Privacy Policy

Last updated: 2026-06-30

1. Who is responsible (controller)

Jan Thies · janthies00@gmail.com. tcxlab is a private, non-commercial, free, invite-only hobby project — reach me by email for any data-protection request. There is no Data Protection Officer (not required at this scale), and no postal address is published, as this is a private, non-commercial service.

2. What data we process, why, and on what legal basis

Data	Purpose	Legal basis
Account: email, password (hashed), optional name/username	Create and secure your account, sign you in	Consent / performance of the service (Art. 6(1)(a)/(b) GDPR)
Training data: GPS routes, pace, distance, elevation, cadence, power	Build your running dashboard, maps and analyses	Consent (Art. 6(1)(a))
Heart-rate & derived fitness/health metrics — treated as special-category health data	Fitness, training-load and performance analysis	Explicit consent (Art. 9(2)(a)) — given at sign-up
Connection tokens (Strava/Garmin), encrypted at rest	Import your activities on your behalf	Consent (Art. 6(1)(a))
Operational logs: IP address, requests, errors, security events (encrypted; short retention)	Keep the service running and secure	Legitimate interest (Art. 6(1)(f))
Optional usage analytics (which views you open, timings) — first-party, no third-party trackers	Improve the app	Consent (Art. 6(1)(a)) — you can turn this off anytime in Settings → Privacy
Feedback you send (message + optional screenshot)	Respond to and act on your feedback	Consent (Art. 6(1)(a))

Your home area is protected: map locations are clipped around a privacy zone you control. We do not sell your data or use it for advertising.

3. Who can see it (recipients / processors)

• Hosting: the app runs on a server operated by Hostinger (hostinger.com), a data processor under Art. 28.
• If you connect them: Strava and/or Garmin — your activities are fetched from there at your request (see their privacy policies).
• Weather: Open-Meteo is queried for per-run conditions (no account data sent).
• USA transfer: if you connect Strava or Garmin, your account is linked to those services and data is exchanged with them — including in the USA — on the basis of your consent (Art. 49(1)(a) GDPR) and/or their own safeguards; see their privacy policies. Otherwise no data is transferred outside the EU/EEA beyond your hosting provider's own infrastructure.

4. How long we keep it

• Your account and training data: until you delete them (or your account).
• Operational event logs: ~90 days; IP addresses are removed sooner (~30 days).
• Security/audit records: up to ~365 days; IP up to ~90 days.
• Feedback: up to ~365 days.

5. Your rights

Under the GDPR you have the right to: access your data, rectify it, erase it ("right to be forgotten"), restrict or object to processing, and data portability (export). You can withdraw your consent at any time (this doesn't affect processing already carried out) — and you have the right to lodge a complaint with a supervisory authority (in Germany, the data-protection authority of your federal state — e.g. the Hamburg Commissioner for Data Protection and Freedom of Information, HmbBfDI).

In the app you can already export your data and delete your account and all its data yourself under Settings. For anything else, email janthies00@gmail.com.

6. Consent & cookies

We use only strictly necessary cookies (to keep you signed in and protect forms) — these need no consent. Optional usage analytics is first-party and can be switched off in Settings.

7. Age

This service is intended for users aged 16 and over.