Privacy

Controller

The controller is the operator named in the imprint. For access, rectification or erasure an email to the address given there is enough.

What is processed

Account data: your email address. It is needed to sign you in and to tie your data to your account.

Profile data: whatever you enter yourself – display name, weight, optionally height, paces or FTP, sweat rate, sodium in sweat, gut tolerance and caffeine habituation. These figures feed the calculation and nothing else.

Your products with their nutrition, and saved routes with distance, elevation, temperature, the calculated plan and – if you loaded a GPX file – a simplified elevation profile of at most about 300 points.

Server logs kept by the host, with IP address, time and the page requested. They arise technically from running the service and are not merged with your account.

Legal basis and purpose

Account, profile and route data are processed to perform the usage relationship (Art. 6(1)(b) GDPR): without them the tool cannot calculate anything. Running the service securely, logs included, rests on the legitimate interest in a working, secure service (Art. 6(1)(f) GDPR).

Figures such as weight or sweat rate are training data, not medical findings. They are used solely to work out your demand.

Where the data sits

Database and authentication run on Supabase; this project's database is in region eu-central-1 (Frankfurt, Germany). The application is hosted by Vercel. Both act as processors; depending on the provider, access from the United States cannot be ruled out, covered by the EU standard contractual clauses.

Sign-in emails (link, confirmation) are sent by Supabase's mail service or the mail provider configured there.

Cookies and browser storage

Only technically necessary cookies are set: your sign-in cookie and one remembering your language. The reach measurement sets no cookies either and stores nothing on your device – which is why there is no cookie banner.

Your browser additionally keeps the planning you are currently entering, so it is not lost when you move between pages. That stays on your device and is never transmitted; “Reset entries” in the planner clears it immediately.

An uploaded GPX file is read in the browser. The file itself never leaves your device – only the simplified elevation profile is stored, and only if you save the route.

Reach measurement

To see which pages get opened, the site runs Vercel Web Analytics. It records the time, the page, the referring page, an approximate location (country, region, city), the device type, and the operating system and browser with their versions.

No cookies are involved. Instead of a lasting identifier, Vercel derives a hash from the incoming request; it is discarded after 24 hours, so views cannot be joined up over time or across other websites. The IP address is not stored with the measurement.

The part of the address after the question mark is cut off before anything is sent – parameters such as a redirect or a sign-in link never reach the statistics at all.

The legal basis is the legitimate interest in statistics about the use of the service (Art. 6(1)(f) GDPR).

How long it is kept

Your data stays as long as your account exists. Individual products and routes can be deleted by you at any time. The whole account is deleted by you in the profile under “Delete account” – account, profile, products and routes are removed immediately and for good.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Access and portability you can handle yourself: under “Take your data with you” in your profile you can download everything stored about your account at any time. You may also complain to a supervisory authority – in Italy the Garante per la protezione dei dati personali, in Germany the authority of your federal state.