Privacy policy
Last updated: Wednesday, September 30, 2026
Who is responsible?
The data controller is the publisher of 8SPLITS, named in the legal notice. Contact for any question about your data: mechergui.skander02@gmail.com.
What data, why, and on what basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, encrypted password (handled by Supabase Auth) | Create and secure your account | Performance of contract | Until the account is deleted |
| Athlete profile: first name or nickname, gender, age group, division, country, language, athlete or coach role | Compute your splits and tailor the app | Performance of contract | Until the account is deleted |
| Plans, followed races, crews, tests, challenges, scores | Provide the service and the crew leaderboard | Performance of contract | Until the account is deleted |
| Subscription (Stripe customer and subscription ids), granted access, referrals, commissions, holder name and IBAN of the commission payout account | Manage the plans, access and commissions | Performance of contract; accounting duties | Account lifetime; accounting records 10 years (anonymised if you delete your account) |
| Optional athlete profile: photo, cover, bio, city, box, coach, languages, colour, strong stations | Personalise your profile and athlete card | Consent (you fill in what you want) | Until changed or deleted |
| Partner finder: location rounded to about 1 km then shifted, availability, target division and race | Show you nearby athletes, and show you to them if you turn it on | Consent (off by default, reversible) | Until turned off or deleted |
| Partner requests, short message, the contact you choose to share (WhatsApp or Instagram), blocks and reports | Connect two athletes and protect against abuse | Performance of contract; legitimate interest (safety) | Until account deletion; reports 1 year |
| Written or voice race notes from your coach, debriefs, trophies | Coach features of your crew | Performance of contract | Until deleted by the coach or with your account |
| Duels and SPLITTED (season recap computed from your races) | Compare races with a friend, yearly recap | Performance of contract | Until account deletion |
| Mobile app notification token | Send you the notifications you allowed | Consent (phone permission) | Until permission is withdrawn or account deletion |
| First-party usage measurement: page views, key steps (calculation, sign-up, save), language, approximate country, device type, visit source | Understand what works and improve the product | Legitimate interest (audience measurement without cookies or cross-referencing) | 13 months |
| Log of emails sent | Avoid duplicates and prove delivery | Legitimate interest | 13 months |
We collect no card data and no health data in the medical sense: a race time and a division are not health data.
Usage measurement, plainly
8SPLITS measures its audience with its own tool, stored in our database. No cookie is set for it: a random identifier lives in your browser tab and disappears when you close it. IP addresses are not stored. There is no advertising pixel and no third-party analytics tool. You can refuse this measurement from the banner or the Cookies page, and the refusal is respected everywhere.
Recipients and processors
Your data is never sold or rented. It is accessible to the publisher and the following processors, only to run the service:
- Supabase: database and authentication, hosted in the European Union (AWS eu-west-1, Ireland).
- Resend: email delivery (welcome, race reminders, coach nudges), region eu-west-1.
- Stripe (Stripe Payments Europe, Ltd., Ireland): subscription payments; Stripe receives your email, country and payment details, and also processes them for its own duties (fraud prevention, legal obligations). 8SPLITS never receives your card data.
- Stripe: the history of earlier Stripe subscriptions.
- Netlify: web application hosting.
- Anthropic: writes the debrief draft offered to the coach, from the plan vs race gaps and the coach's previous notes. The athlete's first name may appear in it; no data is used to train models.
- OpenStreetMap (Nominatim): turns your city name into an approximate point, once per city (no address is ever sent).
- OpenFreeMap (or MapTiler if enabled): map tiles of the partner finder, loaded by your browser.
If one of these providers processes data outside the European Union, the transfer relies on the European Commission's standard contractual clauses.
In a crew, other members see your nickname, target and score. The crew's coach also sees the plans and tests you share in the crew.
If you turn on the partner finder, signed-in athletes see your first name and last-name initial, city, bio, photo, approximate location (never your address), target division and race, strong stations, number of official races and best time. Your contact is shared only after an accepted request, and only the one you choose. A blocked profile no longer sees you anywhere.
Your rights
You have the right to access, rectify, erase, restrict, object and port your data, and to set instructions for what happens to it after your death. Directly in the app:
- Profile > Your data > Export: download all your data as JSON.
- Profile > Your data > Delete my account: cancels your subscription and deletes your account, personal data and files (photos, voice notes). Accounting records (invoices, commissions) are kept with no link to you.
- Profile: correct your details at any time.
For any other request, write to mechergui.skander02@gmail.com. We reply within one month. If you believe your rights are not respected, you can complain to the CNIL (cnil.fr) or your local data protection authority.
Security
Encrypted connections (HTTPS), hashed passwords, database access rules that stop one user from reading another's data, and restricted admin access.
Updates
This policy may change, especially when online payment opens. The last update date is shown at the top of the page; you are emailed about any significant change.
The French version prevails.