Privacy policy

1. Who is responsible

Responsible for your data (the "controller" under the GDPR) is: Dimitrios Kolovos Turnstr. 10 90763 Fürth, Germany

Email: privacy@runbriel.com · Contact form: www.runbriel.com/contact

Runbriel is a private, non-commercial project. A data protection officer is not required and has not been appointed.

2. What is stored, and why

• Account: your email address, how you log in (email, Google or Facebook), technical IDs, and when you accepted the Terms of Use. Needed to log you in. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).
• Login with Google or Facebook: if you choose this, Google Ireland Limited or Meta Platforms Ireland Limited sends us your name, email address and profile picture. They also learn that you use Runbriel. Their own privacy policies apply. Legal basis: Art. 6(1)(b) GDPR.
• Profile: name, profile photo, date of birth, gender, country, language, units (km or miles), whether you prefer pace or effort targets, and the personal bests you enter. Used to build plans that fit you (for example paces and age) and to show your profile. Your profile photo can be opened by anyone who has its exact link. Legal basis: Art. 6(1)(b) GDPR.
• Injury history (health data): only if you tick the consent box. Used to make your plan more careful. Legal basis: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time under Account → Profile; the information is then deleted.
• Plans and training: your plan answers (goal, experience, weekly distance, run days, race date, a recent race time), the plan Runbriel builds, changes you make (moved or postponed workouts), workouts you mark as done or skipped with the optional distance, time, pace, effort and notes, your own plan's workouts and extra runs. Legal basis: Art. 6(1)(b) GDPR.
• Daily check-in: your answers about sleep, energy and pain are worked out in your browser only. They are never sent to us and never stored. The reason for a postponed plan is not stored either.
• Leaderboard: only if you switch it on. Your first name, country, league and points are then shown to other signed-in runners who also take part. Legal basis: your consent, Art. 6(1)(a) GDPR. You can switch it off at any time.
• Contact form and email: your name, email address and message, to answer you. Legal basis: Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR.
• Server logs: whenever a page is opened, the hosting provider automatically processes your IP address, the date and time, the page and information about your browser. This is needed to deliver the website and to protect it against attacks. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR. These logs are kept only for a short time by the hosting provider.

3. Cookies and browser storage

Runbriel only uses what is technically necessary: cookies that keep you logged in, and a setting that remembers your language if you change it. While you fill in the plan form, your browser keeps an unfinished draft (and whether you closed a notice) in its session storage; this disappears when you close the tab.

There are no tracking, advertising or analytics cookies, so no consent banner is needed (§ 25(2) TDDDG).

4. Service providers and where your data is

These companies work for Runbriel and may process your data on its behalf:

• Supabase, Inc. (USA): database, login and photo storage. Your data is stored in a data centre in Ireland (EU).
• Vercel Inc. (USA): hosting; delivers the pages and processes the server logs.
• Cloudflare, Inc. (USA): manages the runbriel.com domain and forwards emails sent to @runbriel.com addresses.
• Google: login with Google; emails sent to @runbriel.com addresses are forwarded to a Google (Gmail) mailbox.
• Meta: login with Facebook.

Where data goes to the USA, this is based on the EU-U.S. Data Privacy Framework for certified companies (Art. 45 GDPR) and/or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The fonts are delivered from Runbriel's own server. Your browser does not connect to Google Fonts.

5. How long your data is kept

As long as you have an account. When you delete your account, your account, profile, photo, plans, logged workouts, own workouts and extra runs are deleted straight away. Copies can remain in the providers' backups for a short time until they are overwritten.

Contact messages and emails are deleted once your request is dealt with, at the latest after 12 months.

How to delete your account: see Delete your data.

6. Your rights

• Access to your data (Art. 15 GDPR)
• Correction (Art. 16 GDPR)
• Deletion (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawing consent at any time, for the future (Art. 7(3) GDPR)

Just write to privacy@runbriel.com or use the contact form.

You can also complain to a data protection authority, for example the one where you live, or the one responsible for Runbriel: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. In Greece: Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens.

7. Other points

• You need an email address (or a Google or Facebook account) to use Runbriel. Everything else is optional or only needed for the plan you choose.
• There are no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Plans are built by fixed rules from your answers, and you can change everything.
• Runbriel is meant for people aged 18 and over (a plan can only be created from 18).
• If this policy changes, the new version is published here with a new date.