Privacy Policy

Last updated: May 17, 2026

1. Introduction

Welcome to Konia ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile application Konia (the "App") and our website at www.konia.app.

Konia is operated from Switzerland. Personal data is processed in accordance with the Swiss Federal Act on Data Protection (revised, "nDSG") and, where applicable, the European Union General Data Protection Regulation ("GDPR"). We are committed to handling your data in an open and transparent manner.

By using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the App.

2. Contact Information

For any question or concern regarding this Privacy Policy or our data practices, please contact us at:

Email: hello@konia.app

3. Age Requirements

Konia is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at hello@konia.app and we will delete that information promptly.

The App offers a Family feature that allows an adult member to register dependents (e.g. their children) under their own account. The adult acts as the legal guardian and is responsible for the data of the dependents they manage, including providing any required consent.

4. Information We Collect

4.1 Information You Provide Directly

When you use Konia, you may provide us with the following information:

  • Account information: Full name, email address, password (stored hashed by Google Authentication), and optionally a profile photo.
  • Profile information: Optional Instagram username, language preference, theme preference (light/dark), notification preferences.
  • Family/dependents: Names and basic profile information of dependents (e.g. minors) that you register under your account.
  • Club information (for the club creator and administrators): Club name, type, description, logo, website, email, Instagram username, distance unit preference, and invite code.
  • Training and workout data: Trainings you create or join, including title, type, date, start/end time, location, equipment, structured workout steps (warm-up, intervals, recovery, etc.), pool length, training groups, GPX route files, and attached documents (PDF/JPG/PNG).
  • Club race data: Club races you create or join, including name, type, date, location, external website, contact person, contact phone, accommodation, meeting point, and departure time.
  • Participation data: Your join/leave status for trainings and club races, and whether you were added by a coach.
  • Community Feed content: News posts and polls you create (title, body, category, optional photo gallery of up to 10 images, optional document, optional external or internal link, poll options and votes), comments (up to 500 characters, with optional photos or PDF attachments), and emoji reactions.
  • Training places: Saved locations within your club, including name, address, Google Maps URL, optional description (up to 200 characters), and optional photo.
  • Club FAQ entries: Questions and answers created by coaches.
  • Training groups and workout templates: Group names and memberships; reusable templates with workout steps, equipment lists, and documents.
  • Support correspondence: Any information you send us when you contact us by email.

4.2 Information Collected Automatically

When you use the App, we automatically collect certain technical and usage information:

  • Device information: Device type, operating system and version, app version, unique device identifiers, IP address, and user agent (collected by our backend services).
  • Usage data: Features used, interaction patterns, session duration, navigation events, and crash reports (Google Analytics and Google Crashlytics where enabled).
  • Push notification tokens: Cloud Messaging ("FCM") device tokens are registered when you sign in, refreshed when the token changes, and removed when you sign out. Tokens allow us to deliver push notifications to your device.
  • In-app notification history: A record of notifications sent to you (type, title, body, payload) is stored in our database so you can review them in the in-app notification center.
  • Computed analytics: Training statistics (number of trainings attended, participation rate, most practiced type, most active day) are derived from data you and your club generate.

4.3 Information from Third-Party Identity Providers

If you choose to sign in with Google Sign-In or Sign in with Apple, we receive basic profile information from those providers (typically name, email address, and, for Apple, an opaque user identifier). The exact data shared depends on your privacy settings with each provider.

When you use the place autocomplete feature (e.g. when adding a training place or a meeting point), search queries are sent to the Google Places SDK and we receive structured place information (name, address, place identifier) for the place you select.

5. How We Use Your Information

We use the information we collect to:

  • Create and manage your account, and authenticate you when you sign in.
  • Enable you to join and participate in clubs, including trainings, club races, polls, and the community Feed.
  • Allow coaches to manage trainings, club races, members, training groups, places, templates, equipment, and the FAQ.
  • Deliver push notifications about new and updated trainings, club races, posts, comments, and other events, in line with your notification preferences. Each notification type can be toggled individually.
  • Compute training statistics for you and (in aggregated form) for your club coaches.
  • Autocomplete place searches via the Google Places SDK.
  • Detect, prevent, and address technical issues, abuse, or fraud (including using Google App Check to protect our backend from unauthorised access).
  • Comply with applicable legal obligations.

We do not use your data to send marketing emails, and we do not use your data for targeted advertising.

6. Data Storage and Security

6.1 Storage

Your data is stored using cloud services operated by Google. Our primary data storage is configured in Switzerland:

  • Google Cloud (database, Zurich, Switzerland): your profile, club data, trainings, club races, participation records, posts, polls, comments, reactions, places, FAQ, training groups, templates, and in-app notifications.
  • Google Cloud (file storage, Zurich, Switzerland): profile photos, club logos, post photo galleries, place photos, GPX route files, and document attachments.
  • Cloud Functions (Zurich, Switzerland): backend logic that sends push notifications, creates welcome content for new clubs, and cleans up data when a club is deleted.
  • Google Authentication: managed on Google's global infrastructure.
  • Google Analytics and Google App Check: processed on Google's global infrastructure, which may include servers in the United States.

Your core personal data and content therefore remain stored in Switzerland. Authentication and analytics signals may be processed outside Switzerland (see section 14).

6.2 Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption of data in transit (HTTPS/TLS) and at rest (managed by Google Cloud).
  • Authenticated access to all backend services, with server-side authorisation rules.
  • Google App Check, which helps us reject requests that do not come from a genuine instance of our App.
  • Regular review of permissions, access controls, and code.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Sharing and Disclosure

7.1 Within the App

Konia is a collaborative app built around clubs. The following visibility rules apply:

  • Your profile (name, optional photo, optional Instagram) is visible to all members of clubs you have joined.
  • Trainings, club races, posts, comments, polls, places, FAQ entries, and training groups are visible to all members of the club they belong to.
  • Coaches can see additional information (join dates, attendance counts) and can moderate content within their club.
  • Any club member can create posts on the Feed. Authors can edit or delete their own posts and comments. Coaches can additionally pin posts and delete any content within the club.

7.2 Third-Party Service Providers

We share the minimum data necessary with the following service providers acting as our processors:

  • Google (cloud database, file storage, backend functions, authentication, push messaging, analytics, and app integrity service) — to host and operate the App. Core data is processed in Switzerland; authentication and analytics may be processed globally.
  • Google Places SDK — to provide place autocomplete when you add a training place or a meeting point.
  • Apple (Sign in with Apple) and Google (Google Sign-In) — optional identity providers that you can use to sign in.

These providers are bound by their own privacy policies and, where applicable, by data processing agreements with us.

7.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g. a court or a Swiss authority).

7.4 No Sale of Personal Data

We do not sell, trade, or rent your personal information to third parties, and we do not share it for cross-context behavioural advertising.

8. Your Rights

8.1 For All Users

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data (see section 9).
  • Portability: Request a copy of the data you provided in a structured, commonly used, machine-readable format.

8.2 For Residents of the European Economic Area (EEA) and the United Kingdom

Under the GDPR (and the UK GDPR), you additionally have:

  • The right to restrict processing in certain circumstances.
  • The right to object to processing based on legitimate interests.
  • The right to withdraw consent at any time where we rely on consent (this does not affect prior lawful processing).
  • The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Konia does not currently make such decisions.
  • The right to lodge a complaint with your local data protection authority.

8.3 For Residents of Switzerland

Under the revised Swiss Federal Act on Data Protection (nDSG), you have the rights to access, rectification, erasure, restriction, objection, and data portability, as well as the right to be informed about automated decision-making. You may also lodge a complaint with the Federal Data Protection and Information Commissioner ("FDPIC", EDÖB / PFPDT) at www.edoeb.admin.ch.

8.4 For California Residents

Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information is collected, how it is used and disclosed, to access your data, to request deletion, and to non-discrimination in service or price for exercising your rights. We do not sell your data.

8.5 Exercising Your Rights

To exercise any of these rights, please contact us at hello@konia.app. We will respond within 30 days. Most rights can also be exercised directly in the App (account deletion, profile edit, notification preferences, etc.).

9. Account Deletion

You can delete your Konia account at any time from Profile > Delete Account, or by contacting us at hello@konia.app.

When you delete your account:

  • Your profile information, profile photo, and FCM tokens are permanently deleted.
  • Your club memberships are removed.
  • Your participation records (join/leave history for trainings and club races) are removed.
  • Content you have created within a club (trainings, club races, posts, comments, polls, places, FAQ entries, templates) may remain in the club for the benefit of the other members, since this content is part of the club's collaborative record. If you wish such content to also be deleted, please contact us.

When a club is deleted by its coach, our backend automatically removes the club and all its associated data (members, admins, trainings, club races, templates, equipment, places, groups, FAQ, posts and comments, and stored files).

10. Data Retention

  • Active accounts: Data is retained as long as your account is active or as needed to provide the App.
  • Deleted accounts: Personal data is deleted within 30 days of deletion request, except where we are required to retain it for legal, accounting, or fraud-prevention purposes.
  • Backups: Google automatically takes encrypted backups of our databases. Deleted data may remain in those backups for up to 30 days before being overwritten in the normal backup rotation.
  • File storage: Deleted files (photos, GPX, documents) may remain in Google's soft-delete buffer for up to 7 days before final removal.
  • Analytics: Anonymised usage statistics may be kept indefinitely. Identifiable analytics data is retained per Google's default retention policy.
  • In-app notification history: Retained until you dismiss the notifications or delete your account.
  • Support emails: Retained for up to 2 years for service quality and dispute resolution.

11. Push Notifications

We use Cloud Messaging to deliver push notifications about events that may interest you:

  • New trainings or club races in your club.
  • Updates to trainings or club races you are participating in.
  • You being added to or removed from an event by a coach.
  • New members joining your club (coaches only).
  • New posts and polls on the Feed, and comments on posts you are involved in.

Each of these notification types can be enabled or disabled independently in Profile > Notification preferences. You can also disable all push notifications at the operating-system level from your device settings. Push notifications are separate from the in-app notification center, which keeps a history of events even if you have disabled push.

To deliver push notifications, we store the FCM device tokens associated with your account. Tokens are refreshed automatically when they change and are removed when you sign out or delete your account.

12. Third-Party Links

The App may contain links to third-party websites (such as a club website, a race organiser's page, or a Google Maps location). We are not responsible for the privacy practices of these external sites. We encourage you to read the privacy policy of any third-party site you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, in particular when we add new features. We will indicate the date of the last update at the top of this document and, for significant changes, we will inform you through the App. We encourage you to review this Privacy Policy periodically.

14. International Data Transfers

Your core personal data (profile, club data, trainings, club races, posts, comments, polls, places, FAQ, and uploaded files) is stored in Switzerland (Zurich). Switzerland is recognised by the European Commission as offering an adequate level of data protection.

Some data may be processed outside Switzerland:

  • Google Authentication operates on Google's global infrastructure.
  • Google Analytics and Google App Check may process data in the United States.

For transfers outside Switzerland and the EEA, Google relies on the EU–US Data Privacy Framework, Standard Contractual Clauses, and equivalent safeguards. We rely on these mechanisms to ensure your data benefits from a level of protection essentially equivalent to that provided in Switzerland and the EEA.

15. Legal Basis for Processing (EEA, UK and Switzerland)

If you are located in the EEA, the United Kingdom, or Switzerland, we process your personal data on the following bases:

  • Performance of a contract: Processing necessary to provide the App and the services you request.
  • Consent: For optional features such as push notifications, location autocomplete, or analytics where consent is required. You can withdraw consent at any time.
  • Legitimate interests: For security, fraud prevention, App Check verification, and improving our services, where this does not override your rights and freedoms.
  • Legal obligations: To comply with applicable Swiss and other laws.

Effective Date: May 17, 2026

© 2026 Konia. All rights reserved.