Privacy policy

Last updated: May 2026

1. Controller

The controller within the meaning of the GDPR for the processing of personal data on this platform is:

René Voglmayr
Finkengang 5
4048 Puchenau, Austria
Email: rene@voglmayr.com

2. What data we collect and why

2.1 Registration and account

When you create an account with 50runs, we process the following data:

  • Display name and username
  • Email address
  • Password (stored as a cryptographic hash, never in plain text)
  • Profile picture (optional, uploaded by you)
  • Profile description and donation recipient (optional)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The email address is used to confirm your account and for important system notifications.

2.2 Running activities

Running activities entered manually or synchronised via Strava or Garmin are stored with the following data: date, distance, duration, activity type and visibility setting. This data forms the basis for challenges, statistics and the community feed.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.3 Posts and comments

When you publish posts, comments or reactions, this content is stored together with your profile name and the timestamp. Public posts are visible to all logged-in users.

Legal basis: Art. 6(1)(b) GDPR.

2.4 Server-side logs

Our web server stores technical data with every access (requested URL, timestamp, IP address, browser identifier). These logs serve exclusively to ensure the secure operation of the platform and are deleted after 14 days at the latest.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

3. Cookies and session data

We only use technically necessary cookies that are required for the operation of the platform. No tracking or advertising cookies are used.

  • session_token: Authentication cookie that identifies your login session. Validity period: 7 days (14 days with “Stay logged in”).
  • csrf_token: Security cookie to protect against cross-site request forgery attacks. Validity period: 7 days.

Both cookies are restricted to our domain and are not transmitted to third parties. Legal basis: Art. 6(1)(f) GDPR.

4. Third-party providers used

4.1 Vercel (hosting)

The platform is hosted on the infrastructure of Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. When you visit the website, your requests are processed via Vercel's global network. Vercel is certified under the EU-US Data Privacy Framework. Privacy policy: vercel.com/legal/privacy-policy

4.2 Vercel Blob (image storage)

Profile pictures, team covers and challenge images are stored in Vercel Blob, an object storage service provided by Vercel Inc. (see above). The files can be accessed via a public URL for as long as the account exists.

4.3 Resend (email delivery)

Transactional emails (account confirmation, team invitations) are sent via Resend Inc., 2261 Market Street #4990, San Francisco, CA 94114, USA. In the process, your email address is transmitted to Resend. Privacy policy: resend.com/legal/privacy-policy

4.4 Strava (activity synchronisation)

When you connect your Strava account, you grant us access to your running activities (distance, duration, date, activity type). We only retrieve the data you have approved and store it locally. The connection can be disconnected at any time in the settings. Strava Inc. is an independent controller for the data in your Strava account. Privacy policy: strava.com/legal/privacy

4.5 Garmin (activity synchronisation)

When you connect your Garmin account, 50runs synchronises your running activities automatically via Garmin webhook. The following data is processed: activity type, start time, distance and duration. The connection can be disconnected at any time in the settings. Garmin Ltd. is an independent controller. Privacy policy: garmin.com/de-AT/privacy/connect/

4.6 Anthropic / Claude (AI assistance)

For optional AI features (generating challenge descriptions, profile biographies and team descriptions), the text you enter is transmitted to and processed by the API of Anthropic PBC, 548 Market St., PMB 90375, San Francisco, CA 94104, USA. Use of this feature is voluntary. No data is stored permanently at Anthropic. Privacy policy: anthropic.com/legal/privacy

4.7 Bunny Fonts (fonts)

We use the privacy-friendly font service Bunny Fonts by BunnyCDN (bunny.net). Unlike Google Fonts, no IP addresses are stored permanently or transmitted to Google. Privacy policy: bunny.net/privacy

5. Data sharing and third countries

Some of the providers mentioned above (Vercel, Resend, Anthropic) are based in the USA. Transfers take place on the basis of standard contractual clauses (Art. 46(2)(c) GDPR) or certification under the EU-US Data Privacy Framework. We do not pass your data on to third parties unless this is necessary to provide the services described above or we are legally obliged to do so.

6. Retention period and deletion

Your data is stored for as long as your account is active. After an account is deleted, all personal data (profile, activities, posts) is deleted within 30 days, unless statutory retention obligations apply. Uploaded images in Vercel Blob are removed at the same time. Server-side logs are deleted after 14 days at the latest.

7. Data security

All communication with 50runs is encrypted via HTTPS (TLS). Passwords are stored exclusively as Argon2id hashes and cannot be viewed by us. Session tokens are generated cryptographically at random and validated server-side. We use CSRF protection, rate limiting and HTTP security headers (HSTS, CSP, X-Frame-Options).

8. Your rights

Under the GDPR, you have the following rights. To exercise them, simply send an email to rene@voglmayr.com:

  • Access (Art. 15 GDPR): What data we store about you.
  • Rectification (Art. 16 GDPR): Correction of inaccurate data.
  • Erasure (Art. 17 GDPR): Deletion of your personal data.
  • Restriction (Art. 18 GDPR): Restriction of processing.
  • Data portability (Art. 20 GDPR): Export of your data in a machine-readable format.
  • Objection (Art. 21 GDPR): Objection to processing based on legitimate interests.

You also have the right to lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at

9. Changes to this privacy policy

We reserve the right to update this privacy policy in the event of significant changes to the platform or the legal situation. The date of the current version is stated above.