Privacy Policy for the B42 App

Last updated on July 13, 2026

This privacy policy applies to the B42 app (iOS and Android). For our websites b-42.com, elite.b-42.com, pro.b-42.com, and prevention.b-42.com, the separate privacy policy for B42 websites applies. For B42 CoachZone (teams.b-42.com) applies the separate privacy policy for the CoachZone.

1. Data protection at a glance

General Information

The following information provides a simple overview of what happens to your personal data when you use our app. Personal data refers to any data that can be used to personally identify you. For detailed information, please refer to our full privacy policy below.

Who is responsible for data collection in this app?

Data processing is carried out by the app operator. You can find contact details in Section 2.2.

How do we collect your data?

Some of your data is collected when you provide it to us, for example, by entering information during registration or while using the app. Other data is automatically recorded by our IT systems when the app is running (e.g., device information, operating system, time of app launch).

What data do we collect and why?

Some data is collected to ensure the app functions correctly. Other data may be used to analyze user behavior. Please refer to the following sections for details.

Analysis tools and third-party tools

When using the app, your usage behavior may be statistically analyzed. This is done using analysis tools, which we describe in detail in Section 4. This analysis only takes place after you have given your express consent when starting the app for the first time.

2. General information and mandatory disclosures

2.1. Data protection

The operators of this app take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Please note that data transmission over the internet may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible. Communication between the app and our servers is exclusively encrypted via SSL/TLS.

2.2. Data controller

The party responsible for data processing in this app is:

SFY GmbH
Industriestraße 15
84149 Velden
Germany
Phone: +49 1590 4864277
Email: info@b-42.com

Represented by the Managing Director, Andreas Gschaider.

2.3. Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You may revoke your consent at any time — either directly in the app settings (Profile tab → icon in the top right) or by emailing us. The legality of the data processing carried out prior to the revocation remains unaffected.

2.4. Right to lodge a complaint with the competent supervisory authority

In the event of data protection violations, you have the right to lodge a complaint with the competent supervisory authority. The competent authority is the State Data Protection Commissioner for the federal state in which our company is based. A list of supervisory authorities can be found at: www.bfdi.bund.de.

2.5. Right to data portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.

2.6. Access, rectification, and erasure

Under applicable legal provisions, you have the right to obtain information free of charge at any time regarding your stored personal data, its origin, recipients, and the purpose of data processing, as well as a right to rectification or erasure where applicable. Please contact info@b-42.com at any time for this purpose.

2.7. Transfers to third countries

Some of the services used in this app are based in the USA. Where we transfer data to the USA, this is done on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) of July 10, 2023, provided the respective provider is certified under the DPF. Otherwise, we base the transfer on standard contractual clauses in accordance with Art. 46(2)(c) GDPR. The respective legal bases are specified for each individual service.

3. Data collection in the app

3.1. Data categories collected

We process the following categories of personal data:

Identity data

First and last name, date of birth, email address, gender, and information transmitted to us via your Meta or Google account. We use this data to verify your identity and provide your account. This data is stored for the duration of the contractual relationship and for 3 years after its termination.

Contact details

Email address and other communication channels you have used to contact us. We use this data to contact you if necessary. Retention period: 3 years after the last contact.

Profile picture

Users may voluntarily upload a profile picture. This is displayed on your public profile and is visible to other B42 users (see "Behavioral and profile information" section below). The profile picture is stored for the duration of the contractual relationship and can be changed or deleted at any time in the app settings. The legal basis is Art. 6(1)(a) GDPR (consent via voluntary upload).

Body and training information

Height, weight, fitness level, training focus, and playing position (e.g., center-back). We use this data to better tailor our training plans and product recommendations to your needs. Retention period: for the duration of the contractual relationship.

Location data

The B42 app offers GPS tracking for running sessions, provided you have granted the app the necessary permission. Processing is based on your age:

• Users under 16: GPS coordinates are displayed in real time exclusively during an active session. Individual GPS points are not stored.
• Users aged 16 and over: GPS data is stored to evaluate and visualize your running performance. The data is automatically deleted after 24 months; aggregated evaluations are retained for the duration of the contractual relationship. The legal basis is Art. 6(1)(a) GDPR (explicit consent).

Marketing communication

Marketing-related emails and in-app communications (e.g., product news, offers) are sent exclusively to users aged 16 and over. The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time in the app settings or by emailing info@b-42.com.

Purchase information

Payment service provider, duration of your B42 subscription, price, currency, VAT, and the payment number assigned by the payment service provider (e.g., Apple, Google). We do not store credit card information ourselves. Payment data is subject to statutory retention requirements and is stored for 10 years (§§ 146, 147 AO).

Behavioral and profile information

Your usage behavior within the app. We use this data to improve our products and provide you with relevant content. Retention period: 12 months, after which it is anonymized.

The information in your public profile is what you present to others in the B42 app. Other users can see your first and last name (if provided), your profile picture, your completed workouts, and your performance test results. Your B42 Player Card is also visible to other users. To help motivate other users through your achievements and progress, you agree to the use of your B42 Player Card on other SFY GmbH communication channels.

Social media information

Information we receive through your interactions with us on social media such as Facebook, Instagram, or Google, including publicly available information like your social media handles and public posts. We receive this information directly from social networks or through third-party agencies with whom we have entered into appropriate agreements.

Device information

Information about your device, including IP address, date and time of app usage, device identifiers, device type, operating system and version, and browser type (for the web view). This data is required for network security and error diagnostics. Retention period: 30 days.

Activity information

Fitness data such as your chosen training program, start and end times of workouts, and completed activities. We use this data to operate our products, support your performance goals, and provide relevant product recommendations. Completed workouts and your full training history are stored permanently so you can track your progress at any time — they remain until you actively delete your account (see Section 11.1). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

3.2. Account and profile data

To use the app to its full extent, you need an account, which can be created via the registration function or by logging in with Meta, Google, or Apple. The email address required for this is stored on our server and used exclusively for login functionality and sending important transactional emails (e.g., password resets, order confirmations). The legal basis is Art. 6(1)(b) GDPR.

3.3. Age-dependent processing

After registration, users provide their date of birth in the app. Based on this information, certain functions and processing activities are managed according to age:

• GPS storage of running sessions, health integrations (Apple Health, Fitbit, Polar, Garmin), and marketing communications are available exclusively to users aged 16 and over (cf. §7 BDSG).
• For users under 16 years of age, the corresponding consents are not obtained; the functions remain disabled.

The date of birth is stored for the duration of the contractual relationship. The legal basis is Art. 6(1)(b) GDPR (performance of a contract, as age-dependent function control is part of the user agreement).

4. Analytics tools

4.1. PostHog

This app uses PostHog, a product and analytics tool from PostHog Inc. We use the EU cloud version of PostHog; all data is processed and stored exclusively on servers within the European Union (Frankfurt, Germany). No personal data is transferred to third countries.

PostHog allows us to analyze how users interact with the app (e.g., screens viewed, click paths, session duration) in order to make targeted improvements. Furthermore, we use PostHog for error analysis to identify and resolve issues in the user flow (e.g., drop-offs during specific actions, faulty screens). The data is processed in a pseudonymized form.

In addition, we use PostHog Workflows to trigger automated actions based on user behavior (e.g., context-sensitive in-app notifications). This processing also takes place exclusively on PostHog's EU servers.

PostHog is only used after your explicit consent upon the first app launch. The legal basis is Art. 6(1)(a) GDPR. You can revoke your consent at any time in the app settings. The collected usage data is automatically deleted after 12 months.

We have concluded a data processing agreement with PostHog. Further information: posthog.com/privacy.

4.2. Automated processing and personalized content

PostHog Workflows analyzes your usage behavior and can automatically trigger context-sensitive in-app notifications or content based on it (e.g., reminders for incomplete training sessions). This processing serves exclusively to improve your app experience.

There is no automated decision-making within the meaning of Art. 22 GDPR—i.e., no decisions with legal or similarly significant effects on you are made solely by automated means (e.g., no automatic termination, account blocking, or credit checks). The legal basis is Art. 6(1)(a) GDPR (consent).

5. Stability and troubleshooting

5.1. Firebase / Google Crashlytics

To detect and fix app errors and crashes, we use Firebase Crashlytics, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

If an error occurs in the app, the following data is automatically transmitted to Firebase:

• Anonymized user ID (randomly generated, no way to identify you)
• Device type, operating system, and app version
• Time of error
• Error logs and stack traces
• Geographic location (country only)

This data is used exclusively for diagnosing and fixing errors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable app operation). Transfers to the USA are based on the EU-US Data Privacy Framework; Google LLC is certified under the DPF. Crash data is automatically deleted after 90 days.

We have entered into a data processing agreement with Google. Further information: firebase.google.com/support/privacy.

5.2. Sentry

In addition to Firebase Crashlytics, we use Sentry for error tracking and performance monitoring. The provider is Sentry, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.

Sentry collects the following data in the event of an error:

• Anonymized user ID
• Device type, operating system, and app version
• Time and type of error
• Error logs and stack traces
• Performance metrics (e.g., load times)

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable app operation). We use Sentry in the EU region; all data is processed and stored exclusively on servers within the European Union. No personal data is transferred to third countries. Error data is automatically deleted after 90 days.

We have entered into a data processing agreement with Sentry. Further information: sentry.io/privacy.

6. Communication

6.1. Mailgun

We use Mailgun to send transactional emails (e.g., password resets, order confirmations, important account information). The provider is Mailgun Technologies, Inc., 112 E Pecan St #1135, San Antonio, TX 78205, USA.

Mailgun processes your email address and the content of the respective email. This data is not used for marketing purposes. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We use Mailgun in the EU region; all data is processed and stored exclusively on servers within the European Union. No personal data is transferred to third countries. Email log data is deleted after 30 days.

We have entered into a data processing agreement with Mailgun. Further information: mailgun.com/legal/privacy-policy.

6.2. Push notifications

With your consent, the B42 app sends push notifications to your device (e.g., training reminders, important app updates). You will be prompted via your operating system's native permission dialog when you first launch the app.

The following services are used for delivery:

• iOS: Apple Push Notification Service (APNs) — Provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (DPF certified)
• Android: Firebase Cloud Messaging (FCM) — Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (DPF certified)

In this process, a device-specific push token (anonymized device identifier) is transmitted to the respective service, which does not allow for your personal identification. The legal basis is Art. 6(1)(a) GDPR (consent). You can disable push notifications at any time in your device's system settings. Upon deactivation or deletion of your account, the push token is deleted immediately.

7. Payment

7.1. RevenueCat

We use RevenueCat to manage in-app subscriptions and purchases. The provider is RevenueCat, Inc., 633 Tasman Drive, San Jose, CA 95134, USA.

RevenueCat processes data regarding your subscription status, purchase time, selected plan, and an anonymized user ID. Credit card or bank account details are not transmitted to RevenueCat; these remain with the respective payment provider (App Store or Google Play).

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in reliable subscription management). Transfers to the USA are based on standard contractual clauses in accordance with Art. 46(2)(c) GDPR. Subscription data is stored for the duration of the contractual relationship and for 3 years thereafter.

We have entered into a data processing agreement with RevenueCat. Further information: revenuecat.com/privacy.

8. Login with third-party providers

8.1. Login with Meta (Facebook)

The B42 app offers the option to sign in using your Meta account (formerly Facebook). The provider is Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA.

When using the Meta login, your name and email address are retrieved from Meta following your express consent. This data is used exclusively for creating and managing your B42 account. Data is only transmitted to Meta after you explicitly click the "Continue with Facebook" button.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for account creation and Art. 6(1)(a) GDPR (consent) for data transfer to Meta. Transfers to the USA are based on the EU-US Data Privacy Framework; Meta Platforms is DPF-certified.

Further information on data protection at Meta: facebook.com/privacy/policy.

8.2. Login with Google

The B42 app offers the option to sign in using your Google account. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When using the Google login, your name and email address are retrieved from Google after your explicit consent. This data is used exclusively for creating and managing your B42 account. Data is only transmitted to Google after you explicitly click the "Continue with Google" button.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for account creation and Art. 6(1)(a) GDPR (consent) for data transfer to Google. The transfer to the USA is based on the EU-US Data Privacy Framework; Google LLC is DPF-certified.

Further information on data protection at Google: policies.google.com/privacy.

8.3. Sign in with Apple

The B42 app offers the option to sign in using your Apple ID. The provider is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA.

When using "Sign in with Apple," Apple transfers your name and email address to the B42 app upon your consent. Apple offers the optional ability to provide an anonymized relay email address so that your actual email address is not transmitted to SFY GmbH. In this case, B42 will communicate with you exclusively via the forwarding address provided by Apple.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for account creation and Art. 6(1)(a) GDPR (consent) for data transfer to Apple. The transfer to the USA is based on the EU-US Data Privacy Framework; Apple Inc. is DPF-certified.

Further information on data protection at Apple: apple.com/legal/privacy.

9. Teams function (CoachZone)

The B42 app includes a Teams area where coaches and clubs can manage their athletes, share training plans, and view performance data. This area is technically connected to the B42 CoachZone (teams.b-42.com) and accesses the same platform.

9.1. Special role structure

The data protection situation in the Teams area differs from the other app functions:

• Athletes use the Teams area to receive content from their coach and share their own training data. SFY GmbH is the controller for this data.
• Coaches and club administrators, who collect, manage, or analyze athlete data via the app, are themselves controllers for this processing under the GDPR. In this context, SFY GmbH processes athlete data exclusively as a data processor in accordance with Art. 28 GDPR.

Athletes who wish to access or request the deletion of their data stored in the Teams area should contact their respective coach or club. SFY GmbH supports the fulfillment of data subject rights upon request from the controller and can be reached at info@b-42.com.

9.2. Data processed in the Teams section

The following data may be processed in the Teams section of the app:

• Athlete name, playing position, and profile picture
• Training results, performance data, and test results
• Attendance and training history
• Internal team communication (e.g., announcements, lineups)

The legal basis for processing by SFY GmbH as a data processor is Art. 6(1)(b) GDPR (performance of a contract with coaches/clubs). Athlete data is deleted no later than 30 days after the termination of the contractual relationship with the respective coach/club.

The full privacy policy for the CoachZone platform, including the tools used and further details, is available at teams.b-42.com/datenschutz.

10. Health Integrations

The B42 app allows you to sync runs and activities via external health and fitness platforms. This feature is available exclusively to users aged 16 and over. Data from these integrations is considered health data under Art. 9 GDPR (special categories of personal data). Processing is based solely on your explicit consent pursuant to Art. 9(2)(a) GDPR. You can disconnect the integration at any time in the app settings.

10.1. Apple Health

On iOS devices, you can grant the B42 app access to your Apple Health data. The provider is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA.

When you enable the integration, the app only reads the data from Apple Health that you have explicitly authorized (e.g., running distance, step count, heart rate, calories burned). The data is transferred only to the B42 app and used there to display and analyze your activities. It is not shared with third parties.

Data is transferred to the USA based on the EU-US Data Privacy Framework; Apple Inc. is DPF-certified. Further information: apple.com/legal/privacy.

10.2. Fitbit / Google

B42 offers integration with Fitbit devices and services. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Fitbit is a Google product).

When you enable the Fitbit integration, activity data such as completed runs, distance, heart rate, and calories burned are retrieved via the Fitbit Web API. The legal basis is Art. 9(2)(a) GDPR (explicit consent). Data is transferred to the USA based on the EU-US Data Privacy Framework; Google LLC is DPF-certified.

We have entered into a data processing agreement with Google. Further information: fitbit.com/legal/privacy-policy.

10.3. Polar

B42 offers integration with Polar watches and the Polar Flow service. The provider is Polar Electro Oy, Professorintie 5, 90440 Kempele, Finland.

When you activate the Polar integration, training data such as completed activities, GPS routes, heart rate, and calorie consumption are retrieved via the Polar Accesslink API. Since Polar Electro Oy is based in Finland (EU/EEA), no third-country transfer takes place. The legal basis is Art. 9 (2) (a) GDPR (explicit consent).

We have concluded a data processing agreement with Polar Electro Oy. Further information: polar.com/de/legal/privacy-policy.

10.4. Garmin

B42 offers an integration with Garmin devices and the Garmin Connect service. The provider is Garmin International, Inc., 1200 E. 151st Street, Olathe, KS 66062, USA.

When you activate the Garmin integration, activity data such as completed runs, GPS routes, heart rate, and calorie consumption are retrieved via the Garmin Connect API. The legal basis is Art. 9 (2) (a) GDPR (explicit consent). Data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework, provided Garmin International is certified under the DPF; otherwise, it is based on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

We have concluded a data processing agreement with Garmin. Further information: garmin.com/de-DE/privacy.

10.5. Storage period for health data

Activity data imported from health integrations is stored for the duration of the contractual relationship. After disconnecting the respective integration or deleting your account, the imported data will be deleted immediately.

11. User rights

11.1. Account deletion

You can delete your B42 account and all associated personal data directly in the app: Profile → Settings (icon at the top right) → Delete account. Deletion includes all stored profile, training, health, and activity data. Data subject to statutory retention requirements (e.g., payment receipts under § 147 AO) will only be deleted after the respective period has expired. You will receive a confirmation email after confirming the deletion.

11.2. Data subject rights

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): You may request information about the personal data processed concerning you.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your data under certain conditions.
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data.
• Right to data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your data.

The right of access and the right to erasure are subject to the restrictions set out in Sections 34 and 35 of the German Federal Data Protection Act (BDSG).

11.3. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority regarding our processing of your personal data.

11.4. Withdrawal of consent

You may withdraw your consent at any time with future effect, either directly in the app settings or by sending an email to info@b-42.com. Processing that took place prior to the withdrawal remains unaffected.

11.5. Right to object to direct marketing

In accordance with Art. 21 (2) GDPR, you have the right to object at any time to the processing of your personal data for the purpose of direct marketing. Once you have objected, we will no longer process your data for this purpose.

11.6. Links to other websites

The app may contain links to services provided by other companies. This privacy policy applies exclusively to the B42 app from SFY GmbH. We have no influence over the data protection practices of other providers.

11.7. Changes to this privacy policy

We reserve the right to amend this privacy policy at any time in compliance with applicable data protection regulations. The current version is available at b-42.com/datenschutzerklaerung-app.

11.8. Contact

If you have any questions regarding the collection, processing, or use of your personal data, please contact:

SFY GmbH
Industriestraße 15
84149 Velden
Germany
Email: info@b-42.com

‍