Privacy notice
Draft for legal review before launch. Version app-consent-v1.
Who is responsible
Sled & Stride, [name and address as in the Impressum], hello@sledandstride.com.
The short version
- The app stores your plan and training log on your phone. By default nothing is sent to us.
- To unlock a plan, the app checks your licence key with Gumroad once per device.
- Only if you switch on "Share my training log" do we receive a copy, stored in the EU under a random ID, without your name or email address.
- Every kind of use has its own switch, off by default. Switching sharing off deletes the shared copy.
What we process, why, and on which legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Licence key, product, Gumroad sale id, a keyed hash of the buyer email (from Gumroad) | Unlock the plan you bought, limit a licence to 5 devices, link shared data to a purchase for founding-cohort refunds | Contract (Art. 6(1)(b) GDPR) |
| Training log, effort, sleep, soreness, energy, test results (only when sharing is on) | Store the shared copy and check founding-cohort refunds | Explicit consent (Art. 9(2)(a) and 6(1)(a) GDPR), switch 1 |
| The same data, pseudonymised | Improve the training plans | Explicit consent, switch 2 |
| The same data, combined with at least 10 people | Statistics in posts and reports; no one can be identified | Explicit consent, switch 3 |
| IP address and request time (Cloudflare request logs, rate limiting) | Security and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
The licence key itself is not stored. We store a keyed hash of it. Your email address is not stored either: we keep only a keyed hash, so we can recognise the same buyer.
Where your data goes
- Cloudflare (Cloudflare, Inc., USA, with Cloudflare entities in the EU): runs the website, the app and its server functions, and stores licence records and the shared training data in a database restricted to the EU, as our processor under its data processing addendum. Requests are handled at the Cloudflare location nearest to you, which can be outside the EU; transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Our own server in Austria: once a week we copy the shared training data of people who switched sharing on, to check founding-cohort refunds and build statistics. Withdrawals are applied to this copy at the same time.
- Gumroad (Gumroad, Inc., USA): sells the plans, confirms licence keys and pays founding-cohort refunds. See Gumroad's privacy policy for the purchase itself.
We do not sell data, show ads, or use tracking or analytics cookies. Fonts are served from our own site.
How long
- Shared training data: until you switch sharing off or ask us to delete it, at the latest 24 months after your plan ends. Switching off deletes the EU copy at once and our Austrian copy within 7 days.
- Licence records: as long as the licence can be used and as required by tax law for purchase-related records.
- Request logs: at most 14 days.
Your rights
You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent at any time without affecting earlier processing. Turning a switch off in the app withdraws that consent. You can also email hello@sledandstride.com. You can complain to the Austrian data protection authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).
Age
Sharing is only available to people aged 18 or older.
Not medical advice
The plans and the app are general training guidance, not medical advice and not a medical device.