This notice supplements our Privacy Policy (https://strideborn.com/legal/privacy) and sets out the legal bases on which we process your personal data and the rights you have under the GDPR and similar data-protection laws.
Controller and contact
The data controller is Masq Systems. Privacy contact: [email protected] — the fastest way to reach us for any data-protection matter.
Legal bases for processing
- Providing the app — performance of our contract with you (Art. 6(1)(b)): your account, journey progress, syncing, subscription validation.
- Health and activity data (steps, distance, active energy, floors) — your explicit consent (Art. 9(2)(a)), given through the Apple Health / Health Connect permission prompt and withdrawable at any time in your device settings.
- Security and bug-fixing — our legitimate interests (Art. 6(1)(f)) in keeping the service safe and working.
- Billing records — compliance with our legal obligations (Art. 6(1)(c)).
Processors we use
We share data only with processors acting on our instructions:
- Apple and Google — subscription processing and purchase validation.
- Sentry (hosted in the EU) — crash and performance diagnostics, configured to exclude your health/activity values, IP address and request headers.
- Google Firebase — push notifications.
- Laravel Cloud (infrastructure on AWS, EU region) — backend hosting.
We do not sell your personal data, and we do not use health or fitness data for advertising.
International transfers
Our backend and diagnostics data are hosted in the EU. Where personal data is transferred outside your region (for example, to Apple or Google), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep your data
We keep account and activity data while your account is active. When you delete your account, we erase your personal data promptly, retaining only the anonymised billing records we are legally required to keep. Diagnostics are kept for a limited period and then deleted.
Your rights
Subject to applicable law, you have the right to: access your data; rectify it; erase it; restrict or object to processing; receive a portable copy; and withdraw consent at any time without affecting processing carried out beforehand. You can delete your account and personal data yourself from the profile screen, or email [email protected]. We respond within the statutory time limits.
Complaints
If you believe we have mishandled your data, you have the right to lodge a complaint with your local data protection supervisory authority. We would, however, appreciate the chance to address your concern first — please contact us.
Contact
Email [email protected].