Privacy policy

1. Overview

This policy covers use of the website (sections 3–5) and use of the Jntos service, which is in development (sections 6–9). The sections on the service apply from its launch.

This is a translation for convenience. The German version prevails.

2. Controller and data protection officer

Controller within the meaning of the General Data Protection Regulation (GDPR):

Data protection officer: We have not appointed a data protection officer at present. For all privacy matters you can reach us at [email protected].

3. Visiting this website

Hosting and server logs

The website is hosted by Cloudflare, Inc. (USA). When you visit, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, referrer and browser and system information. This is needed to deliver the website, keep it secure and analyse errors.

The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Log data is deleted after 30 days unless needed longer to investigate a security incident. Cloudflare processes the data as our processor (Art. 28 GDPR).

No cookies, no tracking

We do not store information on your device or read any from it beyond what is strictly necessary to display the website you requested (Section 25(2) no. 2 TDDDG). There are no cookies, no analytics or marketing services, no social media plugins and no embedded third-party content. Fonts and graphics are loaded from our own server. That is why there is no cookie banner.

4. Contact by email

If you write to us, we process your email address, your name if provided and the content of your message (for example sport and region).

• Purpose: to answer your request.
• Legal basis: for replying, our legitimate interest (Art. 6(1)(f) GDPR) or pre-contractual steps (Art. 6(1)(b) GDPR).
• Retention: We keep your request for up to 12 months. On request we delete it sooner.
• Service provider: our mailbox is operated by Cloudflare, Inc. (email forwarding) and Google (mailbox) as our processor.

We do not use a contact form or a newsletter service.

5. No advertising, no sales

We do not sell personal data, do not pass it on for advertising and do not show third-party advertising. This applies to the website and to the Jntos service.

6. The Jntos service

Account

For an account we process your email address, display name, sports, approximate region and your settings. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR).

Activity data and data sources

We receive activities in two ways: when you upload files (for example .fit or .gpx) or when you expressly connect an account with a device or activity platform. In the second case we receive the data with your consent through the official API of that platform, for example Garmin Connect. You can disconnect at any time in Jntos or at the platform; after that we receive no new data.

We process the following activity data:

• activity type (for example run, ride, hike), date and start time
• distance, duration, speed or pace, and elevation
• route or start region, trimmed by a privacy zone at the start and end
• where available, intensity metrics such as heart rate or power (watts)

Not processed: sleep data, stress and wellness data, women’s health data and training plans. We do not request such data from connected platforms.

Purposes

• forming suitable small groups (sport, region and how you actually train)
• organising shared sessions: invitations, reminders, yes and no
• operating the service securely and reliably

Legal bases

• User agreement (Art. 6(1)(b) GDPR) for the account, forming groups and organising sessions.
• Consent (Art. 6(1)(a) GDPR) for connecting a platform.
• Intensity metrics such as heart rate may allow conclusions about your health. We process them only with your explicit consent (Art. 9(2)(a) GDPR), which you can give separately and withdraw at any time. Jntos keeps working without it. We do not use these values to make statements about health.
• Legitimate interest (Art. 6(1)(f) GDPR) for security, abuse prevention and error analysis.

What other members see

Members of your group see your display name, your sport and, for a shared session, whether you have said yes, plus the time and meeting point of that session. They never see your routes, your activity history, where you live or any other exact location.

Automated analysis

To suggest groups, we analyse your activities automatically (profiling, Art. 4(4) GDPR). There is no automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR): whether you join a session is always your decision.

AI and machine learning

We do not use your activity data to train AI or machine-learning models and do not pass it on to third parties for that purpose. Jntos is an AI-assisted service: we use language models from an external provider (Anthropic PBC, USA) to explain group suggestions in plain language and to word training suggestions. We pass on only derived values (for example typical pace and distance ranges and the sport), never raw files, routes, names or exact locations. The provider processes this data as our processor, only to deliver the respective function.

Payments

There are no paid features at present. If they are introduced, payments will be handled by a payment provider that we will name here. The payment provider receives no activity data.

7. Recipients and processors

We use a small number of carefully chosen service providers who process data only on our instructions under a data processing agreement (Art. 28 GDPR):

Connected platforms (for example Garmin Connect) are not our processors but independent controllers; their own privacy terms apply to processing there. Beyond this, we only disclose data where we are legally obliged to.

8. Transfers to third countries

Some providers are based in the USA, or access from third countries cannot be fully ruled out. We then base transfers on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework, where the provider is certified, Art. 45 GDPR) or on the Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards.

9. Retention and deletion

• Account: until you delete your account.
• Activity data: We keep it until you delete it or your account. You can delete individual activities yourself at any time.
• After disconnecting a platform: we delete the data received through it within 30 days unless you choose otherwise.
• Backups: deleted data disappears from backups after 30 days at the latest.
• Legal obligations: data we must keep for commercial or tax reasons (such as invoices) is restricted until the retention periods expire and then deleted.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); processing carried out until then remains lawful.

An email to [email protected] is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or place of work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI).

11. Obligation to provide data

You are not obliged to provide us with data. Without an email address and activity data, however, we cannot offer you an account or form groups for you.

12. Security

We protect data with technical and organisational measures, including encrypted transmission (TLS), encryption of stored data at our database provider, need-to-know access restrictions and data minimisation.

13. Minimum age

Jntos is intended for people aged 18 and over. We do not knowingly process data of minors.

14. Changes

We update this policy when the service or the law changes. The current version is always available here. We will inform you in advance of material changes affecting your account.