Privacy policy

1. Who is responsible

Responsible for your data (the "controller" under the GDPR) is: Dimitrios Kolovos Turnstr. 10 90763 Fürth, Germany

Email: privacy@runbriel.com · Contact form: www.runbriel.com/contact

A data protection officer is not required (fewer than 20 people regularly process personal data, § 38 BDSG) and has not been appointed.

2. What is stored, and why

• Account: your email address, how you log in (email or Google), technical IDs, and when you accepted the Terms of Use. Needed to log you in. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).
• Login with Google: if you choose this, Google Ireland Limited sends us your name, email address and profile picture. Google also learns that you use Runbriel. Google's own privacy policy applies. Legal basis: Art. 6(1)(b) GDPR.
• Profile: name, profile photo, date of birth, gender, country, language, units (km or miles), whether you prefer pace or effort targets, and the personal bests you enter. Used to build plans that fit you (for example paces and age) and to show your profile. Your profile photo can be opened by anyone who has its exact link. Legal basis: Art. 6(1)(b) GDPR.
• Injury history (health data): only if you tick the consent box. Used to make your plan more careful. Legal basis: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time under Account → Profile; the information is then deleted.
• Plans and training: your plan answers (goal, experience, weekly distance, run days, race date, a recent race time), the plan Runbriel builds, changes you make (moved or postponed workouts), workouts you mark as done or skipped with the optional distance, time, pace, effort and notes, your own plan's workouts and extra runs. Legal basis: Art. 6(1)(b) GDPR.
• Daily check-in: your answers about sleep, energy and pain are worked out in your browser only. They are never sent to us and never stored. The reason for a postponed plan is not stored either.
• Contact form and email: your name, email address and message, to answer you. Legal basis: Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR.
• Server logs: whenever a page is opened, the hosting provider automatically processes your IP address, the date and time, the page and information about your browser. This is needed to deliver the website and to protect it against attacks. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR. These logs are kept only for a short time by the hosting provider.
• Runs recorded with the app (location): while you record a run, the app uses your phone's precise location (GPS), also with the screen off. The route and the GPS points stay on your phone and are not sent to us. Only the totals (distance, time, pace) and what you enter (effort, notes) are saved to your account. Legal basis: Art. 6(1)(b) GDPR. You can refuse or withdraw location access in your phone's settings; recording then doesn't work.
• Health Connect (watch data): only if you connect it. The app then reads from Android's Health Connect your workouts (type, date, time, distance), steps and heart rate – if you allow it, also in the background about once an hour. Workouts that are added to Runbriel are saved to your account with distance, time and pace, and in the notes the app they came from and, if available, the average heart rate and step count. Today's steps are only shown on your phone and not stored. Heart rate can be health data, so the legal basis is your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR, which you give when you connect. You can withdraw it at any time in the Health Connect settings; workouts already saved stay until you delete them. Runbriel only reads and never writes to Health Connect.
• Heart rate strap (Bluetooth): only if you pair one under Watches & apps. While you record a run with the app, it receives the strap's heart rate over Bluetooth and keeps one value per second with the run on your phone; it shows it live, and afterwards the average, maximum, a chart and the time in your heart-rate zones. The strap's name and Bluetooth identifier are also kept on your phone only. None of this is sent to us. If you send a run to Strava, its heart rate goes with it. The Bluetooth permission ("Nearby devices") is used only to find and connect the strap, never for your location. Heart rate is health data: the legal basis is your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR, which you give by pairing a strap. You can withdraw it at any time by tapping Forget; heart rate kept with earlier runs is deleted with those runs on your phone.
• Heart rate and numbers from your watch (Health Connect): to show the heart rate of a watch run again (chart, maximum, zones), the app keeps the run's start and end time and the app that wrote it on your phone and reads that heart rate from Health Connect when you open the run – it isn't sent to us. If your watch recorded the same run as Runbriel, the watch's distance, time, pace and average heart rate replace the phone's numbers in your account, so they match your watch and Strava. Legal basis: as for Health Connect above.
• Data from Health Connect is used only to show and log your training in Runbriel. It is never sold, never used for advertising, never passed on to anyone else, and never used to decide on credit, insurance or employment.
• Reminders: workout reminders and the monthly recap are scheduled and shown by your phone. No push service is used, and nothing about them is sent to us.
• Crash reports: if the app crashes or hits an error, a report goes to Sentry: the error and where in the code it happened, the app version, the phone model and the Android version. It contains no name, email address or location, and IP addresses are not stored. Used only to find and fix errors. Only if you switch it on (off by default; asked once, after your first run). Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG; you can withdraw it at any time in the app (My account → Help improve Runbriel).
• Emails: Runbriel sends you a confirmation email, password-reset emails when you ask for them, and one welcome email. There is no newsletter and no marketing email. Legal basis: Art. 6(1)(b) GDPR.
• On your phone: the app keeps your login, your settings (such as language, reminders and light or dark appearance), recorded runs with their GPS points, and the daily check-in on your phone only. They are deleted when you uninstall the app or clear its data.
• Route map: when you open a run's summary, the map pictures (tiles) for that area are loaded from OpenStreetMap and the map program (Leaflet) from Cloudflare's cdnjs. They receive your IP address and which map area is shown; the route itself stays on your phone. Legal basis: our legitimate interest in showing you your route, Art. 6(1)(f) GDPR.
• Phone calendar: only if you switch it on, the app writes your planned workouts into a “Runbriel” calendar on your phone. Nothing about it is sent to us.
• Feedback in the app: your message, your email address and – unless you switch it off – the app version, phone model, Android version and language. Used to answer you and to fix problems. Legal basis: Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR.
• Races and shoes: the races you add (name, date, place, distance, target time and pace, notes) and your shoes (brand, model, colour, nickname, first used, distance so far, goal) and which run was done in which shoes. Used to show your countdown, your target pace and each pair's kilometres. Legal basis: Art. 6(1)(b) GDPR.
• Best times you add by hand: the distance, your time and, if you enter them, the date and the race or place. Used to show your best times and ranking next to the ones found in your runs. Legal basis: Art. 6(1)(b) GDPR.
• Share pictures and stickers: made on your phone from your run or month. They are only saved or shared when you choose to, through your phone's share menu or photo gallery; nothing about them is sent to us.
• Postponing your plan (illness or injury): only the length of the break and the new dates of your workouts are saved. The reason is not asked for or saved.
• Strava (only if you connect it): your Strava athlete number, the keys Strava gives Runbriel to add activities to your account, and whether runs are sent automatically. Each run sent goes to Strava with its route (GPS points), time, distance and name – apart from a run you report as a problem (see below), this is the only case in which a run's route leaves your phone, and only because you connected Strava. Runbriel doesn't read anything else from Strava. Unless you turn off “Mention Runbriel”, the description says “Recorded with Runbriel”. The Strava number of a sent run is kept on your phone for 7 days only, for the “View on Strava” link. If you remove Runbriel in your Strava settings, Strava tells Runbriel and the keys are deleted. Legal basis: Art. 6(1)(b) GDPR (the service you asked for). Disconnecting in Runbriel removes Runbriel from your Strava account and deletes the keys; runs already on Strava stay there under Strava's own terms.
• Help improve GPS (only if you switch it on; off by default): after each run, a summary without location – phone model and Android version, app version, the day of the run (no time), duration, distance, how many GPS points were good, inaccurate or jumps, signal gaps, app restarts and GPS accuracy – and when you switched it on. “Report a problem with this run” (only when you tap it and send it): that run's GPS points (your route), the recording log and your note. Used only to find and fix GPS problems. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG; you can withdraw it at any time in the app (My account → Help improve Runbriel). Summaries are kept for 12 months and reports for 90 days; both are deleted with your account.
• After a 0 to 5K run, the app asks whether something hurt. That answer is only used on your device to show advice at that moment. It is never sent to us and never stored.
• Weather in the workout brief: when you open the briefing (“Read more”) of today's or tomorrow's workout, the app asks MET Norway for that day's forecast with a rounded location (about 10 km, from the phone's last known position; the app never asks for your location just for this). MET Norway receives that rounded location and your IP address. Legal basis: our legitimate interest in giving you useful advice, Art. 6(1)(f) GDPR.
• Welcome back plan (health data): only if you create one and tick the consent box – why you stopped running (illness, injury, pregnancy), the kind and place of an injury, and the safety checks you confirmed. Used only to build that plan. Legal basis: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. Deleted when you delete the plan or your account; you can withdraw your consent at any time by deleting the plan.
• Moving time and heart-rate zones: the app works out on your phone how long you were moving (stops such as traffic lights left out), and for runs with a heart-rate recording, the time in each of your heart-rate zones. Your zone settings (zone limits or maximum heart rate) stay on your phone and are not sent to us; if you use the estimate, it is worked out from the date of birth in your account. The time saved to your log is the moving time if you stopped for 10 seconds or more, otherwise the whole time (race runs: always the whole time). Legal basis for runs: Art. 6(1)(b) GDPR; for heart-rate data, the consent you gave when you connected your watch (see Garmin and Health Connect).
• Pictures in the guides: the app loads the pictures of the help guides from runbriel.com when you open a guide. Our hosting receives your IP address, as with any visit to our website. Legal basis: our legitimate interest in showing you how the app works, Art. 6(1)(f) GDPR.
• Garmin (only if you connect it): through Garmin's official interface (Garmin Connect Developer Program), Runbriel receives your Garmin user number, the keys that let Runbriel send workouts to your Garmin account and receive your activities, and which of these permissions you granted. Workouts you send go to your Garmin Connect account (name, steps, durations or distances, target paces); there, Garmin's privacy notice applies. From your finished activities Runbriel receives the type, date and time, duration, distance, pace and speed, heart rate (average and maximum), cadence, elevation gain and loss, calories, steps, device name and the activity's Garmin number. Runbriel also receives each activity's detailed recording: heart rate, pace, distance, elevation and cadence over time, laps, and the route (GPS points). The detailed values are kept in your account (thinned out to about one value every 5 seconds). The route is kept on our server only until the app on your phone has downloaded it – at most 7 days – and is then deleted from the server; on your phone it stays like the runs you record with Runbriel. The start position in the summary is not stored. To tell whether you started a run from a Runbriel workout on your watch, Runbriel keeps a fingerprint (hash) of the activity's name and of each workout name it sends; the names themselves are not stored with your activities. For runs recorded on a watch, Runbriel also downloads the watch's original activity file once, reads from it only the time in each heart-rate zone and the zone limits set on the watch (with how they were set: maximum, resting and threshold heart rate), and deletes the file straight away – the file itself is not stored. Used only to show your runs in Runbriel – with map, splits, charts and time in heart-rate zones – and to mark the planned workout as done so your plan can adapt. Heart rate can be health data, so the legal basis is your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR, which you give when you connect. You can withdraw it at any time by disconnecting Garmin in Runbriel, or in your Garmin Connect account settings.
• Garmin data is never sold, never shared with anyone for their own purposes, never used for advertising, never sent on to Strava or any other service, and never used to decide on credit, insurance or employment. No AI system processes it, and it is never used to train, test or improve any AI model. You can see the runs received from Garmin in the app, correct or delete them, and export them with the rest of your data (see “Your rights”).

3. Cookies and browser storage

Runbriel only uses what is technically necessary: cookies that keep you logged in, and a setting that remembers your language if you change it. While you fill in the plan form, your browser keeps an unfinished draft (and whether you closed a notice) in its session storage; this disappears when you close the tab.

There are no tracking, advertising or analytics cookies, so no consent banner is needed (§ 25(2) TDDDG).

4. Service providers and where your data is

These companies work for Runbriel and may process your data on its behalf:

• Supabase, Inc. (USA): database, login and photo storage. Your data is stored in a data centre in Ireland (EU).
• Vercel Inc. (USA): hosting; delivers the pages and processes the server logs.
• Cloudflare, Inc. (USA): manages the runbriel.com domain.
• Google: login with Google.
• Zoho Corporation B.V. (Netherlands): the mailboxes for @runbriel.com addresses (Zoho Mail), with the emails stored in the EU.
• Strava, Inc. (USA): only if you connect Strava – receives the runs you send. Their own privacy policy applies to what is on Strava. Strava may also collect and use data about how Runbriel uses its service (Usage Data), under the Strava Privacy Policy.
• Functional Software, Inc. (Sentry, USA): crash reports from the app, stored in a data centre in Germany (EU).
• Plus Five Five, Inc. (Resend, USA): sends Runbriel's emails (confirmation, password reset, welcome).
• 650 Industries, Inc. (Expo, USA): delivers app updates; processes your IP address and basic device information when the app checks for an update.
• Google: Health Connect runs on your phone and is run by Google; the app is delivered through Google Play. Their own privacy policies apply.
• OpenStreetMap Foundation (United Kingdom): map tiles for the route map. The United Kingdom has an EU adequacy decision (Art. 45 GDPR).
• Norwegian Meteorological Institute (MET Norway, Norway): weather forecast for the workout brief. Norway is part of the European Economic Area (EEA), where the GDPR applies.
• Garmin International, Inc. (USA) and Garmin Würzburg GmbH (Germany): only if you connect Garmin – they send your activities to Runbriel and receive the workouts you send, as independent controllers, not as our processors. Garmin's privacy notice applies. Data received from Garmin passes through our hosting (Vercel) and is stored in our database (Supabase, EU – Ireland), both listed above; no other service receives it.

Where data goes to the USA, this is based on the EU-U.S. Data Privacy Framework for certified companies (Art. 45 GDPR) and/or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The fonts are delivered from Runbriel's own server. Your browser does not connect to Google Fonts.

Payments: Runbriel is free during testing. When Runbriel Premium starts, it is bought and managed through Google Play. Google handles the payment; Runbriel never sees your card or bank details. We only receive whether your subscription is active, its type and when it renews. Legal basis: Art. 6(1)(b) GDPR. Google's own privacy policy applies to the payment.

5. How long your data is kept

As long as you have an account. When you delete your account, your account, profile, photo, plans, logged workouts, own workouts and extra runs are deleted straight away. Copies can remain in the providers' backups for a short time until they are overwritten.

Contact messages and emails are deleted once your request is dealt with, at the latest after 12 months.

How to delete your account: see Delete your data.

Crash reports are deleted automatically after 90 days at the latest.

Strava: the connection (athlete number and keys) is kept until you disconnect, delete your account or remove Runbriel in your Strava settings. The Strava number of a sent run stays on your phone for 7 days.

Help improve GPS: summaries are deleted after 12 months, run reports after 90 days.

Routes received from Garmin are deleted from our server as soon as your phone has downloaded them, at the latest after 7 days. Garmin: the connection (user number and keys) is kept until you disconnect Garmin, delete your account or remove Runbriel in Garmin Connect, which Garmin then reports to Runbriel. When you disconnect, you choose: keep the runs received from Garmin (the default – they stay in your account so you can still see them, until you delete them) or delete them straight away. Runbriel receives nothing new from Garmin after disconnecting. You can delete single Garmin runs in the app at any time, and all of them by deleting your account. Runs you added to your log stay until you delete them.

6. Your rights

• Access to your data (Art. 15 GDPR)
• Correction (Art. 16 GDPR)
• Deletion (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawing consent at any time, for the future (Art. 7(3) GDPR)

Just write to privacy@runbriel.com or use the contact form.

You can also download a copy yourself at any time: "Download my data" at the bottom of every page when you are logged in, or in the app under Account (plans, logged workouts and settings as a JSON file; runs recorded in the app as GPX).

You can also complain to a data protection authority, for example the one where you live, or the one responsible for Runbriel: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. In Greece: Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens.

7. Other points

• You need an email address (or a Google account) to use Runbriel. Everything else is optional or only needed for the plan you choose.
• There are no automated decisions with legal or similarly significant effects (Art. 22 GDPR). Plans are built by fixed rules from your answers, and you can change everything.
• Runbriel is meant for people aged 18 and over (a plan can only be created from 18).
• If this policy changes, the new version is published here with a new date.
• How your data is protected: all connections are encrypted (HTTPS); the database only lets each account read and change its own data; passwords are stored only as secure hashes by the login service; your account data is stored in the EU (Ireland).