Privacy policy

1. Who is responsible

Responsible for your data (the "controller" under the GDPR) is: Dimitrios Kolovos Turnstr. 10 90763 Fürth, Germany

Email: [email protected] · Contact page: www.runbriel.com/contact

A data protection officer is not required (fewer than 20 people regularly process personal data, § 38 BDSG) and has not been appointed.

2. This website

You don't need an account to read www.runbriel.com, and we don't ask you for anything.

• Server logs: whenever a page is opened, our hosting provider Cloudflare automatically processes your IP address, the date and time, the page, and information about your browser and device. This is needed to deliver the website and to protect it against attacks and misuse. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR. The logs are kept only for a short time by Cloudflare.
• Language: if you choose a language in the menu, your browser stores that choice (cookie “locale”) so that runbriel.com opens in that language next time. Otherwise the language is taken from your browser's settings.
• Contact by email: if you write to us, we use your email address and message to answer you. Legal basis: Art. 6(1)(b) GDPR where it concerns a contract, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR.
• Links to Instagram and Facebook: these are plain links. No data goes to Meta when you visit our website; only when you click a link do you go to Meta, where Meta's privacy policy applies.
• No analytics, no tracking, no advertising networks, no embedded videos or maps. The fonts come from our own server; your browser does not connect to Google Fonts.

3. The Runbriel app: what is stored, and why

The Runbriel app for Android is currently not open to new users: no new accounts can be created. This part applies to the existing accounts.

• Account: your email address, how you log in (email or Google), technical IDs, and when you accepted the Terms of Use. Needed to log you in. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).
• Login with Google: if you choose this, Google Ireland Limited sends us your name, email address and profile picture. Google also learns that you use Runbriel. Google's own privacy policy applies. Legal basis: Art. 6(1)(b) GDPR.
• Profile: name, profile photo, date of birth, gender, country, language, units (km or miles), whether you prefer pace or effort targets, and the personal bests you enter. Used to build plans that fit you (for example paces and age) and to show your profile. Your profile photo can be opened by anyone who has its exact link. Legal basis: Art. 6(1)(b) GDPR.
• Injury history (health data): only if you tick the consent box. Used to make your plan more careful. Legal basis: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time under Account → Profile; the information is then deleted.
• Plans and training: your plan answers (goal, experience, weekly distance, run days, race date, a recent race time), the plan Runbriel builds, changes you make (moved or postponed workouts), workouts you mark as done or skipped with the optional distance, time, pace, effort and notes, your own plan's workouts and extra runs. Legal basis: Art. 6(1)(b) GDPR.
• Runs recorded with the app (location): while you record a run, the app uses your phone's precise location (GPS), also with the screen off. The route and the GPS points stay on your phone and are not sent to us. Only the totals (distance, time, pace) and what you enter (effort, notes) are saved to your account. Legal basis: Art. 6(1)(b) GDPR. You can refuse or withdraw location access in your phone's settings; recording then doesn't work.
• Health Connect (watch data): only if you connect it. The app then reads from Android's Health Connect your workouts (type, date, time, distance), steps and heart rate – if you allow it, also in the background about once an hour. Workouts that are added to Runbriel are saved to your account with distance, time and pace, and in the notes the app they came from and, if available, the average heart rate and step count. Today's steps are only shown on your phone and not stored. Heart rate can be health data, so the legal basis is your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR, which you give when you connect. You can withdraw it at any time in the Health Connect settings; workouts already saved stay until you delete them. Runbriel only reads and never writes to Health Connect.
• Heart rate strap (Bluetooth): only if you pair one under Watches & apps. While you record a run with the app, it receives the strap's heart rate over Bluetooth and keeps one value per second with the run on your phone; it shows it live, and afterwards the average, maximum, a chart and the time in your heart-rate zones. The strap's name and Bluetooth identifier are also kept on your phone only. None of this is sent to us. The Bluetooth permission ("Nearby devices") is used only to find and connect the strap, never for your location. Heart rate is health data: the legal basis is your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR, which you give by pairing a strap. You can withdraw it at any time by tapping Forget; heart rate kept with earlier runs is deleted with those runs on your phone.
• Heart rate and numbers from your watch (Health Connect): to show the heart rate of a watch run again (chart, maximum, zones), the app keeps the run's start and end time and the app that wrote it on your phone and reads that heart rate from Health Connect when you open the run – it isn't sent to us. If your watch recorded the same run as Runbriel, the watch's distance, time, pace and average heart rate replace the phone's numbers in your account, so they match your watch. Legal basis: as for Health Connect above.
• Data from Health Connect is used only to show and log your training in Runbriel. It is never sold, never used for advertising, never passed on to anyone else, and never used to decide on credit, insurance or employment.
• Reminders: workout reminders and the monthly recap are scheduled and shown by your phone. No push service is used, and nothing about them is sent to us.
• Crash reports: if the app crashes or hits an error, a report goes to Sentry: the error and where in the code it happened, the app version, the phone model and the Android version. It contains no name, email address or location, and IP addresses are not stored. Used only to find and fix errors. Only if you switch it on (off by default; asked once, after your first run). Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG; you can withdraw it at any time in the app (My account → Help improve Runbriel).
• Emails: Runbriel sends you a confirmation email, password-reset emails when you ask for them, and one welcome email. There is no newsletter and no marketing email. Legal basis: Art. 6(1)(b) GDPR.
• On your phone: the app keeps your login, your settings (such as language, reminders and light or dark appearance), recorded runs with their GPS points, and the daily check-in on your phone only. They are deleted when you uninstall the app or clear its data.
• Route map: when you open a run's summary, the map pictures (tiles) for that area are loaded from OpenStreetMap and the map program (Leaflet) from Cloudflare's cdnjs. They receive your IP address and which map area is shown; the route itself stays on your phone. Legal basis: our legitimate interest in showing you your route, Art. 6(1)(f) GDPR.
• Phone calendar: only if you switch it on, the app writes your planned workouts into a “Runbriel” calendar on your phone. Nothing about it is sent to us.
• Feedback in the app: your message, your email address and – unless you switch it off – the app version, phone model, Android version and language. Used to answer you and to fix problems. Legal basis: Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR.
• Races and shoes: the races you add (name, date, place, distance, target time and pace, notes) and your shoes (brand, model, colour, nickname, first used, distance so far, goal) and which run was done in which shoes. Used to show your countdown, your target pace and each pair's kilometres. Legal basis: Art. 6(1)(b) GDPR.
• Best times you add by hand: the distance, your time and, if you enter them, the date and the race or place. Used to show your best times and ranking next to the ones found in your runs. Legal basis: Art. 6(1)(b) GDPR.
• Share pictures and stickers: made on your phone from your run or month. They are only saved or shared when you choose to, through your phone's share menu or photo gallery; nothing about them is sent to us.
• Postponing your plan (illness or injury): only the length of the break and the new dates of your workouts are saved. The reason is not asked for or saved.
• Help improve GPS (only if you switch it on; off by default): after each run, a summary without location – phone model and Android version, app version, the day of the run (no time), duration, distance, how many GPS points were good, inaccurate or jumps, signal gaps, app restarts and GPS accuracy – and when you switched it on. “Report a problem with this run” (only when you tap it and send it): that run's GPS points (your route), the recording log and your note. Used only to find and fix GPS problems. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG; you can withdraw it at any time in the app (My account → Help improve Runbriel). Summaries are kept for 12 months and reports for 90 days; both are deleted with your account.
• After a 0 to 5K run, the app asks whether something hurt. That answer is only used on your device to show advice at that moment. It is never sent to us and never stored.
• Weather in the workout brief: when you open the briefing (“Read more”) of today's or tomorrow's workout, the app asks MET Norway for that day's forecast with a rounded location (about 10 km, from the phone's last known position; the app never asks for your location just for this). MET Norway receives that rounded location and your IP address. Legal basis: our legitimate interest in giving you useful advice, Art. 6(1)(f) GDPR.
• Welcome back plan (health data): only if you create one and tick the consent box – why you stopped running (illness, injury, pregnancy), the kind and place of an injury, and the safety checks you confirmed. Used only to build that plan. Legal basis: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. Deleted when you delete the plan or your account; you can withdraw your consent at any time by deleting the plan.
• Moving time and heart-rate zones: the app works out on your phone how long you were moving (stops such as traffic lights left out), and for runs with a heart-rate recording, the time in each of your heart-rate zones. Your zone settings (zone limits or maximum heart rate) stay on your phone and are not sent to us; if you use the estimate, it is worked out from the date of birth in your account. The time saved to your log is the moving time if you stopped for 10 seconds or more, otherwise the whole time (race runs: always the whole time). Legal basis for runs: Art. 6(1)(b) GDPR; for heart-rate data, the consent you gave when you connected your watch (see Health Connect).
• Pictures in the guides: the app loads the pictures of the help guides from runbriel.com when you open a guide. Our hosting receives your IP address, as with any visit to our website. Legal basis: our legitimate interest in showing you how the app works, Art. 6(1)(f) GDPR.

4. Cookies and browser storage

This website sets only the language cookie described above, and only when you choose a language. The app's web pages on app.runbriel.com use cookies that keep you logged in, if you log in there.

There are no tracking, advertising or analytics cookies, so no consent banner is needed (§ 25(2) TDDDG).

5. Service providers and where your data is

These companies work for Runbriel and may process your data on its behalf:

• Supabase, Inc. (USA): database, login and photo storage. Your data is stored in a data centre in Ireland (EU).
• Vercel Inc. (USA): hosting of the app's server (app.runbriel.com); processes the app's requests and their server logs.
• Cloudflare, Inc. (USA): hosting of this website (Cloudflare Pages) and the runbriel.com domain; delivers the pages, processes the server logs and passes the app's requests on to its server.
• Google: login with Google.
• Zoho Corporation B.V. (Netherlands): the mailboxes for @runbriel.com addresses (Zoho Mail), with the emails stored in the EU.
• Functional Software, Inc. (Sentry, USA): crash reports from the app, stored in a data centre in Germany (EU).
• Plus Five Five, Inc. (Resend, USA): sends Runbriel's emails (confirmation, password reset, welcome).
• 650 Industries, Inc. (Expo, USA): delivers app updates; processes your IP address and basic device information when the app checks for an update.
• Google: Health Connect runs on your phone and is run by Google; the app is delivered through Google Play. Their own privacy policies apply.
• OpenStreetMap Foundation (United Kingdom): map tiles for the route map. The United Kingdom has an EU adequacy decision (Art. 45 GDPR).
• Norwegian Meteorological Institute (MET Norway, Norway): weather forecast for the workout brief. Norway is part of the European Economic Area (EEA), where the GDPR applies.

Where data goes to the USA, this is based on the EU-U.S. Data Privacy Framework for certified companies (Art. 45 GDPR) and/or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. How long your data is kept

As long as you have an account. When you delete your account, your account, profile, photo, plans, logged workouts, own workouts and extra runs are deleted straight away. Copies can remain in the providers' backups for a short time until they are overwritten.

Contact messages and emails are deleted once your request is dealt with, at the latest after 12 months.

How to delete your account: see Delete your data.

Crash reports are deleted automatically after 90 days at the latest.

Help improve GPS: summaries are deleted after 12 months, run reports after 90 days.

7. Your rights

• Access to your data (Art. 15 GDPR)
• Correction (Art. 16 GDPR)
• Deletion (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawing consent at any time, for the future (Art. 7(3) GDPR)

Just write to [email protected] (see also the contact page).

You can also download a copy yourself at any time: in the app under Account → Download my data (plans, logged workouts and settings as a JSON file; runs recorded in the app as GPX).

You can also complain to a data protection authority, for example the one where you live, or the one responsible for Runbriel: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. In Greece: Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens.

8. Other points

• You need an email address (or a Google account) to use the app. Everything else is optional or only needed for the plan you choose.
• There are no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Plans are built by fixed rules from your answers, and you can change everything.
• The app is meant for people aged 18 and over (a plan can only be created from 18).
• If this policy changes, the new version is published here with a new date.
• How your data is protected: all connections are encrypted (HTTPS); the database only lets each account read and change its own data; passwords are stored only as secure hashes by the login service; your account data is stored in the EU (Ireland).