Privacy Policy
Datenschutzerklärung — in accordance with the GDPR
Data Controller
The data controller within the meaning of the GDPR is:
Chris RoweAbt.-Al497 Mailbox Germany GmbH,
Am Saalehang 4,
Merseburg 06217
moc.liamg@sbal.eihcetdael
What We Process & Why
- Account registration & management — Art. 6(1)(b) GDPR (contract performance)
- Competition participation & activity logging — Art. 6(1)(b) GDPR (contract performance)
- Leaderboards & team assignment — Art. 6(1)(b) GDPR (contract performance)
- Email dispatch (password reset, verification) — Art. 6(1)(b) GDPR (contract performance)
- Technically necessary cookies & session management — Art. 6(1)(f) GDPR (legitimate interest)
- Analytics cookies (e.g. Google Analytics) — Art. 6(1)(a) GDPR (consent), only with your explicit opt-in
- Strava activity import (optional) — Art. 6(1)(a) GDPR (consent). When you connect your Strava account, we access activity data (activity type, activity title, distance, moving time, elevation gain, start time) solely to create scored competition entries. We do not access or store GPS positions, route maps, photos, or device information. Raw Strava data is cached for no more than 7 days and then deleted by a scheduled job; scored entries contain only derived values and are retained as platform data.
Sub-Processors
Supabase Inc.
Purpose: Database hosting & authentication
Location: EU (Frankfurt, eu-central-1)
Transfer basis: Standard Contractual Clauses (SCC)
Vercel Inc.
Purpose: Web hosting & edge functions
Location: EU (Frankfurt, fra1)
Transfer basis: Standard Contractual Clauses (SCC)
Strava, Inc.
Purpose: Activity data import (optional, with your consent)
Location: USA
Transfer basis: Standard Contractual Clauses (SCC)
Data accessed: activity type, activity title, distance, moving time, elevation gain, start time. Raw data cached ≤ 7 days; scored entries contain only derived values.
Strava may collect and use usage data relating to our access to the Strava API (for example request volumes and error rates) in accordance with the Strava API Agreement and Strava's own Privacy Policy.
Functional Software, Inc. (Sentry)
Purpose: Error monitoring for the web application
Location: USA (EU data residency where available)
Transfer basis: Standard Contractual Clauses (SCC)
Data: technical error reports (stack traces, request metadata). Access tokens and Strava activity content are scrubbed before sending.
Google LLC (Google Sheets — database backup)
Purpose: Periodic backup of platform tables, run by the operator
Location: EU data processing available
Transfer basis: Standard Contractual Clauses (SCC)
Data: platform records including scored competition entries (derived values only). Cached Strava data and access tokens are never included in backups.
Google LLC (Google Analytics)
Purpose: Website analytics (only with your consent)
Location: EU data processing available
Transfer basis: Standard Contractual Clauses (SCC)
Your Rights
Under the GDPR you have the right to:
- Access your data (Art. 15)
- Rectification (Art. 16)
- Erasure / "right to be forgotten" (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
To exercise any of these rights, contact us using the details above. You also have the right to lodge a complaint with your local data protection authority.
Data Retention & Deletion
- Account data: stored for the duration of the user relationship
- Activity data: stored for the duration of the competition plus 12 months
- On account deletion: personal data is anonymised (display name replaced, email removed). Activity data is retained in anonymised form for leaderboard integrity.
- Strava raw data: cached for no more than 7 days after import. Automatically purged when the cache retention period expires, when you disconnect your Strava account, or when you revoke access via Strava's own settings. Scored competition entries (derived values only) are retained for the competition lifecycle.
Cookies & Consent
This platform uses technically necessary cookies for session management and authentication. These cannot be disabled.
Analytics cookies are only set with your explicit consent via the cookie banner. You can withdraw consent at any time. We use the Consent Mode v2 protocol to ensure no analytics data is collected without your permission.
Changes to This Policy
We may update this privacy policy from time to time. The current version is always available on this page.