The short version. Strat processes Apple Health activity and, for a live run, precise GPS and motion evidence to verify a running Challenge. That data is linked to your account and sent to Strat’s server. We do not sell it, use it for advertising, track you across other companies’ apps or websites, or provide it for AI-model training.
The controller is Normann Jungbauer, a sole trader established in Austria.
| Business address | Badstrasse 6, 4192 Schenkenfelden, Austria |
|---|---|
| Privacy and support contact | playspeedrun.app@gmail.com |
| Category | Data | Source |
|---|---|---|
| Account and eligibility | Internal user ID; Apple subject ID; email if Apple shares it; public handle; selected country; age-18-or-older confirmation; accepted Terms and Privacy versions and timestamps; account status | You and Apple |
| Health and fitness | Walking/running distance; step counts; hourly aggregates; Apple-provided source/device metadata; manual-entry indicators. If you permit writing, Strat saves a workout with start/end, distance and an active-energy estimate to Apple Health; the current build does not read workout records back. | Apple Health, after permission |
| Precise location and motion | Latitude, longitude, timestamps, horizontal accuracy, speed, altitude, simulated-location indicator, route polyline, steps, cadence, distance and run start/end/duration | iPhone sensors during a live run |
| Challenge and community | Entries, daily progress, participant status, results, leaderboards, winnings, invite/referral relationships, reports and blocks | Your use of Strat |
| Manual verification | Challenge day, claimed distance, optional explanation, review status, reviewer decision, timestamps and audit record | You and the authorised operator |
| Financial and purchase history | Stake and fee quotes, ledger entries, Cash and Promotional balances, payment/payout amounts, status, timestamps and provider references | Strat and Whop |
| Payment-method summary | Provider customer/method reference and, where Whop returns them, card brand and last four digits. Strat does not receive or store the full card number, security code, full bank credentials or identity document images entered on Whop pages. | Whop |
| Device integrity and diagnostics | App Attest key identifier, assertion counters and challenges; app version; iOS version; device model; request ID, IP address, request time, endpoint, response status and security/fraud outcomes | Your device and server requests |
| Support | Email address and the content and metadata of requests you send to support | You |
| Account-closure reconciliation | If money is unresolved when you delete the account, an encrypted copy of the Apple-provided email, the Whop recipient reference and the unresolved financial status are temporarily separated into a restricted operator queue | Existing account and transaction records |
Strat has no advertising or third-party analytics SDK and does not access the iOS advertising identifier. The current build uses local notifications scheduled on your device; it does not upload an APNs push token.
Strat requests only the Apple Health types needed to show activity and verify the Challenge mode you choose. Source and timestamp metadata is needed to exclude manual or implausible activity and prevent one entry from unfairly moving money away from genuine participants.
Strat may save a workout that you deliberately record in Strat back to Apple Health if you grant write permission. It does not write fabricated progress or alter samples created by other apps.
When you start a verified live run, Strat uses precise location in the foreground and, if you lock the phone or temporarily switch apps, in the background until the run is stopped. iOS displays the system location indicator. Strat does not continuously track location outside an active run.
Raw route points leave the phone. They are sent over TLS and stored temporarily with the run so the server can detect teleporting, vehicles, GPS spoofing, implausible speed and inconsistencies between route, time and motion. This corrects an earlier in-app statement that raw GPS remained only on the device.
The IP address and selected country may also be used as coarse region signals to enforce paid-Challenge availability. Strat does not use run routes or region signals for advertising or to infer visits to sensitive places.
| Purpose | GDPR legal basis |
|---|---|
| Create and secure an account; provide Challenges, balances, support and payouts | Contract, Art. 6(1)(b) |
| Read and process Apple Health data | Explicit consent, Arts. 6(1)(a) and 9(2)(a) |
| Record precise location for a live run | Consent, Art. 6(1)(a), and the verification service you request, Art. 6(1)(b) |
| Protect participants and prevent cheating, duplicate accounts, payment abuse and security incidents | Legitimate interests, Art. 6(1)(f) |
| Age, region, sanctions, tax, accounting and financial record compliance | Legal obligation, Art. 6(1)(c), and contract, Art. 6(1)(b) |
| Schedule optional local notifications | Consent on your device, Art. 6(1)(a) |
You may withdraw consent in iOS Settings. Prior lawful processing remains valid. Health, Location and Motion are optional faster verification methods; the permission-free manual-review path remains available for paid Challenge activity and does not create progress until an authorised operator approves it.
| Recipient | Data and purpose |
|---|---|
| Railway | Hosts the API and PostgreSQL database and therefore processes account, Challenge, health, location, financial and technical records on Strat’s instructions. |
| Whop | Processes hosted checkout, saved-payment-method setup, identity/payout onboarding, payment, refund and payout events. Whop receives the data you enter on its pages and the amount, account reference and transaction context Strat supplies. |
| Google (Gmail) | Hosts the published support mailbox and therefore processes the address, content and ordinary email metadata of messages you choose to send to support. Do not email card numbers, passwords, identity documents or Apple credentials. |
| Apple | Provides Sign in with Apple, Apple Health, location permission and App Attest. Strat validates Apple tokens and integrity responses. Apple Health samples are read only after your permission. |
| Authorities and advisers | Only data reasonably required by valid law, tax duties, legal claims, fraud investigation or protection of users and the Service. |
Strat does not sell personal data and does not share it for cross-context behavioural advertising. Providers may act only under their own published terms for data you give them directly or under contracts appropriate to their role.
Your handle, Challenge participation, progress, placement, result and aggregate verified distance may be visible to other users. Email, raw GPS route, exact Health samples, balance and payment summary are not public.
You can report a public handle/profile and block another user in the app. Reports are reviewed for safety, fraud and Terms enforcement. Blocking changes what the two accounts see; it does not erase financial or Challenge records that must remain accurate.
| Data | Normal period |
|---|---|
| Accepted raw GPS route points | Up to 30 days after the run, then coordinates are removed while a non-location verification result and run summary may remain |
| Rejected or fraud-flagged run records | Up to 90 days; the current automated job then deletes the run row and its raw evidence |
| Health hourly aggregates | While the account is active; they are deleted when the account closes. Derived Challenge-day results may remain with the competition record for disputes and accounting. |
| Financial, payment, payout, tax and ledger records | At least 7 years or the period required by applicable law |
| Eligibility acceptance, material fraud and account-deletion audit record | Up to 7 years where needed to establish compliance or prevent repeat abuse |
| Sessions | Up to 90 days, and revoked earlier on logout or account closure |
| Operational application logs | Method, path, status and duration only; no request body, bearer token or account identifier is intentionally logged by the application. Railway retains captured deployment logs for 7, 30 or at most 90 days depending on the active hosting plan. |
| Public profile and payment-method display summary | Until changed, removed or the account is closed |
| Encrypted closure contact | Until financial reconciliation finishes or 30 days after closure, whichever comes first; provider and accounting references may remain with the restricted financial record where legally required |
| Website launch-waitlist address | Until you withdraw, until the launch email has been sent, or 12 months from signing up if the app has not been released — whichever comes first. See section 14. |
Automated cleanup removes or minimises eligible records. A narrowly scoped legal hold pauses deletion only for the data and period needed to resolve it. Backups age out under the hosting provider’s backup cycle and are not restored to recreate a deleted live profile.
Health, Location, Motion and Notifications are controlled in iOS Settings. You can deny or revoke them and use the manual-review path for paid Challenge activity. A manual claim requires no Health, Location, Motion, Photos, Camera, Push or Tracking permission and remains pending until reviewed.
Depending on where you live, your rights include access, correction, portability, deletion, restriction, objection, withdrawal of consent and a complaint to your data-protection authority. California and other covered US residents may also request the categories, sources, purposes and recipients of their information and exercise applicable correction/deletion rights without discrimination. Strat does not sell or share personal information for targeted advertising, so there is no sale/share opt-out to operate.
In-app deletion: Profile → Account → Delete Account starts the permanent process and explains unresolved entries, payouts and retained records. After confirmation, Strat revokes sessions and the Sign in with Apple connection where possible, anonymises public identifiers and deletes data that has no continuing lawful retention basis. You may also contact the address below. Verification may be required for an emailed request.
Financial and fraud records that must be retained are access-restricted and separated from the deleted public identity; deletion never silently changes a settled prize pool or accounting record.
Railway and Whop may process data in the United States and other countries in which they operate. For EEA, UK and Swiss data transferred to a country without an adequacy decision, Strat relies on an applicable transfer mechanism such as Standard Contractual Clauses and appropriate supplementary measures. Provider locations and mechanisms must also be reflected in Strat’s current processor agreements.
No system is perfectly secure. Report a suspected vulnerability privately to the contact below.
Strat is intended only for adults and does not knowingly permit an account for anyone under 18. Registration requires an age declaration. If Strat learns that a minor created an account, the account is closed and data is deleted or retained only where law strictly requires it.
For privacy requests, support or security reports:
Normann Jungbauer
Badstrasse 6, 4192 Schenkenfelden, Austria
playspeedrun.app@gmail.com
EU users may complain to their local supervisory authority or the Austrian Data Protection Authority at dsb.gv.at.
This section covers only the email form on the Strat website. It is separate from everything above, which describes the app: joining the waitlist creates no account, and nobody on the list has agreed to the Terms or has any balance.
| Controller | Normann Jungbauer, Badstrasse 6, 4192 Schenkenfelden, Austria — playspeedrun.app@gmail.com |
|---|---|
| What is collected | Your email address. Alongside it we store which part of the page you submitted from, the language your browser reports, and the country our host observed, if any. Nothing else is asked for and nothing else is stored — no name, no phone number, no date of birth. |
| Purpose | To send you one email when Strat is released, and for nothing else. |
| Legal basis | Your consent, Art. 6(1)(a) GDPR, given by ticking the box next to the form. Providing the address is entirely voluntary; there is no contract or legal obligation behind it, and nothing is withheld from you if you do not. |
| Recipients | Railway Corp., which hosts the server and database the address is stored on. No email service provider is engaged at the time of writing, which is why no launch email has been sent yet; when one is engaged it will be named here before any email goes out. The list is never shared with advertising platforms and is never uploaded as a custom audience. |
| Retention | Deleted immediately when you withdraw. Deleted once the launch email has been sent and the purpose is exhausted, unless you have separately become a Strat user by then. Deleted in any case within 12 months of signing up if the app has not been released. |
| Withdrawing | Use the unsubscribe link in any email we send, or write to playspeedrun.app@gmail.com. Withdrawal takes effect for the future and does not make the earlier processing unlawful. Withdrawing deletes the record rather than flagging it. |
Your rights of access, rectification, erasure, restriction, portability and objection apply to this list exactly as set out in section 9, as does the right to complain to a supervisory authority (section 13).
The website itself loads no third-party resources at all — no analytics, no advertising pixels, no embedded fonts, no consent banner — so visiting it stores nothing on your device and discloses nothing about you to anyone but the host serving the page.