Privacy
Last updated: 11 October 2026
This policy explains what personal data Blaze collects, why, and what you can do about it. Blaze is a web app that helps trail and ultra runners plan race-day nutrition, and it only collects what it needs to do that.
1. Who is responsible for your data
Blaze is run by Giovanni Maria Miani, an individual based in Luxembourg City, Luxembourg. He is the data controller for the personal data described in this policy.
For any privacy question or request, write to blazeultraapp@gmail.com.
2. What data we collect
We collect only the data you give us and, if you accept analytics, data about how you use the app.
| Data | When we collect it | What it includes |
|---|---|---|
| Account | When you sign up | Email address and password (stored only in hashed form by our login provider). If you use "Sign in with Google": your name, email address and profile picture from Google. |
| Profile and preferences | When you fill in your account page | First and last name, unit system, pace format, temperature unit, language, strategy banner, race motto. |
| Race strategies | When you save a plan | Race and distance, your targets for carbohydrates, fluids and sodium per hour, chosen products and brands, expected conditions, notes you add, dates created and updated. |
| Feedback | When you send feedback | Category, an optional message (up to 200 characters), the page or race concerned, and your account if you are logged in. |
| Race requests | When you request a race | Race name, distance, email address, and your account if you are logged in. |
| Usage analytics | Only if you click "Accept" | Pages visited, features used (for example starting or completing a strategy), browser and device type, approximate location derived from your IP address, and recordings of how you move through pages, with typed text masked. |
| Technical data | Whenever you use Blaze | IP address and basic request logs, processed by our hosting provider to deliver and protect the service. |
Blaze does not need any health information. Please do not enter it in free-text fields such as notes or feedback.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create your account, save your strategies and show them to you | Performance of our agreement with you, Art. 6(1)(b) |
| Answer your race request and tell you when your race is added | Your request, Art. 6(1)(b) |
| Use your feedback to fix errors and improve Blaze and its race data | Our legitimate interest in improving the app, Art. 6(1)(f) |
| Understand how Blaze is used through analytics | Your consent, Art. 6(1)(a), which you can withdraw at any time |
| Keep Blaze secure and prevent abuse | Our legitimate interest in a safe service, Art. 6(1)(f) |
| Meet legal obligations | Legal obligation, Art. 6(1)(c) |
We do not sell your data. We do not use it for advertising, and we do not send you marketing emails unless you separately agree to them.
The nutrition figures Blaze shows are planning suggestions that you can change. We make no automated decisions about you that have legal or similarly significant effects.
4. Cookies and similar technologies
Blaze uses two kinds of cookies and browser storage.
- Strictly necessary: these keep you logged in and remember your cookie choice. The app cannot work without them, so they do not need your consent.
- Analytics (PostHog): these are used only after you click "Accept" in the cookie banner. If you click "Reject", no analytics cookies are set and no usage data is sent.
You can change your choice at any time with the "Cookie settings" link at the bottom of every page.
5. Who processes your data for us
We use a small number of service providers. They process your data only on our instructions and under data processing agreements.
| Provider | What it does for Blaze | Where your data is stored |
|---|---|---|
| Lovable | Hosts the app and runs its backend: database, login and account emails (built on Supabase) | Europe |
| PostHog | Usage analytics, only if you accept them | European Union (Frankfurt, Germany) |
| Sign-in, only if you choose "Sign in with Google" | Under Google's own privacy policy |
We share personal data with public authorities only when the law requires it.
6. Transfers outside the European Economic Area
Your data is stored in Europe. Some of our providers, or their own suppliers, are based in the United States and may access data from there, for example to give technical support. When that happens, the transfer is protected by safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
7. How long we keep your data
| Data | How long |
|---|---|
| Account, profile and strategies | As long as your account exists. If you ask us to delete your account, we delete this data within 30 days. |
| Feedback | Up to 24 months |
| Race requests | Until we add the race and notify you, and no longer than 12 months |
| Analytics events | Up to 12 months |
| Session recordings | Up to 1 month |
| Technical logs | For the short period our hosting provider needs them for security |
We may keep some data longer only where the law requires it.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- have your data deleted;
- restrict how we use your data;
- object to uses based on our legitimate interest;
- receive your data in a portable format;
- withdraw your consent at any time. This does not affect what we did before you withdrew it.
To use any of these rights, write to blazeultraapp@gmail.com. We will reply within one month.
You also have the right to complain to the data protection authority of the EU country where you live, where you work, or where you believe a breach of your rights took place.
9. Security
Blaze uses encrypted connections (HTTPS). Access rules ensure that each user can see only their own account and strategies, and passwords are stored only in hashed form by our login provider. No system is completely secure. If a data breach affects you, we will inform you and the authorities as the law requires.
10. Children
Blaze is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
If we change this policy, we will update this page and the "Last updated" date. If the change is significant, we will also tell you by email or in the app.