Privacy policy
In force since
Controller: [PENDIENTE: razón social], [PENDIENTE: domicilio fiscal]. Contact for data protection: [PENDIENTE: correo de contacto].
Two kinds of data that need saying out loud
Health data. Heart rate, weight, height, training load, perceived effort, and any nutrition document a professional uploads for you. Under Article 9 GDPR this is a special category, and it is processed on the basis of your explicit consent, given as a separate checkbox when you register. You can withdraw it by deleting your account.
Location data. An activity file usually contains a GPS trace with timestamps. That reveals where you live, the route you take and the hours you are out. It is processed to show you your own activity on a map and to compute distance and elevation, and for nothing else.
What is stored, and where
- Your account: email, display name, language, password (hashed with Argon2id - it is never stored in a form anybody can read back).
- Your profile: date of birth, sex if you gave it, weight, height, maximum and resting heart rate, threshold power.
- Your activities: the derived metrics, the per-sample series, and the original file exactly as you uploaded it, kept so a future improvement to the importer can read it again.
- Nutrition documents a professional uploads for you, in a separate folder from your activity files.
- Sessions: refresh tokens, with the browser's user-agent string. No IP address is stored.
Everything is held on the server that runs this deployment: [PENDIENTE: ubicación del servidor y proveedor]. Files are written under a folder per account with a server-generated name; the name you uploaded is kept only as metadata to show you.
Who can see it
You, and the staff of the organisation your account belongs to. Athletes never see each other's data. Every query is narrowed to your account before it reaches the database, and there is no endpoint that lists one person's activities or nutrition documents to another.
No data is sold, and there is no advertising, profiling or automated decision-making.
How long
For as long as your account exists. Deleting an activity deletes its stored file with it, immediately and irreversibly. Deleting your account removes your rows, your uploaded files and your sessions. [PENDIENTE: plazos de conservación exigidos por obligación legal, si los hubiera].
Your rights
Access, rectification, erasure, restriction, portability and objection. Two of them are buttons rather than emails: Export my data gives you a ZIP with your original files plus a JSON of your profile and derived data, and Delete my account does what it says. For the rest, write to [PENDIENTE: correo de contacto]. You may also complain to the Agencia Española de Protección de Datos.