Privacy Policy
1. Who we are
nalolabs ("we", "us", "our") is an independent app studio based in Belgium. We build apps for people who care about music, live events, and personal experiences — PoolPace among them.
For the purposes of the EU General Data Protection Regulation (GDPR), nalolabs is the data controller for personal data processed through our apps. Contact: privacy@nalolabs.be.
2. What this policy covers
This policy applies to all apps published by nalolabs. Where a specific app collects data beyond what's described here, a supplementary in-app notice makes that clear before any data is collected.
PoolPace, specifically: the app is a local-network remote control for the EVAStream pool exercise jet — commands go straight to your own jet controller over your home Wi-Fi, never through nalolabs' servers. PoolPace has no account and no cloud sync. It can optionally send your pool's coordinates to the Open-Meteo weather API for a forecast, and can receive "Hey Google" voice commands via Google Assistant — voice recognition happens entirely on Google's side under Google's own privacy policy, and PoolPace only ever receives the resulting command (e.g. "start" or "stop"), never the audio itself.
This policy also covers the PoolPace website (the coming-soon page this policy is linked from). The only data it collects is the email address you optionally submit via the "notify me" signup form, sent directly to our newsletter provider, Buttondown (see §5.2) — used solely to email you when the app launches.
3. What data we collect and why
3.1 Data you provide directly
Depending on the app, this may include:
- A display name or username you choose
- User-generated content — notes, ratings, annotations and lists
- Preferences and settings you configure (in PoolPace: your pool controller's IP address, the cover-interlock preference, and your pool's location for weather)
This data powers the core features of the app. In apps with no account or cloud sync — PoolPace included — it stays entirely on your device; we have no access to it.
3.2 Data collected when you sign in
PoolPace does not offer account sign-in. There's no cloud sync, and nothing about you is linked to an identity.
3.3 Data we do not collect
We do not collect, request, or access:
- Your physical location (precise or approximate) — except the approximate location PoolPace reads once, on-device, if you explicitly tap "use current location" to pre-fill your pool's coordinates for weather (§3.1)
- Your contacts or address book
- Payment card details (handled entirely by the platform's payment system)
- Microphone, camera, or media files
- Browsing history or installed apps
- Any data from children under 13
3.4 No analytics or advertising SDKs
Our apps do not include analytics SDKs, advertising SDKs, or crash-reporting SDKs that send data to third parties. We do not track you across apps or websites.
4. How we use your data
We use your data only for:
- App functionality — delivering the features you use
- Account management — linking your data to your account for sync and continuity
- Service communication — essential notices about your account or the app
- Security — detecting and preventing abuse
We do not use your data to build advertising profiles, make inferences about sensitive characteristics, or make automated decisions with significant effects on you.
PoolPace, specifically: only App functionality and Security apply. There's no account to manage and no account-related communications — PoolPace has no account or cloud sync (§3.2).
5. How we share data
5.1 We do not sell personal data. Ever.
5.2 Infrastructure providers
We use the following third-party services to operate our apps. These providers act as data processors under our instruction and do not use your data for their own purposes:
| Service | Role |
|---|---|
| Firebase (Google) | Authentication, cloud storage, push notifications — where applicable per app |
| Google Play | App distribution and payment processing |
| Your EVAStream jet controller (PoolPace) | Lives on your own local network — command traffic never reaches nalolabs |
| Open-Meteo (PoolPace) | Retrieves a weather forecast for the coordinates you set — no identity attached |
| Buttondown (PoolPace website) | Stores the email address you submit via the "notify me" form and sends the one-off launch announcement — no other data attached |
5.3 Commercial partners
Where an app lets commercial partners (such as event organisers or content creators) reach users through the platform, our commitment is:
- Partners never receive personal data. No names, email addresses, or device identifiers are shared.
- Analytics are aggregate and anonymised. Partners see numbers, not individuals; segments below a minimum size are suppressed.
- Messages are delivered by us. A partner composes content; we deliver it. The partner never sees who received it.
- You control who can reach you. Any partner-initiated communication requires your explicit opt-in, withdrawable any time in settings.
This is a core principle that will not change without prominent prior notice and your explicit consent.
5.4 Legal requirements
We may share data when required by law, to protect our legal rights, or in the event of a merger or acquisition — in which case this policy continues to apply.
6. Deleting your data
- On-device data: clear it from within the app, where the app offers a clear-data control, via your device's system Settings → Apps → [app name] → Clear storage, or by uninstalling the app. PoolPace specifically: the app has no in-app "clear data" control — use system Settings → Apps → PoolPace → Clear storage, or uninstall.
- Cloud data and account (where applicable): delete your account from within the app (Settings → Delete account). This permanently removes all associated cloud data. Not applicable to PoolPace — the app has no account or cloud data.
- Newsletter signup (PoolPace website): every email from us includes an unsubscribe link, which removes your address from Buttondown immediately.
- By request: email privacy@nalolabs.be with the subject
Data Deletion Request. We confirm deletion within 30 days.
7. Data retention
| Data type | Retention |
|---|---|
| On-device data | Until you clear it or uninstall the app |
| Newsletter email address (PoolPace website, in Buttondown) | Until you unsubscribe or the launch announcement is sent, whichever comes first |
| Pool location for weather (PoolPace, on-device) | Until you change or clear it |
8. Your rights under GDPR
If you are in the European Economic Area (EEA), you have the right to:
- Access — request a copy of your personal data
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data
- Portability — receive your data in a portable, machine-readable format
- Restriction — ask us to limit how we process your data
- Object — object to processing based on legitimate interests
- Withdraw consent — for processing based on consent (e.g. notifications), any time, without affecting prior processing
Contact privacy@nalolabs.be to exercise any of these rights; we respond within 30 days.
To lodge a complaint, contact the Belgian Data Protection Authority: www.dataprotectionauthority.be.
Legal bases for processing (GDPR Article 6)
| Processing activity | Legal basis |
|---|---|
| Core app functionality | Contract |
| Cloud sync | Contract |
| Push notifications | Consent |
| Community / social features | Consent |
| Aggregate partner analytics | Legitimate interests (anonymised data is outside GDPR scope) |
| Newsletter signup (PoolPace website) | Consent |
PoolPace, specifically: only Core app functionality applies within the app itself — there's no cloud sync, push notifications, or community/social features. The website's newsletter signup runs on Consent, separately from the app.
9. Security
We apply measures appropriate to the risk:
- All data in transit is encrypted (TLS)
- Cloud data is protected by security rules that restrict access to the account owner, where an app has cloud data — not applicable to PoolPace, which has none
- No personal data is logged in production builds
- Local sensitive data uses Android Keystore encryption where applicable
To report a security issue: privacy@nalolabs.be.
10. Children's privacy
Our apps are not directed at children under 13, and we do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we'll delete it promptly.
11. Changes to this policy
Material changes — particularly to how we share data — are communicated via in-app notice at least 30 days before taking effect. Minor clarifications are reflected in the "last updated" date above.
12. Contact
nalolabs — Belgium
Email: privacy@nalolabs.be
For GDPR requests, use the subject line: GDPR Request — [request type].