Goome — Privacy Policy

Privacy Policy

Version: 1.0 · Last updated: 31-05-2026

What you need to know

Goome detects your posture through your webcam and gives you real-time on-screen corrections. The most important thing about how we built it:

Your webcam feed never leaves your device. Video frames, images, and facial data are processed entirely on your own computer. We do not store them, we do not transmit them, and no one at Goome, or anywhere else, ever sees what your camera sees.

What we do receive is a small set of numerical scores: how long your session was, how often your posture was good or bad, account information, and basic technical data needed to run the service. That's it.

1. Who we are

Goome (eenmanszaak), KvK 42005126, VAT NL005427719B93. Postbus 134, 7900 AC Hoogeveen, The Netherlands. Contact: support@goome.app

We are the data controller for the personal data described in this policy.

2. What we collect

What stays on your device, always

• Raw webcam frames
• Facial landmarks and skeletal keypoints used to detect your posture
• Real-time posture classifications

None of this is ever transmitted, stored, or shared. It exists only in your computer's memory while Goome is running.

What we receive from your device

• Account data: name, email, hashed password, language preference, account creation date
• Session metrics: session start and end times, total active minutes, number of sessions, posture-quality scores, number and type of on-screen corrections, your response to them, app version
• Technical and security data: IP address, operating system, app version, login timestamps, an app instance identifier, failed login attempts
• Support communication: anything you send us when contacting support
• Payment metadata: subscription plan, invoice history. Card and bank details are handled directly by Stripe and never visible to us
• Marketing engagement (only if you opt in): opens and clicks on emails

What we don't collect, ever

• Webcam images or video
• Audio or voice
• Location data
• Contacts or address book
• Financial details (handled by Stripe)
• Anything you do outside of Goome

3. Why we use this data

• Running the service and your account — Performance of contract
• Processing payments and keeping financial records — Contract / legal obligation
• Customer support — Performance of contract
• Security, fraud prevention, abuse detection — Legitimate interest
• Improving the product based on aggregated metrics — Legitimate interest
• Sending marketing about Goome — Consent (or "soft opt-in" for existing customers, Art. 11.7 Telecommunicatiewet)

You can object to processing based on legitimate interests at any time (see section 8).

4. A note on webcam data

Goome uses your webcam, but it doesn't try to identify you. Our on-device processing extracts skeletal keypoints and facial landmarks to detect posture in real time. We don't match these against any database, don't generate a biometric template that could re-identify you elsewhere, and don't store or transmit them.

Because this data is processed only on your own device, only for posture detection, and never with the purpose of uniquely identifying you, it falls outside the scope of Article 9 GDPR.

5. Who else processes your data

We use Stripe for payments and billing, Amazon Web Services for app hosting, database and storage, Squarespace for website hosting, Loops.so for email delivery, Web3forms.com for contact form submissions, Google Workspace for internal email and documents, Cookiebot for cookie consent management, and Capisoft B.V. for software development and production operations. If we add or replace a sub-processor, we update this list and notify affected users where required.

6. International transfers

We aim to keep your data inside the EU/EEA. Where we use providers based outside the EU, we rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses with supplementary measures where appropriate.

7. How long we keep your data

• Account info while subscribed: duration of subscription
• Account info after cancellation: 12 months, then deleted or fully anonymised
• Usage metrics tied to your account: subscription + 12 months
• Aggregated, anonymised metrics: up to 24 months
• Invoices and tax records: 7 years
• Customer support messages: 24 months after the conversation closes
• Security and access logs: 90 days
• System backups: 90 days rolling

8. Your rights

Under the GDPR you can ask us to show, correct, delete, restrict, or port your data, object to processing based on legitimate interests, or withdraw consent. To exercise any of these rights, email support@goome.app. We respond within one month. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens or the supervisory authority in your country of residence.

9. Security

Privacy by design starts with not collecting what we don't need. In addition to on-device webcam processing, we use TLS encryption in transit, encryption at rest, strict access controls, least-privilege access, documented incident response, and notify the Dutch DPA within 72 hours where required.

10. Automated decisions, children, and changes

Goome decides automatically when to show you a posture correction. These are visual notifications and don't produce legal or similarly significant effects. Goome is for adults and we don't knowingly collect data from anyone under 18. The current version is always at goome.app/legal/privacy.

11. Contact

Email: support@goome.app
Post: Goome, Postbus 134, 7900 AC Hoogeveen, the Netherlands
Regulator: Autoriteit Persoonsgegevens