GoodBurn app privacy policy

1. Controller

Plexify GmbH, Lenbachallee 12, 85521 Ottobrunn, Germany. Represented by Philipp Kang, Jonas Leeb and Maik Tran.

Email: business@goodburn.app. Further details are in the imprint.

2. Principle

The app contains no advertising and no analytics or tracking services, and we do not sell data. It processes only what training, missions and crews need. No company funding a mission ever sees individual workouts.

3. Account

For an account we process your email address, your password (stored only as a hash), your display name and a friend code. The legal basis is Art. 6(1)(b) GDPR, use of the app.

If you sign in with Google, Google sends us your email address and name, and Google learns that you sign in to GoodBurn. Google's privacy notice applies to that as well.

4. Hosting and database

We store account and training data with Supabase, Inc., USA, on servers in Frankfurt am Main. Supabase is our processor under Art. 28 GDPR. Where Supabase processes data in the USA, the transfer relies on the adequacy decision for the EU-US Data Privacy Framework and additionally on standard contractual clauses.

5. Training in the app

When you finish a workout in the app, we store its name, time and duration, the exercises and the energy calculated from it. We store your weekly target, training days, goal, level, equipment and limitations to tailor suggestions and reminders. The legal basis is Art. 6(1)(b) GDPR.

6. Health data from Apple Health and Health Connect

Only if you explicitly turn the connection on, the app reads your workouts from Apple Health or Health Connect (type, start, duration, distance, active energy, source app) and the average heart rate during a workout with the number of readings. We do not store your heart-rate history.

This is health data. The legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you give in the app before the system prompt. We use the data only to count workouts as energy for your missions and crews and to calculate your rhythm. It is not used for advertising and not passed to companies individually.

You can withdraw consent at any time by disconnecting under Health data in the app or by revoking access in your system settings. Workouts already imported stay stored until you delete them or your account.

7. Missions and funding companies

When you join a mission, your energy counts towards the total. The funding company sees mission totals, meaning how many take part and how much energy comes together, and daily figures only from five participants. It sees your name and energy total only if you turn that on when joining. It never sees individual workouts. The legal basis is Art. 6(1)(b) GDPR, and for sharing your name your consent under Art. 6(1)(a) GDPR, which you can change at any time.

If you leave, your name is no longer shown. Energy already contributed stays in the total because it is the basis of the committed donation.

8. Crews and friends

In a crew, members see your display name and that you finished a workout. You can turn this off in the app settings with "Show me in crew activity"; your energy still counts towards shared goals. Friends see your display name and your rhythm. The legal basis is Art. 6(1)(b) GDPR.

9. Notifications

Training reminders are scheduled only on your device. For notifications from your crew or mission we store a device token and deliver through Firebase Cloud Messaging by Google Ireland Limited and the Apple Push Notification service. You only receive notifications if you allow them in the system prompt (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can turn them off in the app and in the system settings at any time. Where Google processes data in the USA, this relies on the EU-US Data Privacy Framework and standard contractual clauses.

10. Emails

Account emails, for example to confirm your address or reset your password, are sent through Resend, Inc., USA, as a processor under Art. 28 GDPR, from servers in the European Union. Where Resend processes data in the USA, the EU-US Data Privacy Framework with standard contractual clauses applies.

11. Storage on your device

The app stores progress, workouts and settings encrypted on your device so it works offline. This storage is strictly necessary for the service (Section 25(2) no. 2 TDDDG).

12. Import error log

If an import from Apple Health or Health Connect fails, we store the platform, the step and a fixed error code, for example "permission denied", together with your account ID. We do not store health data or error messages verbatim. We use this to find and fix import problems. The legal basis is Art. 6(1)(f) GDPR. Entries are deleted automatically after 13 months.

13. Retention and deletion

We keep your data while your account exists. You can delete your account yourself at any time in the app ("Delete account"). This deletes your account, profile, workouts, health data, crew and friendship data and device tokens. Your contributions to missions remain without any link to you, because they are the basis of the donation calculation and the report to the funding company.

14. Recipients

Your data is received only by the processors named above, the people at our company who run the service, and, to the extent described, your crew, your friends and the funding company of a mission.

15. No automated decision-making

No automated decision-making, including profiling under Art. 22 GDPR, takes place.

16. Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Contact business@goodburn.app for this. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

17. Changes

We update this policy when our processing changes. The version published on this page applies.