Draft, as of October 21, 2026 – please have this reviewed by a lawyer before publishing.
Ilja Mazar, Jakob-Kneip-Straße 22, 40595 Düsseldorf, Email: support@365lions.app
This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit it, the provider processes technically necessary data such as your IP address, the time of access and the page requested, in order to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare. Transfers to the USA are based on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified.
This website sets no cookies and uses no analytics or advertising services. Fonts are loaded from our own server, not from Google. The only things stored locally in your browser (Local Storage) are your choice between light and dark mode and – if you switch languages – your language choice. Whether the site appears in German or English is decided by a script based on your browser’s language setting; this also happens only in your browser.
If you write to us, we use your information only to respond to your request (Art. 6(1)(b) or (f) GDPR).
The camera detects your movements exclusively on your device. Camera images are not transmitted to us. Videos are only saved if you turn on “Record video” – they then go into the “365 Lions Clips” album in your Photos library.
Without an account, reps, streaks, plans and your history are stored only on your device and are not transmitted to us. If you sign in for the Community, your training history (strength sessions with reps per exercise and set times) is also synced with your account on our server so it’s available on your devices. This history is not public. For runs, only the time they were completed is transmitted – no route and no GPS data. Running routes, weekly planning, plan library, heart-rate data, daily goal and reminders stay on your device only.
The app writes your workouts to Apple Health only if you consent. You can revoke this permission at any time in the Health settings.
The Watch app records workout time and heart rate and, with your consent, saves them to Apple Health. 365 Lions reads these values only on your own devices; heart-rate data is not transmitted to us.
Reminders are scheduled locally on your device. Siri Shortcuts and the Widget only access data on your device. If you allow Community notifications, we store the device token for Apple’s Push Notification service (APNs) and your notification settings for this purpose.
iOS may provide technical crash reports. They are stored on your device and only transmitted if you send them yourself via “Share reports.”
To join the Community you use “Sign in with Apple”. The app sends a sign-in token issued by Apple to our server, which verifies it with Apple. We only store the user identifier (sub) that Apple assigns for 365 Lions, so we can recognize your profile on all your devices. We don’t request or store your email address. Apple shares your name at most on your first sign-in; it is only used in the app to pre-fill your display name and is not stored on our server. For each signed-in device we create a session token valid for 30 days; the server only keeps a hash of it.
The Community is optional. Only if you create a Community profile is the following data transmitted to our server and made visible to other users: display name, short bio, Instagram handle (optional), profile color and picture, home city with approximate location, Crew, points, reps and – only if you turn it on – your streak. To calculate points, the reps per exercise, end time and duration of each camera-counted session are transmitted, but no camera images. If you suggest workout spots, upload photos of them or plan meetups, this information is stored as well. If you report a spot or a meetup, we store the report so moderators can review it.
For the map you can choose a home area. We only store a point rounded to a grid of roughly 1–2 km (0.02 degrees) – never your exact address or GPS position. The street search for this uses Apple’s map service. You can turn off your appearance on the map at any time with “Visible on the map” in your profile; your streak is only shown if you share it.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by selecting “Delete profile on all devices” in the app. Your profile, picture, online history, points, your own meetups and uploaded photos are then deleted; approved workout spots remain, with no link to you. You can delete your profile at any time, even without Premium.
Before you use the community, you confirm the community rules and that you are at least 16 years old. For this we only store the time of this confirmation with your profile so that we can prove it. When saving, the server automatically checks profile names, bios, crew names, posts, comments and texts about training spots and meetups for gross insults; rejected texts are not stored.
The Community, history sync and live sessions run on services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, acting as our processor: Cloudflare Workers for the server programs (at api.365lions.app), the Cloudflare D1 database located in Western Europe, and Cloudflare R2 storage for profile and spot photos. A data processing agreement is in place with Cloudflare; any transfers to the USA are based on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified.
We keep your profile, points, history, photos, spot suggestions and meetups until you delete them or your profile. Session tokens expire after 30 days. Online live sessions are deleted after 72 hours at the latest. To prevent abuse, we count requests per IP address for a short time (usually one hour), and only as a hash. When you connect, Cloudflare processes technically necessary connection data such as your IP address and may create logs for operation and troubleshooting.
Nearby: iPhone and iPad connect directly via Apple’s nearby networking (“Multipeer Connectivity” over Wi-Fi and Bluetooth) – encrypted and without our server. Nearby devices with 365 Lions open can see that a device is ready to connect, and its device type (e.g. iPhone). What’s transmitted are workout values such as exercise, count, round, interval phase, remaining and workout time, plus the live camera image to the controlling display; additional displays only receive the workout values. If you’re signed in, your devices receive a secret pairing key from our server that lets them recognize each other as yours without a code. It is never public and is deleted together with your profile.
Share live online: If you share a workout via a viewer code, our server relays the workout values (exercise, count, round, phase and times) to anyone who enters the code. No camera images are transmitted. The session is deleted after 72 hours at the latest.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).