隐私政策

This English translation is provided for information only. The Polish version is the binding version.

This Policy explains what personal data we process in the BEON.RUN service (https://beon.run), for what purposes, on what legal basis, to whom we disclose it, how long we keep it and what rights you have. It fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).

§ 1. Controller

1. The controller is Radosław Balcerzak, a sole trader operating under the business name balcerzak.it RADOSŁAW BALCERZAK, NIP 7631978291, REGON 300843692, address: ul. Słoneczna 11/B, 64-730 Rosko, Poland (the “Controller”, “we”).
2. Contact on personal data matters: e-mail [email protected] (in Polish or English; messages are read and answered by a person) or by post to the address above. The contact details are also available on the Contact page. The Controller has not appointed a data protection officer.

§ 2. What data we process

1. Account data: e-mail address, password hash (never the password itself), display name, language, Account status, dates of creation, verification and last login.
2. Profile: username, bio, location text you type, profile picture (re-encoded without EXIF metadata), visibility settings.
3. Activities and GPS: activity type, times, distance, pace or speed, route points (latitude and longitude, accuracy, altitude, speed, heading, time), routes and GPX files, goals, records, badges, challenges, calendar.
4. Streams: video and audio from the camera and microphone (transmitted live), title, description, visibility, times, viewer counters; the list of signed-in viewers shown to the broadcaster (see § 6); technical connection data (publisher sessions, tokens, presence - kept briefly).
5. Diagnostics of test versions of the app: in versions of the mobile app marked as test versions (e.g. closed testing on Google Play) we collect additional technical diagnostic data: app lifecycle events, the course of GPS measurement (numbers of points, accuracy ranges, gaps, state of the upload queue - no coordinates), the course of Streams and reconnections, chat statuses (no content), the course of store purchases (product identifiers and statuses - no purchase tokens), statuses of health and sensor integrations (no measured values), app errors (type and place in the code), server response times and device information (manufacturer, model, system version, ranges of battery level, memory and storage, permission states - no hardware or advertising identifiers). The data is linked only to a pseudonymous identifier (a cryptographic hash of the Account) and an app-run identifier. The test version informs about this at its first start. The data is not passed to analytics tools.
6. Broadcaster connection diagnostics: technical parameters of the connection and the video during a Stream (e.g. network type, round-trip time, packet loss, bitrate, number of reconnections, state of the upload queue, app version and system) together with the Account and Stream identifiers. They never include location, health or sensor data or chat content and are not passed to analytics tools (including Firebase and Google Analytics).
7. Recordings and Story videos: video files and their metadata (recordings - only in Plans with recording; Story videos - created at your request, § 5).
8. LIVE reactions: quick reactions (e.g. ❤️ 🔥 👏 💪) sent during a Stream. We do not record who tapped and when - the database keeps only the total number of reactions of a Stream per minute (reaction type, count, approximate number of people) - § 5.
9. Voice cheers: a short voice recording (at most about 4 seconds) recorded and sent by a signed-in Viewer, the display name of the sender, the chosen audience (“everyone” or “broadcaster only”), the times it was sent and played and its status (e.g. skipped, reported, blocked) - § 5.
10. Guest nickname: the name you give when watching a Stream or chatting without an Account - § 6.
11. App preferences: chosen in the initial setup or in the settings: goals (e.g. activity tracking, LIVE), your sports and default sport, LIVE defaults (visibility, chat, reactions, reading messages aloud, microphone) and the progress of the initial setup.
12. Devices and sensors: the list of devices connected to your Account (name, manufacturer, model, type, supported measurements, platform, dates of use and synchronisation) and cadence, speed and power measurements assigned to Activities. The server currently does not store heart rate - § 5a.
13. Body weight (optional): if you enter it (in the app's first set-up or in Account → Privacy), we store the weight in kilograms and the date and time of your consent - § 5a.
14. Ghost and event mode: effort records shared as a ghost and participation, consents and results in events - § 4.
15. Privacy choices: your sharing decisions (e.g. sharing an Activity as a ghost, consent to share your location in an event) with the history of granting and withdrawing them (date, version).
16. Chat and community: chat message content, guest name (if you write without an Account), comments, likes, follows, notifications; moderation state (blocks, mutes - temporary).
17. Group activities and events: invitations, participation, choice of GPS/Stream sharing, event registrations, tracking consents; for Organizers - organizer data (name, legal form, address, contact person, optionally NIP, REGON, KRS).
18. Web Push notifications: the browser endpoint address and encryption keys (needed for delivery) and the browser and OS family (e.g. “Chrome · Android”).
19. Mobile app and in-app push notifications: a random installation identifier, platform (iOS / Android), app version, language, the notification token issued by Google Firebase Cloud Messaging or Apple Push Notification service, whether notifications are on, the chosen notification categories (including consent to the “BEON.RUN news and offers” category), dates of the last contact and the result of the app authenticity check (no hardware data that would identify you).
20. Last approximate location: one point rounded to about 1 km (coordinates to 0.01°), its source and the update date - see § 4(9).
21. Payments: Stripe customer and subscription identifiers, Plan, period, status. For a purchase in the app in the App Store or on Google Play: the store transaction / subscription identifier, product (Plan and period), dates, status (e.g. active, renewed, cancelled, refunded), environment (production / test) and any promo code. We do not store payment card data or Apple ID / Google account data.
22. Creator Support: data described in § 7.
23. Document acceptances: Account identifier, document, version, date and time, and IP address at the time of accepting documents that require acceptance (currently the Support Recipient Terms).
24. Technical data: IP address (used for abuse protection as a rate-limit key and recorded in server logs), a random browser or app-installation identifier (to recognise the device during a running Activity and for the queue of data sent once coverage returns), cookies and browser storage (see the Cookie Policy), analytics data - only with consent (§ 8).
25. Support requests (Help / Support): reply e-mail address, category, subject, message, language, request number, the link to your Account (if you write while logged in), identifiers you give (e.g. of an Activity, Stream or order), the page the form was sent from and - only if you leave "Technical information" ticked - browser, system, screen size, language and time. We never collect passwords, cookies or tokens.
26. E-mail delivery log: recipient address, type of message, language, status and time of sending, number of attempts and the category of any error - without the message content. We do not use tracking pixels in e-mails.

§ 3. Purposes and legal bases

• Creating and maintaining the Account, providing the Service (Activities, Streams, GPS, chat, social features, groups, events, recordings, data export) - Article 6(1)(b) GDPR (performance of a contract).
• Handling paid Plans - Article 6(1)(b) GDPR; keeping billing records - Article 6(1)(c) GDPR (tax and accounting obligations).
• Handling Creator Support (Recipient status verification, payment register, statements, fee) - Article 6(1)(b) GDPR for Support Recipients; Article 6(1)(f) GDPR for Supporters (enabling the payment and displaying the message); Article 6(1)(c) GDPR for tax obligations, possibly including DAC7.
• Transactional e-mails (e.g. address verification, password reset and change, subscription status, support confirmations and replies, event decisions) - Article 6(1)(b) GDPR; optional e-mails (event reminders, news, commercial information) - only with your consent in the Account settings (Article 6(1)(a) GDPR), with an unsubscribe link in every message.
• BEON.RUN newsletter (marketing e-mail: news, tips, offers) - only with your consent (Article 6(1)(a) GDPR in conjunction with Article 398 of the Polish Electronic Communications Law). You can give it by ticking a separate, optional box at sign-up (also when signing up with Apple or Google), by answering a one-time question in the Service or the app, or in Account → Notifications. Consent is not a condition for creating an Account or using the Service. You can withdraw it at any time - with the "unsubscribe" link in every message or in Account → Notifications; withdrawal does not affect the lawfulness of earlier mailings. We keep the history of giving and withdrawing consent (date, version of the consent text, where it was given) - Article 6(1)(c) and (f) GDPR (accountability, defence of claims) - for as long as the Account exists; deleting the Account deletes this history too. The newsletter is sent to your Account e-mail address; if you chose to hide your address when signing up with Apple, messages go through Apple's relay.
• Handling support requests - Article 6(1)(b) GDPR where the request concerns your Account or the services you use, and Article 6(1)(f) GDPR (legitimate interest: answering enquiries, documenting the handling).
• Protecting forms against bots and abuse (Cloudflare Turnstile) on the Help / Support, sign-up and password reset pages - Article 6(1)(f) GDPR (security of the Service). This is not analytics and does not depend on the statistics consent.
• Web Push and in-app push notifications about using the Service (e.g. a followed person starting a Stream, reminders, comments, service information about changes and outages) - Article 6(1)(b) GDPR; sent only if you turn notifications on for a given device.
• Marketing push notifications (news, Plan promotions, offers) - only with your consent given by turning on the “BEON.RUN news and offers” category (Article 6(1)(a) GDPR in connection with Article 398 of the Polish Electronic Communications Law). Consent is voluntary, off by default and can be withdrawn at any time in the notification settings; withdrawal does not affect the lawfulness of earlier messages.
• Sending information to people in a given area (e.g. about an event or an outage in a region) based on the last approximate location - Article 6(1)(f) GDPR (legitimate interest: informing users about matters relevant to their area); for marketing content - only to people who gave the consent described above. You may object (§ 13) - we then stop using your location for this purpose.
• Security, abuse prevention, content moderation, handling notices and appeals - Article 6(1)(f) GDPR (legitimate interest) and Article 6(1)(c) GDPR (obligations under Regulation (EU) 2022/2065).
• Diagnostics and reliability of Streams and of test versions of the app (technical data of the broadcaster's connection and diagnostics of test versions) - Article 6(1)(f) GDPR (legitimate interest: keeping the service working and its quality).
• Handling complaints - Article 6(1)(c) GDPR (Consumer Rights Act) and (b).
• Proof of document acceptance, establishing, pursuing and defending claims - Article 6(1)(f) GDPR.
• Retaining payment, refund, dispute, fee, settlement and payout records after Account deletion (§ 12(3)) - Article 6(1)(c) GDPR (tax and accounting obligations) and Article 6(1)(f) GDPR (establishing, exercising and defending claims, fraud prevention).
• Interaction and activity features (LIVE reactions, voice cheers, the list of viewers with guest nicknames, Ghost, Activity Story, event mode, initial setup and preferences, the LIVE readiness test, sensors and the watch) - Article 6(1)(b) GDPR (performance of the contract - you use these features on your own initiative). Sharing your effort with other people as a ghost and sharing your location in an event happen only on the basis of your choice, which you can change at any time.
• Mobile app usage statistics (Google Analytics for Firebase) and measuring the effectiveness of our ads in the app (Google Ads, Meta) - if the feature is switched on - Article 6(1)(a) GDPR (consent in the app, off by default; on iPhone ad measurement additionally only with tracking permission) in connection with Article 399 of the Polish Electronic Communications Law (§ 8).
• Ads in the mobile app on the FREE Plan (Google AdMob) - if the feature is switched on - consent collected through Google's form where required (Article 6(1)(a) GDPR in connection with Article 399 of the Polish Electronic Communications Law); ads are non-personalised (§ 8).
• Visit statistics (Google Analytics 4) - Article 6(1)(a) GDPR (consent) in connection with Article 399 of the Polish Electronic Communications Law.
• Measuring the effectiveness of our ads (Google Ads conversions) - Article 6(1)(a) GDPR (marketing consent in the cookie banner) in connection with Article 399 of the Polish Electronic Communications Law (§ 8).
• Necessary cookies - Article 6(1)(b) and (f) GDPR; no consent is required for storage necessary to provide the service (Article 399(3) of the Electronic Communications Law).

Providing data when creating an Account is voluntary but necessary to create it. Sharing location, camera and microphone is voluntary - without them the related features cannot be used.

§ 4. Location (GPS)

1. Route location is collected only when you enable GPS before starting an Activity or Stream and allow it in the browser or in the device settings. The GPS state (active / disabled) is always visible. We do not collect location covertly. Point 9 describes the one exception (last approximate location).
2. The current position is kept briefly in the server cache (Redis) and expires automatically (about 10 minutes after the last update); auxiliary data of an active Activity - at most 24 hours. The position is delivered to Viewers who have access to the Stream.
3. The route history is stored in the database in sampled form (not every reading), after rejecting obviously wrong points. It is visible to you; to others only according to your visibility settings. After a Stream ends, Viewers see only a summary unless you share the route.
4. You can hide the start and end of a published route and the area around the start in live tracking (200 m, 500 m or 1 km) to make it harder to identify e.g. your home address - the “Hide the start and end of the route” setting in your Profile (web: Account → Profile and privacy zone; app: Account → Edit profile). For Accounts created from 3 October 2026 the initial setting is “Do not hide”; older Accounts keep their setting (200 m by default). You always see the whole route.
5. When you are offline, unsent GPS points are kept temporarily in browser storage (IndexedDB) and deleted once sent, when the Activity ends or after 24 hours.
6. We do not write coordinates to server logs. We do not send GPS data to analytics tools.
7. In Organizers' events your position is visible to the event's Viewers only after you consent to tracking for that event; you can end it.
8. Event mode (live results). If an event uses event mode, when you check in you choose whether to share your location during the event (default: no) and whether to respect your privacy zone (default: yes; switching it off applies to that event only). You can change your choice at any time, also during the event. When you share your location, Viewers and the Organizer see your position, progress along the route, checkpoint, place and estimated finish time. When you do not, they only see that you are taking part with a private location - no position, progress, place, estimated time, checkpoints or finish time while the event runs. After the event, the results list (place, GPS time, status, checkpoint completeness - marked as unofficial) is visible according to the event's visibility, including participants who did not share their location. We record every grant and withdrawal of consent with its date and version. Live positions in an event are kept only in the server cache and deleted when the event ends.
9. Ghost. You can race against your own earlier effort. If you choose “Share as ghost” for an Activity (Friends - people you follow mutually - or selected people; default: nobody), those people may - in Plans that include the feature - race against a record of your effort: a simplified route without the first and last 200 m (or without the section set in your privacy zone, if longer), your pace along it, the result and your display name. We never share your exact start and finish, raw GPS points, heart rate or other health data, photos or comments this way. You can withdraw your choice at any time - the record can then not be used for new races (a race already running is not stopped). Records held by other people are deleted with your Account. If you show the ghost to Viewers during your Stream, they see how far you are ahead of or behind it - never the ghost's route, and for a friend's ghost not their name either.
10. Location monitoring may require a data protection impact assessment.
11. Last approximate location. We keep one point per Account, rounded to about 1 km, taken from (a) the start point of your GPS Activity or (b) the mobile app when it starts or you sign in - only if you have already given the app access to location (the app never asks for it for this purpose), at most once every few hours. A new point replaces the previous one. It is never shown to other users or written to logs; we use it only to send information to people in a given area (§ 3). You can turn location access off in your phone settings at any time; it is deleted with the Account and you may ask for its earlier deletion (§ 13). It is included in the “Download my data” export.

§ 5. Streams, image and recordings

1. Stream video and audio are delivered through our media server to Viewers in real time. Without recording enabled they are not stored permanently.
2. Recordings (in Plans with recording) are private: accessible to you and - in justified cases, logged in the audit log - to the Service administrators. They are deleted automatically after the retention period of the Plan (e.g. 180 days), earlier on your request or together with the Account. They are not backed up.
3. If other people appear in your Stream, you decide on the broadcast and are responsible for the lawful use of their image (see the Terms, § 6).
4. LIVE reactions. If the broadcaster switched them on, Viewers can send quick reactions. The broadcaster and Viewers see reactions without who sent them. Individual taps are counted only in the server cache (at most 2 minutes); we permanently keep only the total number of reactions of a Stream per minute.
5. Voice cheers. If the broadcaster switched voice cheers on, a signed-in Viewer can record a short cheer (at most about 4 seconds). The microphone is used only after you open the cheer panel and only with the permission given in the browser or the system. Before sending you choose who hears the cheer: “Play to everyone” (default - the broadcaster and all Viewers of that Stream) or “Broadcaster only”. The cheer is played automatically and your display name appears over the Stream video. The broadcaster does not see your Account identifier or e-mail address. The broadcaster can skip the cheer, report it or block the person who sent it. We delete the recording file after 24 hours; a cheer reported by the broadcaster is kept as evidence for up to 30 days and then deleted. How many cheers you can send depends on your Plan (shown before you record). Cheers are not included in Story videos and are not kept by us beyond the periods above; remember, however, that a played cheer may be heard in the Stream and recorded by other people.
6. Activity Story. At your request our server creates a short video of your Activity: the route shape (in a local scale, without coordinates, map or place names; start and finish are hidden if you set a privacy zone in your Profile), statistics, elevation, splits, records, highlights, the ghost result (for a friend's ghost - only their display name), Viewers' reaction counts and - in Plans with recording, if you want - clips of your own Stream recording. The video is private; you share it yourself, through your device's share sheet or an unlisted link (random, not indexed, can be switched off, expires with the video). The video, thumbnail and link are deleted automatically after 7 days (FREE Plan), 30 days (PREMIUM) or 90 days (PLATINUM), earlier at your request or with the Activity or Account. A Story contains no Viewers' voice recordings and no heart-rate data.
7. Initial setup and LIVE readiness test. In the app you can go through the initial setup (goals, sports, how you track, LIVE defaults). We store the chosen settings on your Account (§ 2) so you have them on every device; the front / back camera choice is stored only on the device. The camera test runs only on the device - no image is sent. The LIVE readiness test sends a data sample (up to 1 MB) to the server, used only to measure the connection speed and discarded at once - it is not stored or logged; the test creates no Stream and publishes nothing.
8. Watch. The iPhone app checks on the device whether an Apple Watch is paired, has the BEON.RUN app installed and is reachable, and at your request sends a test signal to the watch. This information is not sent to our server and the watch model is not read.

§ 5a. Sensors, devices and health data

1. At your request the app can connect to Bluetooth sensors (e.g. a heart-rate strap, a cadence, speed or power sensor) and, if you switch it on, to Apple Health or Health Connect. Connecting and reading happen on the device; we do not upload Bluetooth addresses or hardware identifiers of sensors.
2. On the server we store the list of connected devices (§ 2) and cadence, speed and power measurements assigned to Activities. You see them; other people see only the values you choose to show during a Stream (default: none) - without device names or history, and only while the Stream runs.
3. Heart rate is health data. The server currently does not accept heart rate: heart-rate samples sent by the app are discarded without being stored, summarised or shared. Before we start storing heart rate we will ask for your explicit consent (Article 9(2)(a) GDPR) and update this Policy.
4. Body weight and estimated calories. Entering your weight is optional. Weight is health data, so we store it only on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the consent box when saving the weight. We use it only to estimate the calories burned in your Activities: the estimate is computed on the fly from the Activity type, active time, average speed (when GPS was on), the chosen intensity (GYM workouts) and the weight; it is not stored separately. If your Apple Watch recorded the Activity, under the same consent we store with the Activity the total active energy (kcal) measured by the watch and show it instead of the estimate; we do not store the heart rate itself. Withdrawing the consent also deletes these values. Only you see the weight and the calories - we do not show them to Viewers, followers or on public pages and we do not pass them to analytics or advertising tools. You can withdraw your consent at any time by deleting the weight in Account → Privacy (on the website or in the app) - we then delete the weight and the consent date and stop showing calories; withdrawal does not affect the lawfulness of earlier processing. We keep the weight until you delete it or your Account; it is included in the copy of your data (export).
5. We do not pass sensor data or Apple Health / Health Connect data to analytics or advertising tools.

§ 6. Visibility of data to others

• Public - profile, Activities, Streams, routes and events visible to everyone, including search engines; a public profile may show badges and the numbers of followers and followed accounts.
• Unlisted - visible to anyone with the link; not indexed and not shown in lists.
• Private - only for you (and participants of a private group, where applicable).
• Goals, records and statistics are private. Chat messages are seen by everyone with access to the given Stream. Your display name is shown with your messages and comments.
• List of viewers: the broadcaster of a Stream can see which signed-in people are watching it at the moment - the display name and profile photo (avatar), and for a public profile also the username. People watching without an Account who gave a nickname (e.g. for the chat) may be shown to the broadcaster under that nickname - without message content; other people without an Account are shown only as a number. A guest nickname is kept only in the server cache and disappears from the list about 75 seconds after the last presence signal. Only the broadcaster (and the Service's administrators) can see the list, other viewers cannot; it exists only while you watch and shortly after (server cache) and is not stored in the database. Public and unlisted Streams can be watched without signing in - then you are not shown by name.
• Voice cheers: your display name and the recording are available to the broadcaster and, if you choose “Play to everyone”, also to all Viewers of that Stream (§ 5).
• A public Stream address does not reveal your e-mail address or internal identifiers.

§ 7. Payments and Creator Support

1. Subscriptions: payments are handled by Stripe under Managed Payments - a Stripe group entity - Link, LLC (United States) - is the seller of the subscription and processes payment and billing data (including card data, billing address, invoice details) as a separate controller under its own privacy policy. We receive and store only customer and subscription identifiers, the Plan, period and status.
2. Subscriptions in the app (App Store, Google Play): the seller is Apple (in the EU - Apple Distribution International Ltd., Ireland) or Google, which process payment data and store-account data as separate controllers under their own privacy policies. To link the purchase to your Account the app passes the store a random Account identifier (no e-mail or name), and our server checks the purchase with the store API and receives notifications about its changes (renewal, cancellation, refund). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
3. Support - Supporters: the payment is processed by Stripe for the Support Recipient (the seller of that payment). We store payment metadata: amount, currency, date, status (including refunds and disputes), context (Stream, Activity or profile), Stripe transaction identifiers, the signature you enter or the “anonymous” flag, the message (if you add one), whether it was hidden (by the Support Recipient or BEON.RUN) and - if you are logged in - the link to your Account. In the Service the Support Recipient sees the amount, the signature (unless you choose anonymity) and the message; as the payment is made on the Recipient's Stripe account, the Recipient may see in their Stripe dashboard the transaction data collected by Stripe under Stripe's rules. We do not receive card or BLIK data.
4. Support - Support Recipients: identity verification (KYC), bank details and documents are collected and stored by Stripe - we do not receive them. In the Service we keep a settlement profile: recipient type (individual / sole trader / company), country, e-mail, Stripe connected account ID, verification status and the account capabilities and requirements reported by Stripe, as well as the declaration of being of age. We collect the full name or name, business name, address, tax residence and NIP or other tax identification number only when required by law (e.g. for invoicing the fee or DAC7 reporting) - we do not collect them at present. We do not store PESEL numbers, document numbers, bank accounts or document scans. We also keep Support settings, goals, the payment register with the fee, payouts synchronised from Stripe and monthly statements.
5. We share with Stripe the data needed to create a connected account (e.g. e-mail, display name, profile address). Stripe acts towards the Support Recipient under its own agreement (Stripe Connected Account Agreement / Stripe Services Agreement).
6. If the Provider turns out to be a reporting platform operator under the rules implementing Directive (EU) 2021/514 (DAC7), it may have to collect additional data from Support Recipients (e.g. date of birth, tax identification number, account number) and report it to the Head of the National Revenue Administration.

§ 8. Analytics and ads

1. We use Google Analytics 4 only after you consent in the cookie banner (the “Analytics” category) and only on selected public pages (e.g. home, pricing, feature pages, registration, login, stream and event lists). Analytics never runs in the logged-in app or on Stream, profile or route pages.
2. We use Google Consent Mode v2 in basic mode: the Google script is loaded only after consent. We do not send Google your e-mail address, username, GPS data, identifiers or URL parameters (except the Google ad click identifier - gclid - after marketing consent). Google signals and ad personalisation are disabled.
3. Google Ads conversion measurement. We advertise BEON.RUN on Google Ads. If you consent to the “Marketing” category, the Google Ads tag is loaded on selected public pages; it remembers the ad click identifier (_gcl_* cookies), and Google Ads is told that a visit from an ad ended in an Account sign-up (an event sent on the first page after registration under the placeholder address /welcome) or a visit to the App Store, and of a Plan purchase as described in the next point. We do not pass on your e-mail address (not even hashed), name, Account data, GPS or activity data. We use no remarketing or ad personalisation (ad_personalization always off). Google processes, among others, the IP address and browser information. You can withdraw consent in “Cookie settings”.
4. Plan purchase after an ad click. If you reached the Service from a Google Ads ad and the “Marketing” consent is on, we keep the ad click identifier (gclid, gbraid or wbraid) in the bor_ads_click cookie, and if you create an Account in the browser within 90 days of the click, we link it to the Account. If you buy a paid Plan in that time (on the website or in the app through the App Store / Google Play), we send Google Ads (Google Data Manager API) only: the click identifier, the date and time of the purchase, a fixed conversion value and a random transaction identifier - once, without your e-mail address, name, Account data, GPS or activity data. The click identifier is deleted 90 days after the click or with the Account. Legal basis: your marketing consent (Article 6(1)(a) GDPR); you can withdraw it in “Cookie settings” - the bor_ads_click cookie is then removed.
5. You can withdraw consent at any time (“Cookie settings” in the footer). Withdrawal does not affect the lawfulness of processing before it.
6. Statistics in the mobile app. In the mobile app we may use Google Analytics for Firebase - only when we have switched the feature on and you consent in the app (default: no consent). We set no user identifier; events and their parameters are limited to a closed list, without GPS data, content or health data. By consenting to statistics you also agree that Google may use these events (e.g. the first app launch, sign-up, starting an activity) to measure the effectiveness of our Google Ads - on iPhone only if you additionally allow tracking in the system "Allow tracking" prompt (ATT); only then does Google also receive the device's advertising identifier (IDFA). On Android we do not pass the advertising identifier. We use no ad personalisation or remarketing. Google may determine an approximate region from the IP address. You can withdraw consent in the app's privacy settings, and tracking permission in iOS Settings.
7. Measuring our Meta ads in the mobile app. We also advertise the BEON.RUN app on Facebook and Instagram (Meta). By consenting to statistics in the app you also agree that the app sends Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland), through the Meta SDK, only: the fact that the app was launched (the first launch marks the install), that an Account was created (with the sign-up method: e-mail, Apple or Google) and that a paid subscription started (with the Plan name, without the price or a transaction identifier). Meta uses these events to determine whether an install, sign-up or purchase followed seeing or clicking our ad, and to deliver our ads better to people who may be interested in the app. We do not pass the e-mail address, name, Account identifier, GPS data, activity data or health data, and we build no remarketing audiences from them. Without your consent the Meta SDK is not started and does not connect to Meta. On iPhone the events are sent only if you additionally allow tracking in the system "Allow tracking" prompt (ATT) - only then does Meta also receive the device's advertising identifier (IDFA). On Android we do not pass the advertising identifier; Meta may recognise an install from an ad based on information provided by the Facebook or Instagram app on the same device. Meta processes, among other things, the IP address and basic device and app information (e.g. device model, system version, language, time zone, app version). We are jointly responsible with Meta Platforms Ireland Ltd. for collecting this data and passing it to Meta (Article 26 GDPR, Meta's Controller Addendum); Meta's further processing is governed by its privacy policy (facebook.com/privacy/policy), which also explains how to exercise your rights towards Meta. You can withdraw consent in the app's privacy settings (Account → Privacy) - from then on the app sends no events to Meta.
8. Measuring our TikTok ads in the mobile app. We also advertise the BEON.RUN app on TikTok. By consenting to statistics in the app you also agree that the app sends TikTok Technology Limited (10 Earlsfort Terrace, Dublin 2, Ireland), through the TikTok Business SDK, only: the fact that the app was launched (the first launch marks the install), that an Account was created (with the sign-up method: e-mail, Apple or Google) and that a paid subscription started (with the Plan name, without the price or a transaction identifier). TikTok uses these events to determine whether an install, sign-up or purchase followed seeing or clicking our ad, and to deliver our ads better to people who may be interested in the app. We do not pass the e-mail address, name, Account identifier, GPS data, activity data or health data, and we build no remarketing audiences from them. Without your consent the TikTok SDK is not started and does not connect to TikTok. On iPhone the events are sent only if you additionally allow tracking in the system "Allow tracking" prompt (ATT) - only then does TikTok also receive the device's advertising identifier (IDFA). On Android we do not pass the advertising identifier; TikTok may recognise an install from an ad based on information provided by the TikTok app on the same device. TikTok processes, among other things, the IP address and basic device and app information (e.g. device model, system version, language, time zone, app version). We are jointly responsible with TikTok Technology Limited for collecting this data and passing it to TikTok (Article 26 GDPR, TikTok Business Products (Data) Terms with the joint-controller terms for the EEA); TikTok's further processing is governed by its privacy policy (tiktok.com/legal/page/eea/privacy-policy), which also explains how to exercise your rights towards TikTok. You can withdraw consent in the app's privacy settings (Account → Privacy) - from then on the app sends no events to TikTok.
9. Ads. The Service in the browser currently shows no ads. In the mobile app on the FREE Plan, Google AdMob ads may be shown - only when we have switched the feature on; never on the PREMIUM and PLATINUM Plans or during an Activity or Stream. Ads are non-personalised. Where the law requires it (e.g. EEA, UK, Switzerland), Google asks for consent in its form before showing ads, and on iOS the system may ask for permission to track (ATT) - refusing does not limit your use of the app. You can change ad privacy settings in Account → Privacy. Google processes, among others, the IP address and device information and - only with consent - the advertising identifier.

§ 9. Recipients

Data may be disclosed to:

• the server infrastructure (hosting) provider - k.pl (KORBANK S.A., Poland);
• Cloudflare - DNS, proxy and traffic protection services (it sees, among other things, the IP address and request data); transfers outside the EEA - § 10;
• the e-mail provider - cyber_Folks S.A. (Poland), hosting the [email protected] mailbox and sending the Service's e-mails;
• Cloudflare - Turnstile - checking that a form is sent by a person (processes e.g. the IP address, the User-Agent header and technical browser signals); transfers outside the EEA - § 10;
• Cloudflare - R2 (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) - storage of your files (stream recordings, Story videos, clips, voice recordings, data export packages) in the Cloudflare R2 service, with the data location in the European Union. The files are private; they are accessed through short-lived signed links created after a permission check. Basis: a data processing agreement (Cloudflare Data Processing Addendum); transfers outside the EEA - § 10;
• Stripe - payments (§ 7);
• Apple, Google - subscription purchases in the mobile app (§ 7);
• Google Ireland Ltd. - Google Analytics 4 and Google Ads conversion measurement, only with consent (§ 8);
• Google (Google Analytics for Firebase, Google Ads conversion measurement, Google AdMob) - only if these features are switched on in the mobile app and as described in § 8;
• Meta Platforms Ireland Ltd. - measuring our Facebook and Instagram ads in the mobile app, only with consent and as described in § 8 (joint controllership for collecting and passing the data);
• TikTok Technology Limited - measuring our TikTok ads in the mobile app, only with consent and as described in § 8 (joint controllership for collecting and passing the data);
• Google (Play Integrity) and Apple (App Attest) - verifying that the genuine app connects to the Service (without data that identifies you);
• OpenStreetMap Foundation - your browser downloads map tiles directly from OpenStreetMap servers, which receive your IP address and the map area displayed;
• browser push service providers (e.g. Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla, Microsoft) - only once Web Push is enabled; notification content is encrypted and contains no GPS data or e-mail address;
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) - to deliver push notifications in the mobile app: the device token and the short notification text (no GPS data, e-mail address or chat content);
• other Users and Viewers - according to your visibility settings; Organizers - for events you registered for;
• public authorities - where required by law.

§ 10. Transfers outside the EEA

The Service's server is located in Poland, and your files (recordings, Story videos, clips, voice recordings, exports) are stored in Cloudflare R2 with the data location in the European Union. Some recipients (Stripe, Apple, Google, Meta, Cloudflare, push service providers) may transfer data to countries outside the European Economic Area, in particular the USA. Such transfers are based on the European Commission's implementing decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework - for certified entities - or on standard contractual clauses. The OpenStreetMap Foundation is based in the United Kingdom, which is covered by a European Commission adequacy decision under the GDPR (renewed in December 2025). You can obtain a copy of the safeguards by contacting us.

§ 11. Retention

• Account, profile, Activity, GPS route, Stream, chat and community data - until you delete the Account or the item. Your activity history is available until you delete it - currently regardless of the Plan. We will notify you in advance if plan-dependent history retention limits are introduced.
• Current GPS position - about 10 minutes; technical Stream and chat moderation data - from a few minutes to 24 hours.
• Last approximate location - until replaced by a newer one, an objection is honoured or the Account is deleted. App installation data and the notification token - until you sign out on that device (the token is detached), uninstall the app (when the provider reports the token invalid) or delete the Account. The history of administrative push campaigns contains no recipient data (only the text, the criteria and counts).
• Recordings - according to the Plan (e.g. 180 days) or until deleted earlier.
• Files above the FREE Plan storage limit after a paid Plan or storage pack expires - until the deletion date stated in the notice (no earlier than 14 days), under § 12a of the Terms (from 24 November 2026).
• “Download my data” archive - 24 hours.
• LIVE reactions - individual taps in the server cache for at most 2 minutes; per-minute totals - until the Stream or Account is deleted.
• Voice cheers - the recording file 24 hours; a cheer reported by the broadcaster - up to 30 days as evidence; then we delete the file and the entry.
• Guest nickname on the list of viewers - about 75 seconds after the last presence signal.
• Story videos - 7 days (FREE Plan), 30 days (PREMIUM), 90 days (PLATINUM), earlier at your request.
• Ghost records - as long as the source Activity exists, or until the sharing is withdrawn (records held by others) or the Account is deleted; race state during an Activity - up to 24 hours.
• Event mode - live positions until the event ends; participation, checkpoint passes and results - until the event or the Account is deleted.
• App preferences, the list of connected devices, the history of privacy choices - until changed or the Account is deleted; sensor measurements - together with the Activity.
• The LIVE readiness test sample - not stored.
• Server logs - operational logs of the application and the web server: up to 14 days; logs of the individual services - until overwritten by log rotation (at most 5 files of 10 MB per service), i.e. depending on the number of events.
• Broadcaster connection diagnostics - 30 days.
• Diagnostics of test versions of the app - 30 days.
• Google Ads click identifier linked to the Account - 90 days from the click (earlier with the Account).
• Support settings and goals - until the Account is deleted. Support payment, refund, dispute, platform fee, settlement, payout and statement records, document acceptance records and the Provider's accounting documents (e.g. fee invoices, if issued) - for the period required by law, in particular tax and accounting law (generally 5 years from the end of the year in which the tax liability arose), or necessary to establish, exercise or defend claims (including fraud and payment disputes) - also after the Account is deleted, then detached from the Account and linked to a pseudonymous reference (§ 12(3)). Stripe keeps its own records under its own policy.
• Support requests - for as long as needed to handle the request and then until any related claims become time-barred; complaints, content notices (DSA) and payment disputes - under the rules in this section for those matters. E-mail delivery log (no content) - for as long as needed to investigate delivery problems. The exact periods for ordinary requests and the delivery log will be stated in the next version of this Policy; until then the data is not deleted automatically.
• Complaints - for 6 years from the final closure of the complaint. Content notices and moderation decisions (including entries in the administrative action log) - currently kept without automatic deletion.
• After Account deletion the username is reserved for 365 days (we keep only the name and dates); admin log entries are anonymised; settlement records are retained as described in the Support data item; invoices and payment records issued by Stripe remain with Stripe under its own obligations.

§ 12. Account deletion and data export

1. In the Account settings (Privacy and data) you can download a ZIP archive of your data and delete the Account. The archive contains, among others, Account data and app preferences, Activities and routes, privacy choices with their history, reaction totals of your Streams, your voice cheers and Story videos (while their files exist) - without passwords, tokens or other people's private data.
2. Account deletion is irreversible. We delete or anonymise, among other things, Account and profile data, Activities, routes, Streams, recordings (files are deleted and verified first), the profile picture, follows, likes, comments, notifications, push subscriptions, app installations and notification tokens, the last approximate location; your chat messages in other people's Streams are anonymised (“Deleted user”); a paid Stripe subscription is cancelled and your Stripe customer record is deleted (a subscription bought in the App Store or on Google Play is cancelled by you in the store - we cannot do it for you). If you are a Support Recipient, your Stripe connected account is closed (Stripe keeps its own records - including verification data, balance and transaction history - under its own policy), and your Support settings and goals are deleted.
3. Not all data is deleted immediately. Payment, refund, dispute, platform fee, settlement, payout and statement records, document acceptance records and data required by tax and accounting law are retained after the Account is deleted - detached from the Account and linked to a pseudonymous reference - for the period required by law (in particular tax and accounting law) or necessary to establish, exercise or defend claims, including fraud and payment disputes (§ 11). They are deleted when that period ends.
4. If you supported other Support Recipients, your signature and message are removed from public view (including TOP lists) when your Account is deleted. The payment amount remains in the Recipient's settlements and in the settlement records, without the link to your Account.
5. Browser storage is cleared on the Account deletion confirmation page.

§ 13. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), to object to processing based on legitimate interest (Article 21) and to withdraw consent at any time. You can exercise most rights yourself in the Account settings; for anything else write to [email protected] (messages are read and answered by a person). We respond within one month (Article 12(3) GDPR).

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) (Article 77 GDPR).

§ 14. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Article 22 GDPR). Only technical mechanisms run automatically, e.g. masking of profanity in chat and rejecting obviously wrong GPS points. The feed of followed people's activities is chronological, not algorithmic.

§ 15. Minors

An Account may be created by a person who is at least 16 years old. The 16+ requirement is a condition of the Terms accepted at registration - we do not ask for an age or a date of birth. When a User first wants to broadcast LIVE or share their location live, we ask for an adult statement; we record only that it was made, when, the statement version and the client type (web / mobile) - to apply the access rules of these features and for accountability (Article 6(1)(b) and (f) GDPR). LIVE broadcasts, sharing location with other people in real time and publicly sharing a route map require the adult (18+) statement; without it location data is not shared with other people and other activity data is visible only according to the privacy settings. The Support Recipient feature is available only to adults. If we learn that an Account was created by a person under 16, we may delete it.

§ 16. Security

We use, among other things, encrypted connections (HTTPS/TLS), password hashing, rate limiting, CSRF protection, HttpOnly cookies, service isolation and data minimisation in logs (no passwords, tokens or coordinates).

§ 17. Changes to this Policy

We will notify you of material changes to this Policy through the Platform and, where available, may also notify you by e-mail. Each version has a number and an effective date. The Polish version is binding.