so bookings, payments, and messages can flow between the connected parties.
Legal basis: Art. 6(1)(b) GDPR.

4.4 Bookings, sessions & credits. We process session and booking data to let coaches offer sessions and clients book, accept, decline, and pay.
Legal basis: Art. 6(1)(b) GDPR.

4.5 Messaging & notifications. Messages, group chats, and the Updates feed are processed to enable communication between connected coaches and clients.
Legal basis: Art. 6(1)(b) GDPR.

4.6 Diagnostics & crash logs. We process technical/diagnostic data to keep the app stable and fix errors.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, secure app).

5. Payments (Stripe Connect)

Payments in Tremo are handled by Stripe. We use Stripe Connect with Direct Charges, so that coaches receive payments into their own connected Stripe accounts, with Tremo acting as the platform that facilitates the transactions. The coach is the merchant of record.

When you pay for a session, subscription, or payment request, your payment details (e.g. card data, Apple Pay token) are transmitted directly to Stripe and processed by Stripe. We do not receive or store your full card number.

We receive and store transaction metadata (amount, status, timestamp, associated booking/plan, and a Stripe customer/charge reference) to run the service and show payment history.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligations such as bookkeeping/tax retention).

Stripe processes data as its own controller for parts of the payment flow and may transfer data to the USA. See Stripe's privacy policy: https://stripe.com/privacy

6. Processors and third-party services

We use the following service providers, each under a data processing agreement (DPA) where required:

7. International data transfers

Our backend infrastructure (Supabase) is hosted in Ireland, within the EU, so no third-country transfer takes place for that processor. Some other processors are located outside the EU/EEA (notably in the USA). Where this is the case, transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR) and/or the EU–US Data Privacy Framework, and where applicable your consent (Art. 49 GDPR).

8. Retention

We keep personal data only as long as necessary for the purposes described, or as required by law:

• Account & profile data: for the life of your account; deleted or anonymised after account closure, subject to legal retention.
• Booking/payment records: retained as required by German commercial and tax law (up to 10 years).
• Messages: for the life of the relationship / account, unless deleted earlier.
• Diagnostic logs: short-term, then deleted or aggregated.

9. Your rights

Under the GDPR you have the right to:

• Access your data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure ("right to be forgotten", Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, without affecting prior processing (Art. 7(3))

To exercise any of these, contact us at muchasolutions.info@gmail.com. You may also lodge a complaint with a supervisory authority. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

10. Children

The Tremo service may be used by minors under the age of 18 only with the prior, verifiable consent of a parent or legal guardian, in accordance with Art. 8(1) GDPR. Such consent must be obtained before a minor's account is created and before Tremo is used on their behalf. Coaches working with a client under 16 are required to confirm that valid parental consent has been obtained before providing services to that client through the app. If we become aware that a minor's account was created without valid parental consent, we will suspend access and delete the associated data without undue delay. Users aged 18 and over may consent to the processing of their own data.

11. Changes to this policy

We may update this policy to reflect changes to the service or legal requirements. The current version is always available in the app and on tremocoach.com.

Controller: Mucha Solutions UG (haftungsbeschränkt) · Amtsgericht München HRB 315278 · Geschäftsführer: Adrian Malucha · Zwillingstrasse 4, 80807 München, Germany · muchasolutions.info@gmail.com · +420 601 359 752 · Last updated: 16 August 2026