Privacy policy

1. Controller

2. Local data processing (guest mode)

Without login, all data is stored exclusively in your browser (localStorage). No transmission to our servers takes place. You can delete this data at any time via your browser settings.

3. Account data (upon registration)

If you create an account, we process your email address and encrypted password as well as your saved athlete, ride, and stash data for sync between devices. Legal basis: Art. 6 (1) (b) GDPR (contract performance). You can delete your account at any time via Settings.

4. Backend / processor: Supabase

Account and sync data is processed by Supabase Inc. (970 Toa Payoh North, #07-04, Singapore 318992), with whom a data processing agreement (Art. 28 GDPR) is in place. Server region: EU. More: supabase.com/privacy.

5. Hosting: Cloudflare Pages

The website is delivered via Cloudflare Pages (Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA). On access, technically required log data (IP address, user agent, timestamp) is processed. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure delivery). Cloudflare is certified under the EU-US Data Privacy Framework.

6. Cookies, analytics, tracking

FuelStash does not set tracking cookies and does not use analytics services such as Google Analytics. Only technically necessary storage mechanisms (localStorage) are used for your plan and profile data.

7. Your rights

You have the right at any time to information (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21) regarding processing. Contact us informally at info@fuelstash.app. You may also file a complaint with a data protection authority.