Privacy Policy

⚖️ Translation for convenience. TRONGO is based in Austria. The German version of this privacy policy is the legally binding one; this English page is a non-binding translation. In case of any discrepancy, the German text prevails.

📝 Draft. The content describes what the code actually does — every processing activity below is evidenced in the source. The fields marked in amber ([…]) are not yet filled in. Have this reviewed by a lawyer before publication. This is not legal advice.

Diese Datenschutzerklärung auf Deutsch lesen →

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Name / company name: [COMPANY NAME]
Address: [STREET AND NUMBER], [POSTAL CODE AND CITY], Austria
Email: hello@trongo.net
Data protection officer: [DATA PROTECTION OFFICER OR DELETE THIS LINE]

Full provider details in the imprint.

2. The principle

We keep data to a minimum. What we do not do matters as much as what we do:

No advertising or tracking cookies — and therefore no cookie banner. The cookie policy explains why that is lawful.
No ad network, no social media pixel, no third-party analytics (no Google Analytics, no Meta pixel, no Hotjar).
Fonts are hosted on our own server — loading a page sends no request to Google Fonts or any other font network.
Your learning progress stays on your device. XP, belts, study books read and flashcards answered are not transmitted to us.
There is no server-side user account yet and no payment process — accordingly we process neither passwords nor payment data.

3. Processing activities in detail

a) Visiting the website (hosting, server logs, bot defence)

Purpose: Delivering the pages, operational security, defence against attacks and automated bulk requests.
Data: IP address, timestamp, requested path, technical connection data. To limit requests per time window, the IP address is briefly stored as a counter key.
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in secure, available operation.
Retention: The counter key expires automatically after the respective time window (at least 60 seconds). For the retention period of logs at Cloudflare see [CHECK AND ENTER CLOUDFLARE LOG RETENTION].
Recipients: Cloudflare, Inc. (hosting, CDN, key-value store, bot defence)

b) Storage on your device (localStorage)

To operate the site we store entries in your browser's local storage. They do not leave your device and are not transmitted to us:

trongo_academy: Academy progress per discipline and learning area: XP, recently shown questions, whether a study book has been read and how many quiz rounds were completed
trongo_ufc, trongo_ufc_last: progress and last opened area of the UFC section
trongo_streak, trongo_weekly2: learning streak, daily goal and weekly challenge
trongo_last: last opened learning area (for "continue")
trongo_user: local account preview (nickname and email). No account is created on a server and no password is stored.
trongo_cart: basket of the Fightwear preview (no purchase possible)
trongo_lang: selected language
trongo_pwa_dismissed: whether the "add to home screen" hint has been dismissed

Legal basis: Art. 6 (1) (f) GDPR. Under § 165 (3) TKG 2021 no consent is required for these entries: they are strictly necessary to provide the service you explicitly requested. None of them serves advertising, audience measurement or cross-site recognition.
Retention: Until you delete them. Removable at any time via data deletion and via your browser's website data.

c) Founding list / newsletter (double opt-in)

Purpose: Notifying you once TRONGO launches.
Data: Email address, status, confirmation token, time of sign-up, version of the consent text and language. On confirmation additionally the time and IP address as proof of consent. The user agent is deliberately not stored.
Legal basis: Art. 6 (1) (a) GDPR (consent) for sending; Art. 6 (1) (c) and (f) GDPR for keeping the proof of consent.
Retention: Until withdrawal. Unconfirmed sign-ups are deleted automatically after 30 days (daily clean-up run).
Recipients: Cloudflare, Inc. (storage) and Resend, Inc. (sending the confirmation email, where enabled)

You may withdraw at any time without giving reasons — a message to hello@trongo.net is enough. The lawfulness of processing before withdrawal remains unaffected.

d) Bot defence in the sign-up form (Cloudflare Turnstile)

Purpose: Telling humans from automated access in order to prevent misuse of the sign-up form.
Data: When the home page loads, a script from challenges.cloudflare.com is fetched; in doing so Cloudflare learns your IP address and technical characteristics of your browser. According to the provider, Turnstile works without behavioural tracking.
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in preventing automated misuse.
Recipients: Cloudflare, Inc.

e) AI coach (chat)

Purpose: Answering your questions about martial arts.
Data: The text you enter and the conversation so far. This content is transmitted to Anthropic in order to produce an answer. We do not store the conversation — it is forwarded and not written to our database.
Legal basis: Art. 6 (1) (b) resp. (f) GDPR — providing the function you requested.
Recipients: Anthropic PBC, USA

Please do not enter health data or other sensitive information into the coach — no details about injuries, diagnoses, medication or body metrics that identify you. You alone decide what you type into the field; we cannot check the content in advance. For health questions please consult a doctor.

f) Error diagnostics

Purpose: Detecting and fixing technical errors in the browser.
Data: Error type, truncated error message (max. 300 characters) and the page path. No input, no identifiers. Email addresses are masked in our logs.
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in a working service.
Recipients: Cloudflare, Inc. (logging) [IF AN ERROR WEBHOOK IS ACTIVE: ADD RECIPIENT]

g) Audience measurement

A cookieless audience measurement by Cloudflare ("Web Analytics") may be enabled for delivery. It counts page views in aggregate, sets no cookies according to the provider and does not build a cross-device profile.

Status: [AUDIENCE MEASUREMENT: ACTIVE OR NOT — CHECK IN THE CLOUDFLARE DASHBOARD AND RECORD HERE]
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in usage statistics, where active.
Recipients: Cloudflare, Inc.

h) Aggregate number of sign-ups

On the home page we show how many people have already signed up. Only a total count is determined for this — no personal data.

4. Recipients and processors

Cloudflare, Inc.: hosting, content delivery, key-value store, bot defence (Turnstile), logging, possibly audience measurement
Anthropic PBC: processing of chat input in the AI coach
Resend, Inc.: sending the confirmation email for the founding list, where enabled

Processing agreements under Art. 28 GDPR: [ENTER STATUS OF THE DPAs PER PROVIDER]

There are no other recipients. In particular we do not pass on data for advertising purposes and we do not sell data.

5. Transfers to third countries

Cloudflare, Anthropic and Resend are based in the USA and process data partly there. Possible bases are standard contractual clauses under Art. 46 (2) (c) GDPR and/or certification under the EU-US Data Privacy Framework.

Specific basis per provider: [CHECK AND ENTER PER PROVIDER: SCC OR DATA PRIVACY FRAMEWORK]

6. Special categories of personal data (Art. 9 GDPR)

We do not collect health data. Academy progress consists of points per learning area and stays on your device; it says nothing about your physical condition. Flashcard answers are evaluated on your device and not transmitted.

The only place where health data could arise is the AI coach — because you can write freely there. Hence the note under point 3 e): please do not enter details about injuries, diagnoses or body metrics.

7. No automated decision-making

There is no automated decision-making within the meaning of Art. 22 GDPR and we do not build profiles of your behaviour. The AI coach's answers are information, not a decision about you.

8. Your rights

You have the following rights vis-à-vis the controller:

Access (Art. 15) — what data we process about you
Rectification (Art. 16) — correction of inaccurate data
Erasure (Art. 17) — see data deletion
Restriction of processing (Art. 18)
Data portability (Art. 20) — you can additionally export your learning progress as a file from within the Academy
Objection (Art. 21) to processing based on legitimate interests
Withdrawal of consent (Art. 7 (3)) with effect for the future

A message to hello@trongo.net is enough.

Right to lodge a complaint

Independently of this, you may lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

9. Minors

The service is aimed at people aged 14 and over (§ 4 (4) DSG). Consent by younger people requires the approval of their legal guardian.

Age check before paid offerings: [DECIDE BEFORE LAUNCH]

10. Obligation to provide data

You are not obliged to provide us with data. Without an email address, however, we cannot inform you about the launch; without the local entries under point 3 b) learning progress cannot be saved. All learning content is usable without signing up.

Version: 2 August 2026 · draft v2 (rewritten under Art. 13 GDPR on the basis of a code audit). Added compared with v1: on-device storage in detail, bot defence, audience measurement, Art. 9 clarification, Art. 22, retention periods and the obligation to provide data. Future changes will be logged here with a date.

← Back to the home page