Privacy policy

1. Controller

The controller responsible for data processing on this website is:

2. Hosting and server log files

This website runs on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (in Europe: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany). Cloudflare also provides the content delivery network and protection against attacks.

When you open a page, Cloudflare processes technically necessary connection data: IP address, date and time, requested address, amount of data transferred, browser type and operating system, and the referring page. This data is used to deliver the page, to fend off attacks and to diagnose errors, and is stored briefly in aggregated form. I do not keep my own log files with personal data.

The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest is the secure, fast and stable provision of the website. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

Cloudflare may transfer data to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the EU Commission's standard contractual clauses apply.

3. Calculator, planner and live mode: processing only in your browser

To calculate your calorie expenditure you enter height, weight, age and sex. This information is processed exclusively in your browser and stored there locally (Local Storage) so you do not have to enter it again on your next visit. It is not transmitted to my server or to third parties. You can overwrite it at any time via “Edit” or remove it by deleting the website data in your browser.

Body data is health data within the meaning of Art. 9 GDPR. Because it never leaves your device, I do not process it. Should this website offer a user account in the future, any transfer will happen only after your explicit consent (Art. 9 (2) (a) GDPR), and this policy will be updated beforehand.

Without signing in there is no account: everything stays in your browser. With sign-in (next section) your account, challenge days and leaderboard entries are stored in Firebase.

4. Fonts

The fonts used (Bebas Neue, Inter) are served by this website itself. No connection is made to Google Fonts or other font providers.

5. Account, challenge days and leaderboard (Firebase)

For sign-in, account, live mode and leaderboard I use Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – specifically Firebase Authentication (sign-in with Google) and Cloud Firestore (database, location europe-west3, Frankfurt). This is optional: calculator and planner work without an account.

When you sign in with Google, Firebase receives your Google account identifier and email address; I store your user ID, your chosen display name, your category (sex), units and language. I do not take over your Google name or profile picture.

Challenge days (units, complaints such as “knee niggles”, energy level) and – only after your explicit consent in the account – height, weight and year of birth are health data (Art. 9 GDPR). The legal basis is your consent (Art. 9 (2) (a) GDPR), which you can withdraw in the account at any time. This data is readable only by you.

If you submit a result, display name, category, level, calorie value, date, split by sport and review status are shown publicly on the leaderboard and on your entry page. The legal basis is Art. 6 (1) (b) GDPR (participation in the leaderboard). You can delete entries in your account at any time.

A data processing agreement with Google is in place (Google Cloud Data Processing Addendum). Firebase Authentication also processes sign-in data in the USA; Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

Under “Account” you can delete all data with one click: profile, challenge days and entries are removed immediately, and so is the Firebase sign-in account.

6. AI check of the proof screenshot (Google Gemini)

If, after submitting a result, you voluntarily upload a screenshot from your tracking app for verification, the image is sent once to Google's Gemini API (Google Ireland Limited). The model reads the app, the day's total energy and the date and estimates whether the screenshot looks genuine. The image is stored neither by me nor permanently by Google; only the result of the check (app, value read, date, verdict) is stored on your entry.

Transmitted are the downscaled image and the calorie value and date you entered. The screenshot may contain personal data your app shows (e.g. names, health values); please hide what is not needed – only the total energy and the date are required.

The legal basis is your consent given by actively uploading (Art. 6(1)(a), Art. 9(2)(a) GDPR). Without an upload your entry simply stays “unverified”. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework.

7. Visitor statistics with Google Analytics (consent only)

If you choose “Allow” in the cookie banner, I load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Before that the script is not embedded at all – not loaded and blocked, simply absent. If you choose “Decline” or nothing, nothing is measured.

Google Analytics sets cookies (_ga, _ga_…; lifetime up to 2 years) and processes a truncated IP address, page views, time on page, approximate location at city level, device and browser. I have disabled Google Signals and personalised advertising; event data is kept at Google for at most 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). A data processing agreement with Google is in place (Google Ads Data Processing Terms).

Google may transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework (EU Commission adequacy decision of 10 July 2023).

You can withdraw your consent at any time with effect for the future; the Google cookies are deleted and the banner appears again: Change cookie settings

8. Cloudflare Web Analytics

For audience measurement I use Cloudflare Web Analytics. This service sets no cookies, does not access information on your device and does not fingerprint your browser. Only aggregated information is collected: page viewed, referring page, approximate region, device type and load time.

Why you are not asked about it: § 25 (1) TDDDG (German law) requires consent only if information is stored on or read from your device. That is precisely what does not happen here. The legal basis is Art. 6 (1) (f) GDPR. Your right to object under Art. 21 GDPR remains unaffected.

9. Local storage in your browser

This website stores the following entries in your browser's Local Storage or as a technically necessary cookie. None of these entries is transmitted to me.

The legal basis is § 25 (2) no. 2 TDDDG (strictly necessary to provide the service you requested) in conjunction with Art. 6 (1) (b) GDPR. No consent is required for this.

10. Contact by email

If you email me, I process your details (email address, content, time) to answer your enquiry. The legal basis is Art. 6 (1) (f) GDPR, or (b) for contractual enquiries. The data is deleted once your enquiry is settled and no statutory retention obligations apply.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Please use the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

12. Changes

This policy describes the current state of the website. If new features are added (e.g. user account, leaderboard, upload of proof), it will be updated beforehand. The current version is always available on this page.