Privacy Policy

Last updated: 23 September 2026

Our Commitment to Your Privacy

SportStreak is a solo fitness project. We collect only the information needed to provide workout tracking, friend features, notifications, integrations, account security, and support, and we delete data we no longer need.

Who Is Responsible

The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) is the operator named in the Impressum at sportstreak.app/impressum. You can reach us at support@sportstreak.app.

Information We Collect

The service processes: • Account and profile data: email address, authentication data, display name, display ID, avatar, selected sports, times you don't want reminders, and account preferences • Workout data: date, duration, workout type, sport, name, notes, ratings, custom sessions you create, calendar entries, and training-plan progress • Progress data: streaks, streak freezes, pause mode, XP, level, achievements, quests, challenges, and items unlocked in the shop • Social data: accepted friendships, friend streaks, kudos, blocks, reports, and moderation outcomes • Device and notification data: device registration, push token, operating system, app version, timezone, notification preferences, and whether a notification was delivered and opened • Usage and diagnostic data: a small, fixed set of in-app events (onboarding steps, steps after a workout, opening a notification, and interactions with workout recommendations) and error reports that contain no exception text or content you entered • Integration data: if you connect Strava, your Strava athlete ID, access tokens, granted permissions, and the activities you import (name, date, duration, and type); if you add a YouTube link, that video's public metadata SportStreak activity is friends-only by design. We do not run a public activity feed, and we do not use advertising or third-party analytics.

Personalization

We build a recommendation profile from your own workout history (preferred duration and difficulty, the formats and sports you use, and recently completed sessions) to suggest workouts, and we show you a workout persona and habit phase on your Insights screen. This runs automatically but has no legal or similarly significant effect on you, so it is not an automated decision under Art. 22 GDPR. We do not infer sleep, health, or other sensitive traits.

Purposes and Legal Bases

• Providing the service you signed up for (account, workout tracking, streaks, friend features, sync, recommendations, and support): performance of our contract with you, Art. 6(1)(b) GDPR • Push notifications: your consent through the device permission and in-app settings, Art. 6(1)(a) GDPR • Strava import: at your request when you connect your account, Art. 6(1)(b) GDPR • Safety, abuse prevention, handling reports, security, and usage and error diagnostics that keep the app working: our legitimate interest in a safe, reliable service, Art. 6(1)(f) GDPR • Meeting legal obligations: Art. 6(1)(c) GDPR You need an email address and password to create an account. Everything else is optional, but some features do not work without it.

Age Requirement

SportStreak accounts are for people aged 16 and older. If you are under 16, please do not create an account or submit personal information through the app.

Service Providers and Recipients

• Supabase hosts our authentication, database, storage, and backend functions in the EU (Frankfurt, Germany) • Google Firebase Cloud Messaging delivers push notifications • Strava provides the optional activity import; Strava processes your Strava data under its own privacy policy • YouTube (Google) provides optional video metadata and playback Your accepted friends see the activity the app shares with friends. We do not sell your personal information or share it for advertising.

International Transfers

Our database is hosted in the EU. Push notifications and the optional Strava and YouTube features involve providers that may process data in the United States. Such transfers rely on an EU adequacy decision, such as the EU-U.S. Data Privacy Framework for certified providers, or on the EU Standard Contractual Clauses.

Data Security

We protect your information with appropriate technical and organizational measures: • Passwords are stored only as salted hashes by our authentication provider • Data is transmitted over encrypted HTTPS connections • Database permissions restrict each user to their own data and what friends may see • Access to the admin area is limited to the operator and staff accounts the operator authorizes for moderation and support

Data Retention

We keep account, workout, social, and integration data while your account exists. When you delete your account, this data is deleted. Usage events and error reports are deleted after 90 days, and Strava webhook records after 30 days (90 days for failed ones). Backups and security logs may remain for a short period where needed for reliability or legal obligations. Disconnecting Strava deletes the stored Strava tokens.

Your Rights

Under the GDPR you have the right to: • Access your personal data (Art. 15) • Correct inaccurate data (Art. 16) • Have your data deleted (Art. 17); you can delete your account in the app • Restrict processing (Art. 18) • Receive your data in a portable format (Art. 20) • Object to processing based on legitimate interests (Art. 21) • Withdraw consent at any time without affecting earlier processing (Art. 7(3)), for example by turning off notifications or disconnecting Strava • Lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU country where you live or where the operator is based To exercise these rights, email support@sportstreak.app or use Help & Support in the app. We may ask you to verify account ownership.

This Website (sportstreak.app)

The sections above describe the SportStreak app. This part covers the website itself — the marketing pages and the admin area.

Server Logs & Hosting

The hosting provider may automatically receive standard access data such as IP address, browser or operating-system details, date and time, and the requested page to operate and secure the site. These technical logs are used for reliability and security and are retained only as long as necessary.

Fonts, Tracking & Cookies

All fonts and icons are served from our own site — loading the site sends no data to Google Fonts or other third parties. The public marketing pages run no intentional analytics or advertising tracking and set no non-essential cookies. Signing in to the admin area uses local browser storage strictly to keep you logged in.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version in the app and on sportstreak.app with a new date. Changes are effective when posted.

Contact Us

For privacy questions or requests, email support@sportstreak.app or use Help & Support in the app. The operator's identity and postal address are published in the Impressum.