Privacy Policy

1. Privacy at a glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

Data collection on this website

Who is responsible for data collection on this website?
Kristian Hoffmann
Karl-Kraut-Straße 15, 30177 Hannover
Email: moin [at] kristianhoffmann.de
Phone: 0151 15538987

2. Hosting and Data Processing

External Hosting

The website is delivered by Vercel Inc. Database, authentication and storage run on a self-hosted Supabase installation on a server in Germany.

Vercel Inc.
Vercel Inc., USA. Technical delivery logs may be processed outside Germany.
Privacy policy: https://vercel.com/legal/privacy-policy

Self-hosted Supabase
Database, authentication and file storage run on our own server infrastructure in Germany. Supabase Inc. does not process production data in this setup.

Brevo SAS
Brevo SAS, France. Brevo processes email addresses and delivery metadata for authentication and transactional emails.
Privacy policy: https://www.brevo.com/legal/privacypolicy/

GitHub
Source code and deployment metadata are managed with GitHub. GitHub does not receive training or health data from the Supabase database.

3. Payment Processing

For payment processing, we use the service Stripe: Stripe:

Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irland
Privacy policy: https://stripe.com/de/privacy

The following data is transmitted to Stripe during payment processing:

• Email address
• Payment information (credit card data)
• IP address
• Transaction data

The transmission is based on Art. 6 para. 1 lit. b GDPR (contract fulfillment) and Art. 6 para. 1 lit. f GDPR (legitimate interest in secure payment processing).

4. Health-related Data (Art. 9 GDPR)

This app processes special categories of personal data (health data):

• Heart rate data
• Lactate values
• Training performance data (pace, watts)
• Calculated threshold values (LT1, LT2, VLamax)

Legal basis: The processing is carried out exclusively on the basis of your explicit consent pursuant to Art. 9 para. 2 lit. a GDPR, which you give by using the app and entering your data.

Purpose: The data is used exclusively for calculating and displaying your individual training analysis.

Retention period: Your health data is stored as long as your account is active. Upon account deletion, all data will be completely deleted within 30 days.

No sharing: Your health data is never sold to third parties or used for advertising purposes.

5. Your Rights

You have the right at any time to:

• Access (Art. 15 GDPR) to your stored data
• Rectification (Art. 16 GDPR) of inaccurate data
• Deletion (Art. 17 GDPR) of your data
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) to processing
• Withdrawal of consent granted (Art. 7 para. 3 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

Responsible supervisory authority: The State Commissioner for Data Protection Lower Saxony Prinzenstraße 5, 30159 Hannover, Germany

6. Cookies and Tracking

This website uses only technically necessary cookies and local storage for:

• Authentication (session cookies)
• Language settings (localStorage)
• Theme settings (localStorage)
• Anonymous session ID for internal statistics (localStorage, no link to personal data)

In addition to the technically necessary mechanisms above, we use the web-analytics and conversion-tracking services described in section 7.

7. Web Analytics and Conversion Tracking

To measure reach and improve our offering, we use Google Analytics only after explicit consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 uses cookies and similar technologies to analyse use of the website.

The Google Analytics tag is loaded only after consent. Advertising personalisation signals and Google Signals are disabled. Google states that GA4 does not log or store individual IP addresses from EU users.

Retention: maximum 14 months. Data is automatically deleted thereafter.
Transfer of personal data to the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework.

You can prevent collection by Google Analytics by installing the browser add-on: https://tools.google.com/dlpage/gaoptout

Provider privacy policy: https://policies.google.com/privacy

Meta Pixel (Facebook Pixel)

When enabled, this website uses the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The Meta Pixel allows measurement of conversions from ads on Facebook and Instagram and the creation of custom audiences.

Transfer of personal data to the United States to Meta Platforms, Inc. cannot be ruled out.

You can object via the ad settings of your Facebook account or via youronlinechoices.eu.

Provider privacy policy: https://www.facebook.com/policy.php

8. SSL/TLS Encryption

This site uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by the lock symbol in your browser's address bar.