Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Fabian Weiß
Kolonnenstr. 8
10827 Berlin
Germany
E-Mail: contact@cardioclash.com

2. The key points

• You need an account for duels. Your profile (username, profile picture, bio, results) is visible to other users so they can challenge you.
• An AI (Claude by Anthropic) reads your proof photo of the machine display. Your opponent in that duel and, in case of a dispute, we can see it; all other users only if you choose to show it in the feed.
• We do not read location data from image metadata, and we remove the metadata from JPEG photos before storing them.
• No ad tracking, no selling of data. Usage statistics and error reports only with your consent.

3. Processing in detail

3.1 Visiting the website (cardioclash.com)

When you visit this website, our hosting provider Vercel processes technically necessary connection data (in particular IP address, time of access, page requested, user agent) in server logs in order to deliver the website and ensure secure operation. The website does not set cookies for analytics or advertising.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).

3.2 Beta sign-up and notifications (Brevo)

You can sign up for beta access using the form on the home page. All we need is your email address. We use it exclusively to notify you about the start of the beta and the availability of the app.

Transition period: Until sign-up via Brevo is live, the form opens a prepared email in your mail app. If you send it, your address reaches us as an email to hello@cardioclash.com. We then add it to the waitlist at Brevo and send you the confirmation email; afterwards we delete the email from our inbox.

Double opt-in: After you submit the form, we send you an email with a confirmation link. Only once you click it do we add you to the waitlist, so that nobody can sign up with someone else's address. The stored time of confirmation and the delivery log of the confirmation email serve as proof of consent.

Email service provider: Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) sends the emails and stores the waitlist as our processor. Brevo stores the data on servers in the EU. We store your email address, the language of your sign-up and the time of confirmation, plus the technically required sending and delivery data (e.g. delivery status).
Legal basis: Art. 6(1)(a) GDPR (consent) for the sign-up and notifications; Art. 6(1)(f) GDPR (legitimate interest in proving consent and in secure delivery) for the logging.

Withdrawal: You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by sending an informal email to contact@cardioclash.com. We then remove your address from the waitlist. We may keep unsubscribed addresses for up to three years solely to prove the earlier consent; on request we delete them sooner.

3.3 Account and profile

To use the app you create an account, either with an email address and password or via “Sign in with Apple” or “Sign in with Google”. If you sign in with Apple or Google, we receive an identifier and, depending on what you share, your email address, name and profile picture. Processing by Apple and Google is governed by their privacy policies.

We store your login data (passwords only as a hash), your username and display name, optionally a profile picture, short bio, region and Instagram and Strava names, as well as your duels, results, personal bests, points, leaderboard positions, badges and monthly goals. If you signed up via an invite link, we store who invited you.

What others see: The app shows your username, display name, profile picture, bio, region, sign-up date, results and leaderboard position to other signed-in users. You decide in the settings whether the app shows your Instagram and Strava names and your personal bests to others. Profile pictures are stored at a public address and can be accessed there without signing in.

The data is stored with our processor Supabase.
Legal basis: Art. 6(1)(b) GDPR (providing the app under the terms of use).

3.4 Friends, feed and crews

Your results appear as posts in the feed, which all signed-in users can see; others can react to them, and you can add a caption. You can add other users as friends, create or join crews and take part in crew duels and the weekly challenge. Crew names and crew pictures are visible to all users; crew pictures are stored at a public address. If you share a duel via a link, anyone with the link sees a preview with your username. If you report or block a user, we store the report including your details, or the block.
Legal basis: Art. 6(1)(b) GDPR (providing the social features); for reports also Art. 6(1)(f) GDPR (legitimate interest in protecting users).

3.5 Duels and proof photos (AI analysis)

To submit a result, you take a photo of your machine's display (rowing, ski or bike erg, treadmill or smartwatch) or pick a photo from your library. The app asks for access to the camera or photos for this; you can revoke the permission in your system settings at any time.

This is what happens with the photo:

• It is uploaded to your area of our storage at Supabase. Your opponent in that duel and, in case of a dispute, we can see it. If you choose to show the photo in the feed when submitting, all signed-in users can see it.
• From the image metadata (EXIF) we only read the capture time and the name of any image editing software, to detect tampering. GPS data is not read. For JPEG photos we then remove the metadata and store the photo without it.
• We create an image fingerprint (hash) to detect photos submitted more than once.
• The photo is sent to Anthropic (Claude), in some cases already during a pre-check before you submit. The model reads time, distance, machine type and other displayed values (e.g. split, power, stroke rate) and assesses whether the photo is plausible. If the photo shows other content, such as a smartwatch route map, it is transmitted too. We store the result together with the duel.

Legal basis: Art. 6(1)(b) GDPR (running the duels); for the tampering checks also Art. 6(1)(f) GDPR (legitimate interest in fair competition for all users).

3.6 Checking profile content

When you change your username, bio or profile picture, we automatically check the content for offensive or prohibited material before it is published. For this, the text or image is sent to Anthropic (Claude). Rejected content is not applied. When we check a username before sign-up, we store your IP address together with a request counter to limit abuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting users from unlawful and hurtful content).

3.7 Push notifications

If you allow notifications, we store your device's push token with your account. We use it to send you updates, such as new challenges or results, via Expo (650 Industries) and the services of Apple or Google. You choose which notifications you receive in the app; when you sign out, your device's token is removed.
Legal basis: Art. 6(1)(a) GDPR (consent by granting the permission).

3.8 Usage statistics (PostHog)

Only if you agree in the app do we use PostHog to record how the app is used: screens viewed, interactions such as tapping buttons, and events such as completed sign-ups, duels created or accepted and results submitted. The data is linked to your account ID, not to your name or email address. There is no screen recording. The data is processed on PostHog servers in the EU. Without your consent the app sends no statistics; you can withdraw your consent in the settings at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).

3.9 Error reports (Sentry)

Only if you agree when setting up the app does it send an error report to Sentry when it crashes or a technical error occurs (error message, affected code location, device type, operating system and app version), plus performance data such as loading times for a share of sessions. We do not transmit your IP address or email address. You can withdraw your consent at any time by emailing contact@cardioclash.com.
Legal basis: Art. 6(1)(a) GDPR (consent).

4. Recipients and processors

We use the following service providers. Where required, we have concluded a data processing agreement with each of them under Art. 28 GDPR.

Transfers to third countries: Several providers are based in the USA. Transfers are based on adequacy decisions under Art. 45 GDPR (EU-US Data Privacy Framework, where the provider is certified) or the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. According to Anthropic, it stores API requests for a limited time (up to 30 days) for abuse monitoring.

Other users see your public profile and your feed posts (see sections 3.3 and 3.4); your opponent in a duel sees your proof photo.

5. Storage period

• Account, profile, duels, results and proof photos: for as long as your account exists. If you delete your account in the app, we delete it immediately, including your profile picture and proof photos.
• Push token: until you sign out on the device or delete your account.
• Beta email address (Brevo): until you withdraw your consent; after that for up to three years solely to prove the earlier consent (see section 3.2).
• Usage statistics and error reports: according to the retention periods of PostHog or Sentry.
• Server logs (Vercel, Supabase): according to the retention periods of the respective provider.

6. Your rights

You have the following rights towards us:

• Art. 15 GDPR: Access to the data processed
• Art. 16 GDPR: Rectification of inaccurate data
• Art. 17 GDPR: Erasure (“right to be forgotten”), directly in the app via “Delete account”
• Art. 18 GDPR: Restriction of processing
• Art. 20 GDPR: Data portability
• Art. 21 GDPR: Objection to processing based on Art. 6(1)(f) GDPR

You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority at your place of habitual residence. An informal email to contact@cardioclash.com is enough to exercise your rights.

7. No obligation to provide data

You are not legally or contractually obliged to provide personal data. Without the data described in section 3, however, we cannot offer the respective function (website, beta sign-up, account, duels).

8. Automated evaluation of results

The AI reads the result from your proof photo, and the duel is scored on that basis. This scoring has no legal effect on you and does not similarly significantly affect you (Art. 22 GDPR). If you think a result is wrong, you can file a dispute in the app. We review disputes ourselves; if we do not decide within 14 days, the original result stands.

9. Changes to this policy

We update this privacy policy when our data processing changes (e.g. new features or service providers). The current version is always available at cardioclash.com/en/datenschutz.