What we know about you, and why.

What we collect

• Your email — only if you subscribe.

  Used to send the daily coach mail. Stored until you unsubscribe. We do not share or sell it. Ever.

• Your country (always) and lat/lon (often).

  Country comes from a local DB-IP database that lives on our server — no external lookup, no IP shared with a third party. It drives the unit auto-detect (US → °F + miles) and the cities sort on /cities and /steden. Lat/lon (~city-level accuracy) drives the weather lookup so the coach line matches what's outside your door. Both are derived from your visit's IP and never stored long-term.

• Your precise location — only if you grant it.

  When you press Yes on the homepage, the browser asks for your location. If you accept, we use the precise lat/lon to look up the local weather (via Open-Meteo). If you decline, we fall back to the coarse IP-based location described above.

• Your IP address — briefly, hashed.

  We compute a SHA-256 hash of your IP (first 16 chars) for rate-limiting community submissions, custom roasts, and city suggestions. The raw IP is never stored — only the hash and only for the rolling window we need.

• What you type — for custom roasts and community lines.

  Custom excuses are sent to OpenAI for moderation and roast generation. Community submissions and city suggestions are stored in our database until you ask us to delete them or until an admin rejects them.

• Anonymous pageviews and clicks — our own counter.

  We run our own first-party audience-measurement: pageviews, which excuses are picked, which destinations are shared to, run-commits, subscribes. Stored in our database with route + event-type + country (from local mmdb) + device class + referrer host. No cookie set, no visitor identifier, no PII, no fingerprinting. Falls outside cookie-consent rules per CNIL / DSK / ICO guidance for consent-free first-party analytics. We use it to answer product questions (what works, what gets shared) — not to profile.

• Anonymous run events.

  When you press Yes and commit to a run, we record the moment (timestamp, locale, the excuse you picked, current city + temperature + weather code, IP hash). It's used to power the live counter in the footer and the activity ticker on the homepage. No name, no email tied to it. Kept 90 days at full detail, then anonymised.

• A small cookie + localStorage set — see the table below.

  Locale, theme, units preference, your cookie-consent record, and (only with consent) Google Tag Manager. Full list a few sections down.

Who else sees it

• Brevo (transactional email).

  When we send the daily mail, Brevo sees your email address and the rendered mail. EU servers, EU processor.

• OpenAI (custom roasts + moderation + admin translations).

  When you type a custom excuse, the text is sent to OpenAI to moderate and generate a roast. When an admin uses AI translation, the source text is sent too. OpenAI does not retain API requests for training as of their current policy.

• Open-Meteo (weather + geocoding).

  Weather lookup sends your lat/lon. City-suggestion geocoding sends a typed place name. No account, no cookie required. Their server is in Germany.

• OpenStreetMap Nominatim (reverse geocoding, opt-in only).

  When you click "Use precise location" on /cities and grant the browser permission, we send your lat/lon to OSM's Nominatim service to convert it into a city name (e.g. "Rosmalen"). Free service operated by the OpenStreetMap Foundation. Never invoked without an explicit click + permission grant.

• Mapbox (city map images).

  Static map tiles for city pages are fetched from Mapbox by our server (not your browser). Mapbox sees our server IP, not yours. No tracking script ever loads in your browser from them.

• Strava (running segments).

  Strava's public segments-explore API powers the segment markers on /city/[name] pages. Our server queries it with city lat/lon. Strava sees our server IP and the bounding-box lookup, not your IP or your identity.

• Meta (Facebook + Instagram, outbound only).

  When we auto-post the daily roast to our own Facebook page and Instagram account, our server calls the Meta Graph API. No visitor data is sent — only our roast text and our own square OG image. Meta does not see who you are.

• Google Tag Manager + GA4 (analytics, optional).

  Only loads when you accept cookies. Used to count visits and clicks for product decisions. We do not run advertising pixels.

• Our hosting (Vultr via Cleavr).

  The server runs on a Vultr instance in the EU. Standard web logs (IP, user agent, requested URL, timestamp) are kept for 7 days by the provider for abuse and uptime monitoring.

Cookies, exactly which ones

We keep this list complete and current. If we add anything, the date at the top of this page changes and (if you've consented to analytics) GTM will see a new consent_version field.

How long we keep it

Email: until you unsubscribe (one click in every daily mail). Run events / excuse picks: 90 days at full detail, then anonymised (city + temp blanked, only the slug + timestamp kept for aggregate stats). Community submissions + city suggestions: until you ask us to remove yours, or we reject it. Rate-limit hashes: 1 hour, rolling. Server logs at Vultr: 7 days.

Your rights

You can ask us to: - Show you everything we have tied to your email or submitted name. - Delete it. - Hand it over in a portable format (we'll send JSON). - Update or correct anything that's wrong. - Object to processing. Reply to any daily mail or write to the address below. We try to respond within 7 days. If you're in the EU/EEA/UK and unhappy with our response, you can also complain to your national data-protection authority — in the Netherlands that's the Autoriteit Persoonsgegevens.

What we never do

We don't sell your data. We don't share it with advertising networks. We don't profile across sites. We don't use dark patterns to keep you subscribed — there's an unsubscribe link in every mail and a one-click confirm page that works without an account. We don't fingerprint your browser. We don't pixel-track. We don't run third-party scripts in the page except Google Tag Manager, and only when you've said yes.

Children

nobs.run is intended for people 16 and older. We don't knowingly collect data from younger users. If you believe we have, get in touch and we'll remove it.

International transfers

OpenAI processes API calls in the US. We rely on the EU-US Data Privacy Framework for that transfer. Brevo and Open-Meteo process within the EU. Mapbox uses US servers; transfers happen server-to-server (your IP isn't part of it). Strava is US; same — server-to-server, not your IP.

Changes to this page

When we change anything substantive, we update the date at the top and (if you're a subscriber) mention it in a daily mail. The full history lives in git: github.com/elixermedia/nobsrun.