Privacy policy
Last updated: 15 September 2026
Courtesy translation. This English version is provided for convenience only. UNYWAYS is established in France and these terms are governed by French law: in the event of any discrepancy, the French version is the only one that legally binds the parties.
This page explains what personal data UNYWAYS collects, why, how long it is kept, and how to exercise your rights. It is written to be read, not to be skimmed past: every processing activity described corresponds to a real feature of the service.
1. Data controller
Controller: Joachim BERLAND, sole trader
Address: 99 Traverse du Val Fleuri, 06250 Mougins, France
Contact for any data-related question: contact@unyways.com
Data protection officer (DPO): none appointed — appointment is not mandatory given the nature of the activity and the volume of data processed. Requests are handled directly at the address above.
2. Data collected
2.1 Account data
Email address, first and last name, password. The password is never stored in plain text: only an irreversible cryptographic hash is kept (PBKDF2-SHA256, 600,000 iterations, a random salt per account). Nobody, the publisher included, can recover your password from that hash.
2.2 Training data
This is the data used to build the programme: target race and date, level, weekly volume, number of sessions, available days, recent long run, history and experience, reference times.
As the subscription goes on, this is joined by: completed-session tracking, perceived effort (RPE) after each session, daily readiness checks (sleep, energy, muscle soreness, stress, overall condition), races imported as GPX files and the measurements computed from them (distance, duration, pace, splits, elevation, heart rate where the file contains it), together with league participation and results.
Readiness checks and the heart rate taken from your GPX files may, depending on context, constitute health data within the meaning of Article 9 of the GDPR. They are processed only on the basis of your explicit consent, given at the moment you enter or import them, and solely to adapt your training. You may stop supplying them at any time without losing access to the service: the programme is then built without them.
2.3 Exchanges with the coach
The content of messages sent from the member area, together with enquiries submitted through the home page contact form (first name, email, goal, target date, message).
2.4 Payment data
The subscription is processed by Stripe. Your card details are entered directly into Stripe's interface: they do not pass through UNYWAYS servers and are never stored there. UNYWAYS keeps only the Stripe technical identifiers for your customer record and subscription, its status (active, trialing, cancelled, unpaid) and its renewal dates.
2.5 Technical and security data
To protect accounts against brute-force attacks, failed sign-in attempts are recorded with the IP address and a timestamp. Active sessions are held as random tokens. This security data is never used for advertising profiling or for marketing by any third party.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account | Account | Performance of the contract (Art. 6(1)(b)) |
| Build and adjust your programme | Training data | Performance of the contract |
| Adapt training to your condition | Readiness checks, heart rate | Explicit consent (Art. 9(2)(a)) |
| Manage the subscription and billing | Payment | Performance of the contract · legal obligation (accounting) |
| Reply to your messages | Exchanges, contact form | Legitimate interest — replying to you |
| Tables and challenges between runners | First name, race results | Performance of the contract — visible only to members of your league |
| Keep accounts secure | IP address, sign-in attempts | Legitimate interest — preventing fraudulent access |
| Send service emails | Performance of the contract |
4. Retention periods
| Data | Length |
|---|---|
| Account and training data | For the whole subscription, then 12 months after cancellation — deleted thereafter |
| Exchanges with the coach | Same period as the account |
| Contact form enquiries | 12 months from the last exchange |
| Invoices and accounting records | 10 years (legal obligation, Article L123-22 of the French Commercial Code) |
| Sign-in sessions | 30 days, then automatic expiry and purge |
| Failed sign-in attempts | A few hours — the length of the rate-limiting window |
| Password reset links | 1 hour, single use |
Deleting your account erases your training data and your exchanges, other than records the law requires to be kept (invoices).
5. Recipients and processors
Your data is not sold, rented or transferred. It is accessible to the coach, strictly as far as needed to follow your training, and to the following technical providers:
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Site and database hosting | United States — European infrastructure where available |
| Stripe Payments Europe, Ltd. | Payment processing | Ireland (European Union) |
| Resend | Sending service emails (password resets, contact form) | United States |
Transfers to the United States are governed by the European Commission's standard contractual clauses and, where applicable, by the provider's certification under the EU-U.S. Data Privacy Framework. Each provider is bound by a data processing agreement prohibiting any use of the data for its own purposes.
6. Your rights
Under the GDPR, you have the following rights:
- Access — obtain a copy of the data concerning you.
- Rectification — correct inaccurate data. Most of it can be changed directly from your member area.
- Erasure — request deletion of your account and associated data.
- Restriction — ask for processing to be frozen while something is checked.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdrawal of consent — at any time, for health data, without affecting what was done before the withdrawal.
To exercise any of these rights, write to contact@unyways.com. You will receive a reply within one month. Proof of identity may be requested where there is serious doubt about the requester's identity, and only in that case.
If the reply does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
7. Cookies and local storage
The site sets cookies and local storage that are strictly necessary for it to work. With your consent, it may also use Google Analytics for audience measurement, and the TikTok pixel to measure how well our TikTok ads perform. A banner lets you choose, category by category, what you accept from your very first visit — nothing is measured before you agree, and you can change your mind at any time.
Strictly necessary cookies and storage
Exempt from prior consent (Article 82 of the French Data Protection Act): they only serve a service you requested yourself.
| Last name | Type | Role | Length |
|---|---|---|---|
| preparun_session | Strictly necessary cookie | Keeps you signed in to your member area. Set only after signing in, inaccessible to JavaScript (HttpOnly), sent over HTTPS only (Secure) and restricted to the site (SameSite=Lax). | 30 days |
| Display preferences | Browser local storage | Remembers the light or dark theme. Never leaves your device and is never sent to the server. | Until you clear it yourself |
| unyways_consent | Browser local storage | Remember your cookie choice (categories accepted or declined), so you're not asked again on every visit. Never leaves your device and is never sent to the server. | 6 months |
Audience measurement (subject to your consent)
Set only if you have accepted the “Audience measurement” category in the cookie banner. These cookies are managed by Google Analytics (Google Ireland Limited), with the safeguards for transfers outside the European Union that Google provides for this service.
| Last name | Type | Role | Length |
|---|---|---|---|
| _ga | Audience measurement cookie (Google Analytics) | Distinguish users in order to compile visit statistics. | 2 years |
| _ga_* | Audience measurement cookie (Google Analytics) | Remember the state of a visit session for Google Analytics. | 2 years |
Personalised advertising
Set only if you have accepted the “Personalised advertising” category in the cookie banner; without that consent, the TikTok pixel does not load and no data is sent to TikTok. The TikTok pixel (TikTok Technology Limited, Ireland) lets us measure how well our ads on TikTok perform, for example whether a visit to the site follows watching one of our videos. It sends TikTok technical information about your visit (page viewed, browser, IP address, cookie identifier). TikTok also uses this data for its own advertising purposes, under its own privacy policy, and may transfer it outside the European Union with the safeguards it provides.
| Last name | Type | Role | Length |
|---|---|---|---|
| _ttp | Advertising cookie (TikTok) | Recognise your browser to attribute a visit to a TikTok ad. | 13 months |
| _tt_enable_cookie | Advertising cookie (TikTok) | Check that the browser accepts the pixel's cookies. | 13 months |
| ttcsid, ttcsid_* | Advertising cookie (TikTok) | Group the events of a single visit session. | Set by TikTok |
Your choice
You can accept, reject or customise your choice at any time from the “Manage cookies” link at the bottom of every page. This choice is kept for 6 months on your device, after which you will be asked again.
8. Security
The following measures are in place:
- encryption of all traffic (HTTPS enforced, HSTS enabled);
- passwords stored as PBKDF2-SHA256 hashes at 600,000 iterations with a unique salt per account;
- sessions carried by an HttpOnly, Secure, SameSite cookie that expires automatically;
- rate limiting on sign-in attempts, per account and per IP address;
- strict security headers (content security policy, anti-clickjacking, anti-sniffing );
- cryptographic verification of the signature on every payment notification received from Stripe, before it is acted upon;
- access isolation: a runner can only reach their own data, which is checked server-side on every request rather than in the browser.
In the event of a data breach likely to create a risk to your rights and freedoms, you will be informed as promptly as possible, and the CNIL will be notified within 72 hours in accordance with Article 33 of the GDPR.
9. Minors
The service is not intended for people under 15. Subscribing on behalf of a minor requires the agreement of their legal guardian, together with prior medical advice.
10. Changes to this policy
This policy may change. Any material change will be notified to subscribers by email before it takes effect. The date it was last updated appears at the top of this page.