WattRun

Privacy Policy

1. Data controller

Matthias Henkert
Birkenstraße 52c
16321 Bernau b. Berlin, Germany
Email: hallo@wattrun.de

2. What data we process

  • Account data: email address, name (via Supabase Auth).
  • Training data: FIT files, GPS tracks, power and heart-rate streams, cadence, derived metrics (FTP, Fitness, Fatigue, Form, power curve, training load).
  • Health-related data (Art. 9 GDPR): heart rate, power and training history are considered health-related and are processed only with your explicit consent.
  • Connection data (technically necessary):IP address, browser type, OS, referrer URL, requested resource, timestamp. Server logs are retained for max. 7 days, then deleted or anonymized. The IP address is also briefly held in-memory (max. a few minutes) for rate-limit / abuse prevention (Art. 6 (1) (f) GDPR).
  • Usage days (activity record): we record the calendar days on which an account is used—for operating and securing the service (legal basis: legitimate interest, Art. 6 (1) (f) GDPR).

3. Purpose of processing

  • Providing the training analysis features
  • AI-assisted training recommendations (Anthropic Claude API)
  • Authentication and account management
  • Self-hosted analytics (Umami) — consent only

4. Processors and recipients

  • Anthropic, PBC (USA): AI processing for training recommendations, coach insights and weekly summaries. Data sent: training metrics (FTP, Fitness/Fatigue/Form, workout statistics, optional training goal) plus aggregated activity data — no GPS rawdata, no plaintext-name linkage. Per Anthropic's Commercial Terms, API inputs are not used for model training. Legal basis: Art. 6 (1) (b) GDPR plus explicit consent for processing health-related data (Art. 9 (2) (a) GDPR). Third-country transfer to the US under Standard Contractual Clauses (Art. 46 GDPR), see Anthropic DPA. Internally we log only API request counters and token usage — no content.
  • Supabase, Inc. (USA): authentication, session management and hosting of the application database (account, training and health-related data). Data is stored in an EU region. Data: email, name, sign-in timestamp, session token plus the training and health data stored in the app. Legal basis: Art. 6 (1) (b) GDPR, and — for health-related data — Art. 9 (2) (a) GDPR (explicit consent). Data Processing Agreement under Art. 28 GDPR in place (Supabase DPA). As Supabase Inc. is a US company, any access from the US is covered by Standard Contractual Clauses (Art. 46 GDPR).
  • Hostinger UAB (Jolantos g. 3, Vilnius, Lithuania, EU): server hosting of the backend/API on a dedicated VPS. Legal basis: Art. 6 (1) (f) GDPR. Data Processing Agreement under Art. 28 GDPR in place (DPA).
  • Self-hosted analytics (Umami): runs on a server operated by the controller (umami.wattrun.app, also at Hostinger) — no third-country transfer. Loaded only after your consent in the cookie banner (Art. 6 (1) (a) GDPR + § 25 (1) TTDSG). Processes page views, time on page, browser/OS info and a daily-rotated IP+User-Agent hash. No cookies are set.

Connected services (only at your request):

  • intervals.icu (Intervals.icu Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom): Only if you set up the connection yourself under “Sync training data”, WattRun retrieves your activities through the intervals.icu API—the original FIT files plus details such as sport, date, duration, distance, device name and data source (e.g. Garmin). When you connect, the last 90 days are imported; after that, intervals.icu notifies us of new activities automatically. For this we store an access token with read-only access to activities and your intervals.icu athlete ID. We only send this token to intervals.icu to retrieve data or to disconnect—no training data from WattRun. intervals.icu is not a processor of WattRun but an independent service you chose; its privacy policy applies to processing there. Legal basis: Art. 6 (1) (b) GDPR (a feature you requested) and, for health-related data, Art. 9 (2) (a) GDPR (explicit consent). You can disconnect at any time; we then revoke the access at intervals.icu and delete the token. Sessions already imported stay in your account until you delete them or your account.
  • Wahoo (Wahoo Fitness, LLC, 90 West Wieuca Rd NE #110, Atlanta, Georgia 30342, USA): Only if you set up the connection yourself, WattRun retrieves your workouts through the Wahoo API—the FIT files and the workout summary (e.g. date, duration, distance). Wahoo notifies us of new workouts automatically. When you connect, we also read your Wahoo profile once (name, email address) to show you the connected account; we do not store these details. We store the access and refresh tokens, their expiry, the granted permissions and your Wahoo user ID. We only send these tokens to Wahoo to retrieve data or to disconnect—no training data from WattRun. Wahoo is not a processor of WattRun but an independent service you chose; its privacy policy applies to processing there. Legal basis: Art. 6 (1) (b) GDPR (a feature you requested) and, for health-related data, Art. 9 (2) (a) GDPR (explicit consent). When you disconnect or delete your account, we revoke the access at Wahoo and delete the tokens. Sessions already imported stay in your account until you delete them or your account.

5. Your rights

  • Right of access to your stored data (Art. 15)
  • Right to rectification of inaccurate data (Art. 16)
  • Right to erasure of your data (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object to processing (Art. 21)
  • Right to withdraw consent at any time, without giving reasons

To exercise your rights, contact hallo@wattrun.de.

6. Cookies and similar technologies

The app sets technically necessary cookies and session tokens for authentication via Supabase. These are required to operate the app and cannot be disabled without losing your sign-in.

In your browser's localStorage we additionally store: UI preferences (theme, sport mode) and your analytics consent decision (wattrun-consent-v1). This storage is permitted without consent under § 25 (2) (2) TTDSG (strictly necessary to deliver the requested service and respect your decision).

The Umami analytics is only activated after your explicit consent in the cookie banner. You can withdraw consent at any time by deleting the wattrun-consent-v1 entry under this domain in your browser (DevTools → Application → Local Storage).

7. Retention period

Account and training data are stored as long as your account is active. After deletion, all data is removed from active systems within 30 days; backup remnants are overwritten according to standard backup rotation (max. 30 additional days). Server logs: max. 7 days. AI API logs: max. 30 days (anonymized).

8. Right of complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is determined by your country of residence. For EU residents using a German-based service, the competent authority is the State Commissioner for Data Protection and Freedom of Information of Brandenburg, Germany.

Last updated: October 2026