Privacy Policy

The Runfluence
Tobias Benz
c/o Workation Adria d.o.o.
Orban 34, 52100 Pula, Croatia

Email: info@the-runfluence.com

The Runfluence is an AI-powered running coaching app. We collect and process personal data to provide you with a personalised training experience. This policy explains what data we collect, how we use it, and what rights you have.

The app is hosted and operated on the Base44 Inc. platform (USA). Base44 provides backend infrastructure, database (Supabase/PostgreSQL), authentication, and hosting.

Data processed: user data, training data, uploaded files (photos). Server location: USA/EU (AWS). Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 46 GDPR (standard contractual clauses).

Base44 Privacy Policy: base44.com/privacy

A registration is required to use the app. We collect:

• Email address
• Name (optional)
• Password (stored encrypted)

Optional: sign-in via Google OAuth (Google LLC, USA). Name, email, and profile picture are transferred from Google. Legal basis: Art. 6(1)(b) GDPR.

With your explicit consent, you can connect your Strava account (Strava Inc., San Francisco, USA) to the app. We collect and process:

• Activity data (distance, pace, time, heart rate, elevation)
• GPS routes and map thumbnails
• Personal bests (PBs)
• OAuth tokens for synchronisation

Legal basis: Art. 6(1)(a) GDPR (consent). You can disconnect Strava at any time in your Profile and request deletion of the data.

Strava Privacy Policy: strava.com/legal/privacy

6a. Supercoach (AI Coaching)

The app uses AI language models (OpenAI GPT-4 / Google Gemini via Base44) to generate personalised coaching messages, training plans, and feedback. Your training data, profile data, and chat history are transmitted to these AI models.

Legal basis: Art. 6(1)(b) GDPR. Data processing in the USA on the basis of Art. 46 GDPR (standard contractual clauses).

6b. Screenshot Workout Logging

If you use a running app without a direct integration (e.g. Adidas Running, Garmin without Strava sync), you can upload a screenshot of your workout summary to the Supercoach chat. By uploading an image, you consent to it being analysed by AI to extract your workout metrics (distance, time, pace, heart rate, elevation, cadence). Extracted values are only saved to your training data after you confirm them in the chat. Screenshots are used solely for this extraction purpose.

Legal basis: Art. 6(1)(a) GDPR (consent through active upload of the image).

6c. Story Creation & Photo AI

The Story feature allows you to turn training photos and data into visual cards. Photos may be transferred to AI image generation services (OpenAI DALL-E via Base44). Uploaded photos are stored on Base44 servers.

Legal basis: Art. 6(1)(a) GDPR (consent through active use of the feature).

During onboarding and ongoing use, the app processes the following data:

• Age, gender, weight (optional)
• Training goals and race dates
• Heart rate zones
• Injury history and current complaints (voluntary)
• Stress level and sleep quality (voluntary)

Some of this data may constitute health data under Art. 9 GDPR. Processing only takes place with your explicit consent (Art. 9(2)(a) GDPR).

The app may send transactional emails (e.g. coaching summaries, run notifications) via Base44's email service (Resend/AWS SES). Legal basis: Art. 6(1)(b) GDPR.

We use Base44 Analytics for anonymised analysis of app usage (e.g. which features are used). No personal profiles are created. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the app).

The app stores technically necessary data in your browser/device's local storage (e.g. session tokens, last-seen message timestamps). This data does not leave your device and serves only to ensure the app functions correctly. Legal basis: Art. 6(1)(b) GDPR and § 25(2) TDDDG.

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) — request by email
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future

Please send requests to: info@the-runfluence.com

You also have the right to lodge a complaint with a data protection supervisory authority.

Data transmission is encrypted via HTTPS/TLS. Passwords are stored in hashed form. We implement appropriate technical and organisational measures to protect your data.

Your data will be deleted once the purpose of processing no longer applies and no statutory retention obligations prevent deletion. You can request complete deletion of your account and all associated data at any time by email.