Article 1 — Who is responsible for your data
The data controller is Michaël Chabaud, sole trader trading as Yune Production, 1249 avenue Jean Moulin, 13480 Cabriès, France, registered under SIREN number 932 830 144. For any question about your data, or to exercise your rights: contact@mysportapp.fr. This policy applies to MyRunningAPP, the MySportAPP running app. Your MySportAPP account also works in the other MySportAPP apps, listed on mysportapp.fr. What these apps share is set out in Article 14.
Article 2 — The data we collect
IDENTITY AND ACCOUNT — email address, first and last name, username. If you sign in with Apple or Google, we receive your email address (where applicable, Apple's relay address) and your name from that service, never your password. PROFILE — photo, bio, city, date of birth, gender, height and weight. All of these fields are OPTIONAL: only your first and last name are required. Other users see your first and last name, username, photo and bio. Your city is visible only to your friends, unless you make it public. Your date of birth, gender, height and weight are visible only to you. ACTIVITIES — activity type (run, trail, intervals, treadmill, walk, hike), date, duration, distance, pace, elevation, laps and records, title, description, perceived effort, shoes used and their mileage, training plans and workouts. LOCATION — GPS track of your activities. This data is covered by Article 4. HEALTH DATA — heart rate, estimated calories, weight, and the data you choose to import from Apple Health or Health Connect. This data is covered by Article 5. WATCH, BRANDS AND FILES — workouts, routes and heart rate sent by your paired watch or by your Polar, Wahoo or Withings account if you link it, GPX, FIT or TCX files you import, and history imported from another app's archive. See Article 6. BEACON — live location during an activity, when you turn on a beacon. See Article 6. SOCIAL — shared activities, photos, friend mentions, kudos, comments, friends list, groups, private and group messages, challenges, segments and leaderboards among friends. REPORTS AND FEEDBACK — the reports you send, with a copy of the reported content, your bug reports and, if you give one, the reason for cancelling your subscription. TECHNICAL — device identifier for notifications, display preferences, error logs. SUBSCRIPTION — status and purchase history, and the purchase and renewal notifications RevenueCat sends us. NO banking data passes through or is stored on our servers: payment is handled by Apple or Google alone.
Article 3 — Why we collect them, and on what basis
PROVIDING THE SERVICE — account, activity recording, maps, statistics, training plans, messaging, subscription. Legal basis: performance of the contract formed by these terms of use. LOCATION — recording the route of your activities. Legal basis: your consent, given when your phone asks for access to your location, and revocable at any time in its settings. HEALTH DATA — your own training statistics. Legal basis: your explicit consent (Article 9 GDPR), detailed in Article 5. SOCIAL FEATURES AND BEACON — feed, friends, groups, challenges, segments, sharing, live location. Legal basis: your consent, withdrawable at any time by ceasing to use them or deleting the content concerned. NOTIFICATIONS — reminders and social alerts. Legal basis: your consent, given when the system asks and revocable in your phone settings. SECURITY AND ABUSE PREVENTION — reports, blocking, fighting fake accounts and falsified activities. Legal basis: our legitimate interest in protecting users. We carry out NO fully automated decision-making producing legal effects concerning you. The paces, time predictions, plans, levels and statistics computed by the app are sporting indicators, with no contractual consequence.
Article 4 — Your location and your routes
The app accesses your precise location ONLY WHILE RECORDING an activity, including in the background — with the screen off or another app open — so that the route is not interrupted. Your phone signals this use with its usual indicator. Outside a recording, the app does not track your movements. The full track of each activity is stored on our servers and can be read ONLY BY YOU. You choose, for each activity, what others see of the map: — THE ROUTE, with the option to hide the start and finish: the first and last 200 metres are then removed and the starting point is not published; — AN APPROXIMATE AREA of about 2 km, together with the name of the town. To obtain that name, only a rounded point is sent to the Photon service (komoot), never your route; — NO MAP. This choice is enforced by our servers: a hidden map is not merely concealed on screen, it is never transmitted to others. You also choose the visibility of each activity: PUBLIC (any user of the app), FRIENDS, or ONLY ME. Your defaults can be changed in Running settings, and each activity can be edited afterwards. SEGMENTS — only your times on a segment are shared, never your route. An activity that is private, or whose map is hidden or approximate, never feeds a segment. CHALLENGES AND LEADERBOARDS — participants see your totals (distance, duration, number of activities), not your routes. PHOTOS — up to 6 per activity. The location metadata they contain is removed at upload.
Article 5 — Your health data
Your heart rate, estimated calories, weight and perceived effort are data concerning health within the meaning of Article 9 GDPR. They receive enhanced protection. They are OPTIONAL: the app works without them. Their processing rests on your EXPLICIT CONSENT, given by entering them, by connecting a sensor or a watch, or by turning on the import. You may withdraw it at any time. Your weight, calories and heart-rate zones are shown only to you. Your heart rate is PRIVATE BY DEFAULT: nobody else sees it. If you choose to show it, for one activity or for all of them in the running settings, it becomes visible to the people allowed by that activity's visibility setting. APPLE HEALTH AND HEALTH CONNECT — import is turned off by default. It only works if you turn it on in Running settings and grant the permission your phone asks for. Access is READ-ONLY and limited to running, walking and hiking workouts, their route, their distance and heart rate. The app writes nothing to Apple Health or Health Connect. You can revoke this access at any time, in the app or in the Health and Health Connect settings. Data obtained from Apple Health (HealthKit) or Health Connect is used ONLY to display your activities and statistics. It is NEVER sold, NEVER used for advertising, marketing or profiling purposes, NEVER passed to a data broker, and is disclosed to no third party other than our host, which stores it on our behalf. Its use complies with Apple's HealthKit rules and with the Health Connect Permissions Policy, including its Limited Use requirements. None of your health data is passed to an insurer, an employer or any third party.
Article 6 — Watch, imported files and beacon
WATCH — The MySportAPP watch app, on Apple Watch or Wear OS, is paired with your account using a code shown in the app. The watch then sends your workouts, their GPS route and your heart rate to our servers, where they become activities subject to the same rules. You can unpair the watch at any time from "My watch". BRAND ACCOUNTS — you can link your Polar, Wahoo or Withings account. We then keep the access the brand grants us until you unlink that account or delete yours; at that moment the access is revoked with the brand. The workouts it sends us wait at most 30 days before being imported, then become activities subject to the same rules. FILES — the GPX, FIT or TCX files you import are read to create an activity: route, time, distance and, where present, heart rate. They follow the same visibility rules. HISTORY FROM ANOTHER APP — the export archive from the app you used before is read on your phone and is not sent to our servers. Only the activities taken from it are stored. BEACON — during an activity, you can create a live location link. About every 30 seconds, your latest position, your simplified track, your distance and your time are sent to our servers. ANYONE WHO HAS THE LINK sees this information together with your first name and the activity type, without needing an account. We never publish the link: you choose whom to send it to. It shows nothing more 2 hours after the end of the activity, and at the latest 24 hours after it was created. The beacon's positions are erased from our servers 1 day after the end of the activity.
Article 7 — Who else has access
We sell no data and display no third-party advertising. The providers below act on our behalf or supply a technical service, and access only what is necessary to them. SUPABASE — database, authentication, photo storage and service emails. Infrastructure located in the European Union (Ireland). APPLE — app distribution and subscription billing on iPhone, Sign in with Apple, iOS notifications (APNs). Apple Health runs on your device: we send nothing to Apple from the import. GOOGLE — distribution and billing on Android (Google Play), Sign in with Google, Android notifications (Firebase Cloud Messaging). Health Connect runs on your device. REVENUECAT — technical management of subscriptions and their status. RevenueCat knows your account only by its technical identifier, never by your name or email address; the subscription itself is purchased and managed through Apple or Google. INFOMANIAK — hosting of the whole mysportapp.fr website, including the legal pages, the account management page and the public beacon page. These pages talk directly to our database: no data from your account is stored at Infomaniak. POLAR, WAHOO AND WITHINGS — only if you link your account with one of these brands: it sends us your workouts. We send it nothing beyond what the link requires. OPENFREEMAP AND OPENSTREETMAP — base maps. Your device downloads the images of the area displayed. NOMINATIM (OPENSTREETMAP) AND PHOTON (KOMOOT) — place search and the town name of an approximate area. Only the text you type or a rounded point is sent to them. VALHALLA — route calculation, by a public server operated by FOSSGIS (openstreetmap.de). The points you place on the map are sent to it. APPLE (WEATHERKIT) — weather for your activities. Through our server, Apple receives the starting coordinates rounded (about 1 km) and the day of the activity, with no identifier, to obtain temperature, humidity and wind. None of these map or weather services receives your identity. As with any request on the internet, they see your device's IP address.
Article 8 — Transfers outside the European Union
Your data is hosted in the European Union. Some providers listed in Article 7 are nevertheless established in the United States: Apple, Google and RevenueCat. These transfers are governed by the mechanisms set out in Chapter V GDPR — the European Commission's standard contractual clauses and, where applicable, certification under the EU–US Data Privacy Framework. You may request a copy of the applicable safeguards at the address given in Article 1.
Article 9 — How long we keep them
ACCOUNT AND ASSOCIATED DATA — for as long as your account exists. INACTIVE ACCOUNT — after 3 years without any use, the account is deleted. An email warns you 30 days beforehand; signing in again is enough to keep it. ACTIVITIES, TRACKS AND PHOTOS — until you delete them, and at the latest until your account is deleted. Deleting an activity also erases its full track. IMPORTED DATA — turning off the Health import or unpairing your watch stops new transfers; activities already imported remain in your history until you delete them. BRAND ACCOUNTS (POLAR, WAHOO, WITHINGS) — the link is kept until you remove it or delete your account; the access is then revoked with the brand. Workouts received wait at most 30 days before being imported. IMPORTED HISTORY — the archive is processed on your phone and is not kept by our servers; only the activities taken from it are kept, like any others. BEACON — the link stops showing anything 2 hours after the end of the activity, and at the latest 24 hours after it was created. The beacon's positions are erased 1 day after the end of the activity. AFTER ACCOUNT DELETION — your data is removed immediately from the live database. Backup copies are purged within 30 days. MESSAGES — deleted with the account, on both sides of the conversation: the messages you sent also disappear for their recipients. REPORTS, BUG REPORTS AND CANCELLATION REASONS — 12 months. IN-APP NOTIFICATIONS — 12 months. NOTIFICATION TOKENS — deleted when you sign out and when the account is deleted, and at the latest after 6 months without being refreshed. TECHNICAL ERROR LOGS — 30 days. SUBSCRIPTION EVENTS — the purchase and renewal notifications sent by RevenueCat are kept for 3 years, including after the account is deleted, as proof of the contract. They contain only the account identifier, the type of event and its date. BILLING DATA — retained by Apple or Google under their own statutory periods, over which we have no control.
Article 10 — Your rights, and how to exercise them
You have the rights of ACCESS, RECTIFICATION, ERASURE, RESTRICTION, PORTABILITY and OBJECTION, as well as the right to withdraw your consent at any time. The most direct route: Profile → Data and privacy. There you can view and change your information and download a copy of your account (JSON file: profile, friends, messages, posts). Each activity can also be exported as GPX, edited, hidden or deleted from its details. DELETING YOUR ACCOUNT — in the app (Profile → Data and privacy → Delete account), on the web at https://mysportapp.fr/supprimer-mon-compte, or by email to contact@mysportapp.fr. To obtain a complete copy of all the data we hold about you, or for anything else, write to contact@mysportapp.fr. We reply within one month, as required by the GDPR. If our answer does not satisfy you, you may lodge a complaint with your country's supervisory authority. In France: the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
Article 11 — Minors
You must be at least 13 years old to create an account. The age rating shown by the App Store and Google Play describes the app's content; it is not the minimum age for opening an account. The app includes open messaging between users, allows location sharing and allows health data to be recorded. It is aimed at an audience able to appreciate what that means. In the European Union, the age of digital consent ranges from 13 to 16 depending on the country. Below that age, creating an account requires the authorisation of the holder of parental responsibility, who may at any time view, correct or have the child's data deleted by writing to contact@mysportapp.fr. A parent who finds that an account was opened without their agreement, or by a child under 13, may request its immediate deletion at that same address.
Article 12 — Security
Traffic is encrypted with TLS. Passwords are never stored in clear text. Access to data is partitioned row by row by database-level security rules (Row Level Security), so that an account can only read what concerns it. The full track of your activities is kept separately, readable by you alone. A beacon link relies on a random token that cannot be guessed. No system is infallible. In the event of a data breach likely to result in a high risk to your rights, we will inform you and notify the CNIL within the periods laid down by the GDPR.
Article 13 — Local storage and cookies
The app uses NO advertising cookies, NO third-party trackers and NO external analytics tools. Your device's local storage serves operation only: display preferences, language, theme, the activity being recorded, activities waiting to be sent while you are offline, and keeping your session. Nothing there is read by a third party.
Article 14 — MySportAPP: one account, several apps
The MySportAPP apps — MyRunningAPP and the apps for other sports, listed on mysportapp.fr — share a single account. SHARED across all these apps: your identity (first and last name, email, photo, date of birth, city, height and weight), your friends list, your groups and your messages. You can therefore be friends and chat with someone who does not use the same app as you. SPECIFIC to MyRunningAPP: your activities, tracks, statistics, records, shoes, training plans, challenges, segments and health data. This data is never transferred to another app in the family. The only information that travels, for display purposes, is the list of apps where you are active — shown to other users as small badges. It reveals neither your activities nor your statistics in those sports. Deleting your account erases your data across all the apps in the family, without exception.
Article 15 — Changes to this policy
This policy may change, in particular if we add a feature or change provider. Any substantial change will be signalled in the app at your next sign-in, and the update date above will be corrected. Earlier versions may be requested at the contact address.
Contact: contact@mysportapp.fr