Web Services Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

Borafit UG (haftungsbeschränkt)

Straße der Jugend 18, 14974 Ludwigsfelde, Germany

Email: [email protected]

We are not required to appoint a data protection officer and have not done so. For any data protection matter, please contact us at the address above.

2. Principles

We process your data in Germany and the EU. We collect as little data as possible, and we neither sell data nor pass it on for advertising purposes.

Our sign-in is passwordless. We store no password.

We embed no third-party advertising, tracking or crash-reporting services. We collect no advertising identifiers and build no cross-device profiles.

3. Processing in detail

Data	Purpose	Legal basis	Retention
Account data, in particular your email address	Maintaining your account, authentication	Art. 6(1)(b) GDPR	Until the account is deleted
Record of your acceptance of the terms and of your declaration of majority	Evidence that the contract was validly concluded	Art. 6(1)(b) and (f) GDPR	Until the account is deleted
Sign-in codes	Passwordless sign-in	Art. 6(1)(b) GDPR	10 minutes; also expires on use
Two-factor authentication data	Securing your account, if you enable the feature	Art. 6(1)(b) and (f) GDPR	Until deactivated or the account is deleted
Session data for your active sign-ins	Keeping you signed in and showing you your active sessions so you can spot and end unfamiliar access	Art. 6(1)(b) and (f) GDPR	Until sign-out, at the latest when the session expires
Rate limiting: IP address	Protecting our sign-in and account functions from automated attacks	Art. 6(1)(f) GDPR	60 seconds
Profile data, for a performer including the up to three places they name	Presenting your profile in the app	Art. 6(1)(b) GDPR	Until the account is deleted
Training data	Building and maintaining your training plan	Art. 6(1)(b) GDPR	Until the account is deleted
Training venues you name yourself — no location data	Adapting your training plan to the venue you have chosen	Art. 6(1)(b) GDPR	Until the account is deleted
Aggregate usage figures: each night we count, from the current training plans of all members, how many members are active, how many members’ plans include each video, and how often combinations of movement, level and equipment come up. We store only these counts — no member ID and no other link to a person	Improving our exercise library. Performers see only a ranked list of the movement and equipment combinations members look for, and nothing at all while fewer than 1,000 members are active. A performer’s own plan is not counted toward their own videos	Art. 6(1)(f) GDPR	13 months
Notification settings	Storing your preferences for training reminders	Art. 6(1)(b) GDPR	Until the account is deleted
Service emails	Performing the contract and securing your account	Art. 6(1)(b) and (f) GDPR	As required for delivery
Server logs: timestamp, file requested, data volume, browser, operating system, referrer — no IP address	Security and stable operation	Art. 6(1)(f) GDPR	Stored without an IP address; no individual profiles
Audience measurement: aggregated and not attributable to a person	Understanding how our pages are used	Art. 6(1)(f) GDPR	Aggregated; no individual profiles
City and country of each session, as reported by our content delivery provider Cloudflare for the connecting IP address. We do not store the IP address	Showing you where each of your sessions signed in, telling your other devices when a sign-in comes from a new country, and limiting console access for editors to Europe. The same country is read for a search to rank results, for that request only, and is not stored	Art. 6(1)(f) GDPR	With the session: deleted when you sign out or the session ends
Performer application: the account you give us (platform and username), your note, the code you put in that account’s bio, the dates and status of the application, and — if we decline it — the reason we give you and an internal note by our staff	Assessing your application and confirming that the account is yours. Our staff open the account you name and check by hand that the code is in its bio; we send the username to no platform	Art. 6(1)(b) GDPR	30 days after submission if we have not answered, 30 days after a rejection, six months after an approval; deleted at once if you withdraw it; in any case with your account
Limit on the number of applications: your account ID	Protecting the application function from misuse	Art. 6(1)(f) GDPR	24 hours
Performer status record: when we granted it, when you first accepted the Performer Terms, which version you most recently accepted and when (a restore or a new grant clears this until you accept again), when you ended it, and the date set for deleting your videos	Proving the licence and the consent you gave us and when they ended; carrying out the deletion of your videos on time after you end your status	Art. 6(1)(b) and (f) GDPR	Until the account is deleted

An application is seen only by Borafit staff who handle applications. We do not read the account automatically, on any platform; our staff open it and check by hand that the code is in its bio. We never write to you on the account you give us.

We ask for your device location only when a performer taps Use my location while setting up their places. Your browser then gives a coarse position, which is rounded before it is sent. We use it once to find the nearest town and keep nothing: the position is not stored or logged. We process no precise location data and otherwise do not know where you are.

When you upload a profile or banner image, we receive only the single file you choose. The images we store carry none of the original file's metadata — in particular no GPS coordinates and no camera information from the original capture.

So that Borafit works when the connection drops, the app stores content locally on your device. That data stays on the device and is not read by us. It is removed when you delete the content concerned, sign out, or clear the site data in your browser.

4. No special categories of personal data

We do not process health data or any other special category of personal data within the meaning of Art. 9 GDPR.

Our training data describes your training preferences and your training progress. We collect no diagnoses, symptoms, injuries, medication, weight, body measurements, heart rate, or any other biometric or medical value.

5. No automated decision-making

Your training plan is generated automatically. It is based solely on the information you provided yourself and your training progress.

This involves no automated decision in an individual case that produces legal effects concerning you or similarly significantly affects you. There is therefore no decision within the meaning of Art. 22(1) GDPR. You can change your inputs at any time and swap out individual exercises.

6. Visibility to other members

The only profiles visible publicly are those of our performers, together with the videos they have published. What is visible there is the display name, username, description, linked addresses, places, and profile and banner image. A performer who has not yet accepted the Performer Terms is shown only to signed-in members. Your training plan, your training data, and your training venues are never visible to other members.

Beyond the app, a performer can additionally make their profile reachable on the open internet, so that anyone holding the link can open it without a Borafit account. That page shows the display name, username, description, linked addresses, profile and banner image, and published videos — not the places, which only signed-in members see. This is on only after the performer accepts the Performer Terms with the box Make my profile and videos public, with shareable links ticked, which it is by default; the performer can untick it there or switch it off again at any time, in their account settings. While it is off, that profile is not served to anyone who is not signed in and is not indexed by search engines. Visibility inside the app, described above, is unaffected either way: if someone signed in to Borafit follows a link to that profile, it opens for them inside the app under the in-app rules described above, whether the switch is on or off.

7. Recipients and processors

We use only the following external service providers:

• Cloudflare as DNS, security and content delivery provider, and as the storage for our images and videos. In this context your IP address is routed via Cloudflare's servers. Cloudflare stores every uploaded image and video for us — including your own — on a lasting basis, in object storage that was irrevocably restricted to data centres in the European Union when it was created; they are delivered through Cloudflare's network. Publicly accessible pages and images — including a public performer profile's share preview — are also held on their servers for a short time so they can be delivered quickly. The legal basis for storing your files is Art. 6(1)(b) GDPR, and otherwise Art. 6(1)(f) GDPR. Cloudflare acts as a processor under Art. 28 GDPR and a corresponding agreement is in place. Where data is transferred to the USA, the transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework and, additionally, on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914).
• Hosting providers for our server environments within the EU, each acting as a processor under Art. 28 GDPR. Our backups — of the database as well as of all images and videos — are held by a hosting provider in Germany.
• Technical delivery paths for email. We use no marketing or newsletter provider.

No disclosure takes place for other purposes. Statutory obligations to provide information to public authorities remain unaffected.

8. Deleting your account

You can delete your account yourself at any time. After you confirm, deletion is scheduled in two days — so you have two full days to cancel it. After that you are signed out everywhere and your data is erased. Allow up to three days in total between your confirmation and your data actually being gone. The following are deleted: your account, your profile, your training data and venues, your ratings, your uploaded images and videos, and all of your sessions.

If you end or decline your performer status yourself, or an offer of it ends unanswered after 30 days, your videos are deleted 30 days later unless you restore your status before then, together with your profile picture, banner image, bio, links and places, as set out in section 7 of our Terms and section 9 of our Performer Terms. Their deletion then follows the rules below for caches and backups.

If you had a public performer profile, its share preview — the page and images shown when a link to your profile is posted elsewhere — may still be delivered from caches for up to 24 hours after your data is erased, after which those copies expire on their own. Browsers that already loaded the preview may keep their own copy for the same period. Nothing about your profile is served from our systems from the moment of erasure.

Uploaded images and videos are also held in the caches of our content delivery network so they load quickly. Whenever one is deleted — with your account, or on its own because it was removed or replaced — its cached copies are removed from that network within 24 hours. A browser or app that already downloaded an image or video may keep its own copy on that device; that copy is outside our reach.

Data with no connection to you personally is not deleted.

Otherwise, we delete personal data as soon as the purpose for storing it no longer applies and no statutory retention obligation prevents it.

Your data is not removed from technical backups immediately. We make those backups daily and keep them for up to 40 days, after which they are deleted automatically. For their first 30 days they are locked against deletion, so that neither a mistake nor an attack can destroy them early. Until then your data remains inside them but is no longer used — restoring a backup does not bring back a deleted account. To ensure that, we record each completed deletion for 40 days in a deletion log holding only the pseudonymous account ID and the date — no name, no email address; after a restore, every deletion recorded there is carried out again.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing (Art. 21).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal is unaffected.

To exercise your rights, an email to [email protected] is sufficient.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg

Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany

10. Whether you must provide data

To conclude and perform the contract we need your email address; without it we cannot maintain an account or sign you in. For a meaningful training plan we additionally need your statements on level and goals. All further information — description, images, linked addresses, venues, and notifications — is voluntary; without it, only the relevant features are unavailable. To apply as a performer we need one of your accounts and the code in its bio; without them we cannot assess the application.

11. Changes to this policy

We update this policy when the underlying processing changes. The version published on this page applies; the date of the most recent change appears at the top.