Last updated: September 1, 2026
The controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR is:
Michael Lopes Pinto
trading as: 3D Druck Michael Lopes Pinto (sole proprietorship)
Staufener Str. 26
79189 Bad Krozingen
Germany
Email: info@mlp3d.de
This policy covers the app “Kurbl: Indoor Cycling” on every platform we offer it on. Kurbl is built so that your data stays on your device. There is no user account, no sign-in, and no server of ours holding your training or health data. We collect no personal data about you through the app, we show no ads, and we use no analytics, tracking, or advertising services. We build no user profiles and we sell no data. Personal data only arises on our side if you write to us yourself, see section 10. The app works fully offline, except for buying Kurbl+.
The legal basis for processing what you enter and what your equipment measures is Article 6(1)(b) GDPR: the processing is necessary to give you the app you installed. Writing to your operating system’s health store is covered separately in section 6.
Kurbl connects over Bluetooth to your smart trainer and, if you use them, to your power meter, your cadence or speed sensor, and your heart rate strap. It reads power in watts, cadence, speed, distance covered, duration and, if such a device is connected, your heart rate. These values are processed only on your device and displayed there. They are not sent to us and not to anyone else.
The app also sends control commands to your trainer, such as a resistance level, a target power, or a gradient. Nothing about you goes to the device beyond that control.
Your heart rate is health data and therefore falls under the special categories of personal data in Article 9 GDPR. That is exactly why it stays on your device. Whether it arises at all is your decision, made by connecting a device that measures it. We never process it, because it never reaches our systems.
Everything you create in Kurbl is stored and processed on your device alone:
Speed, distance, gradient, and the course of a session are all calculated on your device as well. No data is transmitted to us or to anyone else in the process.
You can pick a GPX file to ride a route of your own. The app reads the waypoints from it, meaning geographic coordinates and elevation values, and stores them as a route on your device. The app gets access to the one file you pick in the file chooser, and to nothing else.
A GPX file from a recorded ride can contain your movement history and with it clues about where you live. That stays on your device. It is not sent to us and not to anyone else. You remove it by deleting the route in the app. Kurbl never asks for your actual location.
Kurbl can write a finished ride into your phone’s health store as a workout: Apple Health on iOS, Health Connect on Android. This feature is off by default. It does nothing until you turn it on under Your Rides and grant the permission your operating system asks for.
What gets written is the start and end time of the ride, the distance you covered, and the energy expenditure calculated from your power. No heart rate series and no location data are written. Kurbl reads nothing from the health store; it does not request a single read permission.
The data stays on your device. It goes straight from Kurbl to your operating system’s health store. It is not sent to us and not passed to anyone else. We never have access to it.
The legal basis is your explicit consent under Article 9(2)(a) GDPR, which you give with the switch in the app and with the system prompt. You can withdraw it at any time by turning the switch back off or by revoking Kurbl’s permission in your system settings. Workouts already written are unaffected, and you can delete them yourself in Apple Health or Health Connect. Rides that took place before you turned the feature on are not written retroactively.
Kurbl is not a medical device. The app does not diagnose, does not treat, and is not intended for the prevention, monitoring, or alleviation of disease.
So that your rides, sessions, and coins survive a change of phone, Kurbl is included in your operating system’s backup. On Android that is Android Auto Backup, which puts the app’s data into your Google account in encrypted form. On iOS it is your iPhone’s device backup, to iCloud or to your computer.
That backup is run by your operating system, not by Kurbl, and it goes into your own account or storage. We receive no data from it and have no access to it. Google’s and Apple’s own privacy terms apply to how they handle it. You can turn the backup off in your device settings.
Kurbl+ is a one-time purchase that unlocks the app’s extended features. There is no subscription and there are no recurring charges. The purchase runs entirely through the store: on the App Store through Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), on Google Play through Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These companies process your payment data as controllers in their own right, under their own privacy terms. We never receive your payment data and never receive any details about you.
To check and restore your purchase, the app asks the store directly whether that purchase exists for your store account. We put no server of our own and no other service provider in between. This check also runs at startup, so that access you have paid for once is available again on a new device.
If you write to kurbl@mlp3d.de or info@mlp3d.de, we process your email address, your name if you give it, and everything contained in your message and its attachments. We use this solely to deal with your request and to reply to you. The legal basis is Article 6(1)(b) GDPR where your purchase or your use of the app is concerned, otherwise Article 6(1)(f) GDPR. Our legitimate interest is answering enquiries.
Our mailbox is operated on our behalf by manitu GmbH, Welvertstraße 2, 66606 St. Wendel, Germany. A data processing agreement under Article 28 GDPR is in place with them. Under that agreement, processing takes place solely in Germany, in another member state of the European Union, or in a state party to the European Economic Area; no transfer to a third country takes place. There are no further recipients of your message.
We delete support messages no later than twelve months after your request has been dealt with. We keep them longer only while a statutory retention obligation applies or while we need them to establish or defend legal claims.
Please do not send us anything we do not need. A description is almost always enough for a problem with the app. If you send us a backup file or a screenshot, we see everything on it, with Kurbl that includes recorded rides and heart rate values. Those are health data under Article 9 GDPR. We never ask for such details and we do not need them. If you send them anyway, we process them solely to answer your request. The legal basis is your explicit consent under Article 9(2)(a) GDPR, which you give by deliberately attaching them and can withdraw at any time. We delete attachments of that kind as soon as your request has been dealt with, at the latest after 30 days.
Your data stays on your device until you delete it in the app or uninstall the app. You can remove individual rides, your own sessions, and imported routes in the app at any time. Nothing reaches us from the app itself; it sends us no data. The only thing we hold is the messages you write to us yourself, for the period stated in the previous section. For backups run by your operating system, see section 7.
Under the GDPR you generally have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)). We neither collect nor store personal data about you through the app. The only data held by us is what comes from an email you sent (section 10). Your rights attach to that; an informal message to info@mlp3d.de is enough. For anything to do with your purchase, please contact the store you bought from.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de). You can also go to the supervisory authority where you live.
Right to object. Where we process data on the basis of Article 6(1)(f) GDPR, that is support messages outside a contract with you, you may object to that processing at any time on grounds relating to your particular situation (Article 21 GDPR). We will then stop processing your message unless we can demonstrate compelling legitimate grounds.
If you live in the United Kingdom. The same rights apply to you under the UK GDPR, and you can complain to the Information Commissioner’s Office (ico.org.uk). You can also complain to us directly, and we would rather you did that first. Write to info@mlp3d.de with “Data protection complaint” in the subject line. We will confirm that we received it within 30 days, look into it, and reply without undue delay.
If you live in the United States. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling, because none of it reaches us in the first place. If you are a Washington resident, our separate Consumer Health Data Privacy notice sets out what applies to health data.
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The app evaluates your training data only when you ask it to, and it makes no decision with legal effect for you. The values it shows, in particular calculated energy expenditure and power estimated without a meter, are guide values and not medical or sports medicine advice.
We update this policy when the app or the law changes. You can always reach the current version from the app’s settings.