This policy covers the RadlBock app: the training hub (web interface and server) and the desktop app that records workouts. The website privacy policy covers this website.

Last updated: October 2026

Controller

André Munzinger, Germany
For questions about your data or to exercise your rights, please use the contact page.

What data the app processes

The app stores your training. Much of it is health data (Art. 9 GDPR):

• Name and account settings, training zones, equipment
• Activities: duration, distance, power, cadence, speed, laps
• Heart rate, heart-rate variability (RR intervals), resting heart rate, VO2max estimates
• Sleep, steps, body weight and other body metrics
• Daily and weekly check-ins (fatigue, soreness, stress, mood) and test results
• GPS tracks. They show where you trained and can reveal where you live.
• Training plans, workouts and scheduled sessions

The desktop app also keeps, on your own computer, which sensors (heart-rate strap, trainer) were connected recently, and recordings that have not yet been sent to the hub.

Purpose and legal basis

The data is used only to show you your own training, analyses and training plans. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give on first use and can withdraw at any time. There is no advertising, no profiling for advertising and no sale of data.

Where the data is stored

The hub runs on a self-operated server in Germany. The data is stored in a database there and is not transferred to a cloud provider. Other users of the same hub cannot see your data. Access credentials for connected accounts are stored encrypted; passwords for Garmin Connect and Polar Flow are used once to sign in and are not stored.

Connected accounts

You decide which accounts to connect. Each connection can be removed in Settings.

• Polar (AccessLink): the app reads training sessions, sleep and nightly recovery values (resting heart rate, heart-rate variability). No data is sent to Polar AccessLink.
• Polar Flow (training targets), only if you turn it on: the app creates planned workouts (name, date, sport, interval structure) as training targets in Polar Flow so they appear on your watch.
• Garmin Connect: the app reads activities. If you turn it on, it uploads activities recorded in RadlBock or imported from other sources to Garmin Connect as files.
• Withings: the app reads body measurements (such as weight) and activity data (scopes user.info, user.metrics, user.activity). No data is sent to Withings.
• Runalyze: the app reads activities using an API token you create.

These providers' own privacy policies apply to the processing on their side. When you disconnect an account, the stored access credentials are deleted; data already imported stays until you delete it or your account.

Other services

• Maps: map images come from the OpenStreetMap tile servers, which see your IP address and the map area you view. Road data for the 3D view comes from the Overpass API (areas along your routes) and country names from Nominatim (one point of a route).
• Route builder: points you draw go to OpenTopoData (elevation) and, if configured, OpenRouteService (road snapping).
• Video workouts are played from YouTube in privacy-enhanced mode. YouTube sees your IP address and what you watch.
• Telegram reminders, only if you turn them on: reminders and your check-in answers go through Telegram.
• Calendar subscription, only if you set it up: your calendar app fetches your planned sessions through a secret link. Anyone with the link can read the calendar; you can renew the link at any time.

How long data is kept

Your data is kept as long as your account exists. You can delete individual activities and measurements at any time. Deleting your account removes all of your data from the server.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw your consent at any time. In the app, Settings → Privacy lets you download everything stored about you, withdraw your consent and delete your account. You can also lodge a complaint with a data protection supervisory authority.