Privacy policy
English translation. The German version, Datenschutzerklärung, is binding. If the two differ, the German version applies.
Rucksteady has no accounts, shows no ads and contains no analytics tools. Your routes and rucks stay on your device.
Controller
Sebastian Nuss, Am Hochgericht 15, 55126 Mainz, Germany, hello@autopunk.io. Further details in the Impressum.
Location
When you start a ruck, the app asks for your location ("while using the app" only) and records it until you end the ruck, with the screen off too. The location points are stored only on your device, and distance, pace and elevation gain are calculated from them. They are not transmitted to us or to third parties. The legal basis is the provision of the feature you started (Art. 6(1)(b) GDPR).
Health data
If you connect Apple Health or Health Connect, the app writes every finished ruck to that store on your device as a hike with distance, active energy, elevation gain and route. This happens only with your explicit permission in the system dialog (Art. 9(2)(a) GDPR), which you can withdraw there at any time. The app reads no data from Apple Health or Health Connect, and we receive no health data. The app stores your body weight and pack weight for the calorie estimate only on your device.
Self-check and answers after a ruck
Before your first plan you confirm that you are 18 or older and say whether any of eight health points applies to you. The app does not ask or store which one. It keeps only a summary on your device: your answer ("yes" or "no"), the date, the version of the questions and notices, and your age confirmation. After a ruck you can say how it felt (easy, right, hard). The app does not ask about pain. It stores this answer with the ruck on your device and uses it to adapt your plan. None of this is transmitted to us or to third parties; we never receive these answers. Where this processing on your device needs a legal basis, it is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by skipping the answers or deleting the app.
App updates
We ship fixes through EAS Update by 650 Industries, Inc. (Expo, USA) as our processor (Art. 28 GDPR). At every launch the app asks Expo for a new version and sends your IP address, the platform (iOS or Android), the app's runtime and channel, the IDs of the installed version, and a random installation ID that is linked to no person and no purchase. If the app crashed on its last launch, the error message is sent as well. The legal basis is our legitimate interest in fixing errors quickly (Art. 6(1)(f) GDPR). Privacy notice: https://expo.dev/privacy.
Subscription (Premium)
You buy Premium through the App Store (Apple) or Google Play (Google); only the respective store receives payment data. The subscription is managed by RevenueCat, Inc. (USA) as our processor (Art. 28 GDPR): RevenueCat receives a random app user ID, the purchase receipt, your purchase history, platform, operating system and app version, and your IP address, in order to determine whether your subscription is active (Art. 6(1)(b) GDPR). There is no account; the ID is not linked to a person. Privacy notices: https://www.revenuecat.com/privacy, Apple https://www.apple.com/legal/privacy/, Google https://policies.google.com/privacy.
This website
This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Cloudflare acts as our processor (Art. 28 GDPR) under its Data Processing Addendum. When you visit the site, Cloudflare processes connection data (IP address, time, page requested, browser identifier) in server logs across its global network in order to deliver the site and protect it against attacks and abuse (Art. 6(1)(f) GDPR). How long Cloudflare keeps the server logs is set by Cloudflare; we do not evaluate them and use no analytics or statistics service. We set no cookies and load no third-party content. Only if Cloudflare classifies a request as a possible attack may it set a strictly necessary security cookie to block it. If you write to us by email, we process your message and your email address in order to reply (Art. 6(1)(f) GDPR) and delete them once the request is settled.
Third countries
RevenueCat, Expo (650 Industries) and Cloudflare are based in the USA. The transfer rests on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR); a copy of the safeguards is available from the contact address.
Retention
You delete all data in the app under Profile → Account and data → Delete all data, or by uninstalling the app. Workouts the app saved to Apple Health or Health Connect are deleted only if you choose that option there; otherwise you delete them in Apple Health or Health Connect. Backups of your device (iCloud, Google) you manage in your device settings. RevenueCat keeps the purchase data for as long as the subscription and statutory retention duties require; on request we arrange deletion.
Your rights under the GDPR
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Since we receive no data apart from the purchase data at RevenueCat, access and erasure refer to that data; we answer every request. You may also complain to a data protection supervisory authority, for example the one responsible for Rhineland-Palatinate.
Children
Rucksteady is intended for adults aged 18 or older (rucking with a loaded pack); the training plans are not designed for people under 18. If you believe a child has sent us personal data, write to us; we will delete it.
Changes to this policy
If the way the app handles data changes, we update this page and the date above. We also announce material changes in the app's release notes.
Contact
Sebastian Nuss
hello@autopunk.io