Privacy Policy

1. The controller

The controller of the personal data described here is: Machán Félix egyéni vállalkozó (sole trader), registered seat: 1063 Budapest, Szinyei Merse utca 10., basement 2., Hungary, registration number: 62834119, tax number: 92391905-1-42, e-mail: support@cheerlify.com, for data-protection matters: privacy@cheerlify.com. Cheerlify is the brand name of the service; the service is operated from Hungary.

We have not appointed a data protection officer (not required at our size); for privacy questions or requests, contact us at the e-mail address above.

The runner as a "household" user. When a runner shares the race link with friends and family and they send cheers, that is a personal, private activity on the runner's part; in that respect the GDPR does not apply to the runner. Cheerlify is responsible as controller for the data processed in its own systems (every category below).

2. What data we process

• Runner account: e-mail address, display name, the password hash (never the password itself) — or, with Apple/Google sign-in, the identifier and e-mail received from that provider (with Apple, at your choice, a hidden relay address) — plus the profile details, profile picture and race settings you provide, and which version of the Terms you accepted and when, and when you acknowledged the safety notice shown before your first tracking start.
• Race data: uploaded GPX routes and, from the moment tracking starts (including the wait before the start) until the end of the race, location data (GPS coordinates and timestamps), the phone's battery level and charging state (plugged in or not, Low Power Mode on or off), and the phone's model and major operating-system version (e.g. "iPhone 15 Pro, iOS 26"; no device identifier) (for energy-saving tracking, debugging and measuring the app's battery use), from which we compute progress, pace and ETA, and the resulting recap.
• Supporter data: the display name entered on joining, the recorded cheers (audio or video — a recording of the supporter's voice and, for video, face), chat messages, claps, and — only if the supporter chooses — a one-off location pin, and, if they enable browser notifications, the browser's push subscription endpoint. Supporters have no account; we do not ask them for a name or e-mail.
• Data provided by others: if a runner invites a co-runner by e-mail, we process the invitee's e-mail address to send the invitation (source: the inviting runner). A video cheer may show people other than the person recording it (source: the supporter sending the cheer). We cannot inform such third persons directly; we ask the recorder to include others only with their consent, and anyone appearing can request deletion at any time (section 8).
• Payment data: purchases are made through in-app purchase in the Apple App Store or Google Play. We receive a signed confirmation of the product, price tier, currency and the store's transaction identifier. We never receive or store card details.
• Refund requests on the App Store: if you ask Apple to refund an in-app purchase, Apple asks us how much of it you used. We then only tell Apple whether you received the purchase and what share of it was used (for cheer credits the share of cheers sent, for a pack whether the race started, for a Season Pass the share of its year that has passed). No account data, race data or recordings are shared, and nothing is sent unless you accepted the terms (Terms 5.4).
• Referral programme: your invite code and who invited whom (to settle rewards).
• Support, contact, reports: if you write to us (e-mail, the website's contact form, in-app feedback), your name, e-mail address and message; if you report content, the reason for the report and — if you give it — your e-mail address so we can tell you the outcome.
• Newsletter: if you subscribe, your e-mail address, the time of subscription and of confirmation (double opt-in by e-mail), and the fact of unsubscribing.
• Waitlist: if you sign up on the website to hear about the launch, your e-mail address, language and — if you came from a campaign link — the campaign source. Kept until you unsubscribe; the fact of unsubscribing for 3 more years so we don't write again, then deleted.
• Campaign data: if you arrive through a campaign link (e.g. `?src=ig`), we store at sign-up which campaign brought you (to measure which channel works).
• Technical data: for every API request the time, the function called, the IP address and — for signed-in users — the e-mail address (operational security, abuse prevention); the IP address and basic details of failed requests (security, debugging); a push notification token if you enable notifications, and the error reports described under Sentry (without personal data).
• Device identification to prevent abuse: on the website a random key stored in the browser; in the app additionally the device's ANDROID_ID on Android and a single-use Apple DeviceCheck token on iOS. We store the identifiers only as a keyed, irreversible fingerprint (HMAC), and for DeviceCheck we only read and set the "banned" flag Apple stores. Used solely so that a device banned for violating the community rules cannot rejoin; not for tracking, profiling or advertising.
• Website analytics: page views, referrer, campaign parameters, a few anonymous events (e.g. "cheer sent") — without cookies, in a form that cannot identify you (see section 9).

We ask for no special-category data. We do not collect health data (e.g. heart rate). We do not use audio or video recordings to identify a person (no biometric processing).

3. What we use it for, and the legal basis

• To provide the service you asked for — creating and running races, live tracking, cheers, recaps and delivery of the notifications you enabled, settling referral rewards, answering support requests (GDPR Art. 6(1)(b), performance of a contract).
• For a supporter's own data (name, recording, chat, claps, pin): by joining and sending a cheer the supporter also concludes a contract with us (Terms 2.1), so the processing is performance of that contract (Art. 6(1)(b)). Keeping the recording in the runner's recap, and the data of third persons visible in a recording, are based on legitimate interest (Art. 6(1)(f)). The essence of the balancing test: the supporter sends the recording voluntarily and specifically to this runner; only the runner (and the sender) can play it, other followers cannot; it is kept for a limited time (section 7); the sender and anyone appearing can request deletion at any time; there is no public display. The full balancing test is available on request.
• To collect payment for credits and upgrades and to keep the accounting records required by law (Art. 6(1)(b) and (c)).
• To keep the service running, secure and free of abuse — rate limiting, error logs, moderation, excluding accounts and devices banned for violations, examining reports and keeping records of moderation decisions (partly a legal obligation: DSA Art. 16–17) (Art. 6(1)(f) and (c)).
• Consumption data given to Apple on a refund request: preventing refund abuse (Art. 6(1)(f), legitimate interest); only delivery and the share used are shared.
• Campaign data and analytics: understanding where users come from and which features they use (Art. 6(1)(f), legitimate interest); not used to identify you.
• To send the transactional e-mails the service needs (verification code, password reset, invitations, the warning before recordings are deleted, notice of changes to the Terms) (Art. 6(1)(b)). We send marketing e-mail (the newsletter) only if you expressly subscribed and confirmed by e-mail; you can unsubscribe with one click in every message (Art. 6(1)(a), consent). We do not measure opens in the newsletter.
• To establish, exercise or defend legal claims and to comply with requests from authorities (Art. 6(1)(c) and (f)).

Automated decision-making, profiling: none. Moderation decisions are made by a person.

App permissions. The app uses the phone's location, microphone, camera and notifications only after the operating system's permission prompt and only for the corresponding feature (tracking, recording a cheer, notifications). You can revoke the permissions in the phone's settings at any time; that feature then stops working, the rest continue.

4. Who we share it with (processors and recipients)

We use the following providers; they process data solely on our instructions:

• Cloudflare, Inc. — CDN, DNS, TLS, DDoS protection, the tunnel in front of the server (all traffic passes through it) (EU / USA, EU-US Data Privacy Framework + SCCs).
• Cloudflare, Inc. — R2 storage: encrypted backups of the database and media files (EU jurisdiction). The backup is encrypted on the server; only we hold the key.
• Resend, Inc. — transactional e-mail and newsletter delivery, and passing e-mails sent to us into our support system (EU (eu-west-1) / USA; EU-US Data Privacy Framework).
• Zoho Corporation B.V. — hosting of the cheerlify.com mailboxes (mail sent to support@, privacy@ etc.) (EU data centre).
• Functional Software, Inc. (Sentry) — error monitoring, personal-data sending switched off (EU / USA).
• Apple Inc. / Apple Distribution International Ltd. — App Store, in-app purchase, Sign in with Apple, push notifications, DeviceCheck (marking banned devices: Apple stores two bits per device for us; it receives no personal data from us) (EU (Ireland) / USA).
• Google Ireland Ltd. / Google LLC — Google Play, in-app purchase, Google Sign-In, push notifications on Android (EU (Ireland) / USA).
• OpenFreeMap (Zsolt Ero, Hungary) — map tiles; your browser / the app fetches the map directly from them (IP address) (EU).
• The iOS app's map is drawn by Apple Maps; the app fetches map tiles from Apple for it (IP address) (Apple, EU / USA).

Other users as recipients. Supporters who know the race link (and, for a private race, the access code) see the runner's live position (the precise GPS position, from the moment tracking starts, including the wait before the start) and the route covered so far, name, profile picture and the race's cheer timeline (the other supporters' names and chat messages; recordings can be played only by the runner and the sender). The runner sees who sent each cheer (display name) and can download their race's recordings. Nothing is public: there is no search, listing or public profile. If the runner shares downloaded recordings or the recap elsewhere, the runner is responsible for that. What supporters see, they can record (e.g. with a screenshot) and pass on; we cannot control that.

We do not sell personal data and use no advertising trackers. We hand data to authorities or courts only where the law obliges us or where it is necessary to assert a legal claim. If another business takes over the operation of Cheerlify (e.g. a company founded by the provider), we transfer the data to it — with prior notice — and it processes them under this same policy.

5. Transfers outside the EU

Our servers are in Hungary. Some of the providers above (Cloudflare, Sentry, Apple, Google, Resend) may also process data in the United States; those transfers rely on the EU-US Data Privacy Framework (every US provider listed is a certified participant) and/or the European Commission's Standard Contractual Clauses. We send a copy of the safeguards on request.

6. Location data

We collect location only from the moment tracking starts (including the wait before the start) until the end of the race, while the runner shares it, and only for that race. On iOS the app asks for "Always" (background) location permission so that tracking continues with the screen locked; on Android it runs as a foreground service (shown by a notification) without background permission. Followers of the race see the location, and we keep it as part of the recap. The supporter's location pin is voluntary, and the supporter can delete it at any time. The runner can stop tracking in the app at any time; after that no new location is recorded.

What followers see. Followers see the runner's precise, real-time position (not only the place projected onto the course) and the route covered so far — from the moment tracking starts, so during the wait before the start too. We therefore recommend starting tracking near the start line, not at home or where you are staying. With an uploaded route the race closes automatically when the runner reaches the finish; without a route the runner closes it with Finish. If a race receives no location for 48 hours, we close it automatically.

What we don't use it for. We use location only for tracking, for computing progress, pace and ETA, and for the recap. We do not build heatmaps or aggregated datasets from it, do not sell or license it, do not use it for advertising, profiling or training artificial intelligence, and do not share it with anyone other than the processors listed in section 4 and the race's followers (except where an authority lawfully requires it).

7. Retention

• Account data is kept while the account exists; within 30 days of deletion we delete everything belonging to it (except what the law requires us to keep).
• Cheer voice and video recordings are kept from race day for the period of the race's pack: free race: 14 days, Race Pack: 30 days, Marathon Pack (and Season Pass): 90 days. We e-mail the runner 7 days before deletion; until then they can download the recordings one by one or all at once (ZIP); deletion happens no earlier than 7 days after the notice. After a recording is deleted, the fact of the cheer (sender's name, time, place on the course) stays in the recap.
• Race data (route, GPS points), chat and the recap are kept for at most 2 years after the race (or until the runner deletes the race or the account earlier); then the race is deleted with all its data.
• Races created without an account (anonymous) and their cheers are deleted by the periodic clean-up no later than 12 months after the race.
• Purchase records are kept as long as accounting and tax law requires (currently 8 years); they contain the transaction, not your race data.
• Referral programme data while the account exists, to settle rewards.
• The API request log (IP address, and the e-mail address of signed-in users) is kept for 30 days, the log of failed requests for at most 90 days. The push token and the browser push subscription are deleted when you turn notifications off or the store / browser reports them invalid, and at the latest when the race is deleted.
• Backups may contain already-deleted data for at most 90 days; we read from them only for recovery.
• Complaints and support cases (with the correspondence and our answer) are kept for 3 years after they are closed.
• Ban records (the account concerned, device fingerprints, the reasons for the decision) are kept while the ban lasts, at most 3 years; the register of reports and moderation decisions also for 3 years.
• The newsletter subscription is kept until you unsubscribe; the fact of unsubscribing (the e-mail address on a suppression list) is kept for a further 3 years so we do not write again, then deleted.
• Analytics data is kept for at most 13 months, then deleted; aggregated numbers that cannot be linked to a person (e.g. monthly visitors) may be kept afterwards.

8. Your rights

Under the GDPR you can request access to your data, its rectification or erasure, restriction of processing, object to processing (in particular processing based on legitimate interest), request data portability, and withdraw consent where we rely on it (withdrawal does not affect the lawfulness of earlier processing). Runners can delete their account in the app (Profile → Account) or at cheerlify.com/delete-account; supporters can ask by e-mail for a cheer or message to be deleted. If you appear in a video cheer you did not send, you can also ask for it to be deleted.

To exercise any right (access, rectification, erasure, restriction, objection, portability), write to privacy@cheerlify.com (requests sent to our general support address, support@cheerlify.com, are handled too); we reply within one month (for complex requests this may be extended by up to two months, and we tell you if so). Requests are free of charge. If we cannot be sure the request comes from you — e.g. supporters, who have no account — we may ask for further details to identify you (e.g. the race link and the name used when joining). You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11., naih.hu, ugyfelszolgalat@naih.hu) or with the supervisory authority of your country of residence, and you can go to court.

9. Cookies, local storage and analytics

The website uses no tracking or advertising cookies, so there is no cookie banner. The browser's local storage keeps the language, the races you joined, the random key used for abuse prevention (section 2), (for runners) the login token, the campaign parameter for 30 days if you arrived via a campaign link, and a few convenience flags (e.g. an announcement bar you closed, analytics switched off) — these are necessary for the service you requested or record your own choice; the admin interface uses one strictly necessary session cookie only.

We measure visits with one cookieless tool, Umami, running on our own EU-hosted server (stats.cheerlify.com). It sets no cookie, stores nothing in your browser and does not identify you; we do not store the IP address, do not share the data with third parties, and only look at it in aggregate. The legal basis is our legitimate interest in making the site clearer and more usable (Art. 6(1)(f)); you can object under section 8 — or, more simply, switch the measurement off for this browser with one click at the bottom of this page.

10. Security

Traffic is encrypted (TLS, Cloudflare), passwords are stored hashed, uploaded media under unguessable names, access is rate-limited, and the origin server is reachable only through an authenticated tunnel. Backups are encrypted, off-server, on EU storage. Nobody besides the provider has access to the data; we have no employees. No system is perfectly secure; if a data breach affects your data, we notify the authority within the statutory deadline (72 hours) and — where required — you as well.

11. Children and changes

Cheerlify is not aimed at children under 16, and we do not knowingly create accounts for them. If a child under 16 sends a recording as a supporter, or a child appears in a recording, a parent can ask for it to be deleted.

We may update this policy; the date above shows the current version. We give at least 7 days' notice of material changes by e-mail and in the app; earlier versions remain available on the website.

Analytics in this browser

You can switch the cookieless measurement (Umami page views) off here with one click. The setting applies to this browser only and leaves one flag in its local storage.

Versions

• 2026-11-10 — in force
• 2026-09-24 — earlier version