Privacy policy

1. Controller

Unkart Solutions, owner Christoph Unkart, Willy-Brandt-Str. 21, 91052 Erlangen, Germany. Email: christoph.unkart@unkart-solutions.de

2. Data we process

• Account: When you sign in with Google we receive your Google account ID, email address, name and profile picture. We do not store a password.
• Own profile picture (optional): If you upload your own picture in the settings, we store it cropped and scaled down (256 × 256 pixels) and without metadata (no location, no camera model) and show it instead of the Google profile picture wherever your profile picture appears. Anyone who knows the image address can load it without signing in (like Google profile pictures; needed for pictures in emails). So that you can change the crop later, we also store the original picture – scaled down (at most 1600 pixels) and without metadata – and the chosen crop; only you can load the original. “Remove” or deleting your account deletes both immediately.
• Activities: FIT files you upload, including timestamps, GPS positions, speed, altitude, heart rate (if included), sensor data and jump data. From these we calculate jumps, tracks, records and statistics for display, as well as an estimate of calories and training load from speed, jumps and the body weight and gender contained in the file.
• Preselection on your device: When importing directly from the watch via USB (Android app) or from a data export, your device itself checks the sport of each file. Only kitesurfing sessions are transferred; other activities never leave your device. To avoid duplicate uploads, the device first sends a checksum (SHA-256) of the file, from which the content cannot be derived.
• KiteJump watch app: If you pair the watch app with your account, we store a checksum of the random device identifier generated by the watch (not the identifier itself), the time of pairing and the last contact, and the watch app version (to point you to updates). The 6-digit pairing code is valid for 15 minutes. The watch uploads saved sessions directly to us via your phone's internet connection (Garmin Connect app): start time, duration, distance, time zone, a coarse GPS track and, per jump, time, height, airtime, position, the RTK height curve and the acceleration curve, plus the calories and training load estimated on the watch. The watch computes this estimate itself from speed, jumps and the weight, gender and VO2max of your Garmin profile; the profile values themselves are not transmitted.
• Garmin Connect: If you connect your Garmin account, we store your Garmin user ID and the OAuth access tokens to fetch new activities. We only fetch activity files, no health data.
• Spots: We derive a place name from the start point of a session. For this we only send the coordinates (without any reference to you) to the Nominatim service of the OpenStreetMap Foundation, if no name is known for the place yet.
• Added spots: Spots you create (name, position, description) are visible to all signed-in users together with your display name.
• Friends & comments: Friendships you enter into and comments you write. Friends can see your sessions (including the track) and comments unless you switch this off in the settings.
• Profile page: Signed-in users see your display name, profile picture and since when you have been a member on your profile page. Your best jumps per spot (spot, date, height, airtime – as in the leaderboards) appear there only if you take part in the leaderboards; sessions and records only for friends, if you share with friends.
• Direct messages: Messages you send to or receive from other riders (text, time, time read) and blocks. They are visible only to you and the other person; the operator does not read messages. You choose in the settings who may write to you (nobody, friends or all signed-in users).
• Email notifications: If someone sends you a friend request, we let you know by email to the address of your Google account (sender's name and a link to the friends page). You can turn this off in the settings.
• Help & feedback: If you write to us via “Help”, we store your message, attached screenshots, the replies and – only if you leave the box ticked – technical information (page, browser or app version, language, paired watches, number and key data of your sessions, in the app the state of the sensor connection without credentials). Without an account we also store your email address to reply to you and, for rate limiting, a shortened, irreversible hash of your IP address. We use this data only to help you and improve KiteJump; it is deleted with your account, requests without an account after 12 months at the latest.
• Spot leaderboards (optional): Only if you opt in, all signed-in users can see your display name, profile picture, spot, date, jump height and airtime of your kitesurfing jumps – no tracks and no times of day. We also suggest you as a friend to other riders if you have been at the same spots (also on the same day), have friends in common or jump similarly high; common friends are only counted, never named.
• Improving jump detection (optional): Only if you consent in the settings, we use your sessions (jumps, GPS track, sensor and RTK data) in pseudonymised form – without name, email, comments and messages – to develop, train and test algorithms for height and jump detection. Only by us, no sharing with third parties. We store the time and version of your consent. After withdrawal your data is not used in any new analyses; models already trained contain no raw data.
• Android app: The app displays the KiteJump website and processes the same data. Sign-in with Google runs in Chrome; afterwards a one-time code valid for 2 minutes hands the sign-in over to the app. The app only accesses a watch connected via USB after your permission and only reads activity files there. If you connect the KiteJump sensor, the app asks for Bluetooth permission and keeps the connection as a foreground service with a notification until you stop it. If you enter NTRIP access for correction data, the app stores caster, user and password only on your phone, connects directly to the caster you chose and sends it the sensor’s current position every 10 seconds so it can compute matching corrections. The caster operator is responsible for that connection; it does not pass through our server. The sensor raw data recording (time, position, height, speed, jumps) is stored only on your phone; it leaves the device only when you share it yourself. Every 12 hours the app asks our server for the latest versions of the app, sensor firmware and watch app to point you to updates; no personal data other than the IP address is transmitted. The app remembers the last seen sensor firmware and the watch app version on the phone. You can switch the check off in the settings. While you are signed in, we store with your account when you first and last used the app and which app version is installed (updated at most hourly), to see how widely the app is used and how quickly new versions are adopted (Art. 6(1)(f) GDPR). You can download the app file from our server.
• Beta reservation: If you reserve a spot for a device under “Beta testers”, we store your name, email address, chosen accuracy level with guide price, your maximum price if given, language, time, the reservation number and the devices you use (watch and phone) and – if you provide them – watch model, home spot and your message, plus the reservation status (open, confirmed, cancelled). No account is needed and the reservation is free. We only use these details to contact you about the beta devices.
• Page counter: We count page views per day and page, split into guest, signed-in and app, plus the country and – only as a domain – the referring website or the campaign tag in the link (utm_source). The country is determined on our server from your IP address using a local database (DB-IP Lite); the IP address is only used briefly in memory for this and is neither stored nor passed on. No cookies are set and no profiles are built; only counts are stored (Art. 6(1)(f) GDPR, audience measurement and improving the service).
• Technical: A session cookie for sign-in and cookies for your chosen language and design. In the storage of your browser or the app we remember the chosen map view and dismissed hints, and for the duration of the session the scroll position in the log and the return after sign-in. The web server processes IP addresses briefly to deliver the page. There is no tracking and there are no analytics or advertising cookies.

3. Purpose and legal basis

We process the data to provide you with the analysis of your kitesurfing sessions and the platform's features – watch app, friends, comments, profile and messages (Art. 6(1)(b) GDPR, contract/terms of use). The Garmin connection, participation in the leaderboards and the use for improving jump detection only take place with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by disconnecting or in the settings. We process beta reservations to take pre-contractual steps at your request (Art. 6(1)(b) GDPR). Cookies and local storage are strictly necessary for the functions you request (Section 25(2) No. 2 TDDDG).

4. Recipients and hosting

The platform runs on servers of Hetzner Online GmbH in Nuremberg, Germany, under a data processing agreement. Google (Google Ireland Ltd.) is used for sign-in and Garmin (Garmin Ltd.) for importing activities from Garmin Connect. The watch app sends via the Garmin Connect app on your phone. Map tiles are loaded from Esri (satellite imagery; Esri Inc., USA) or, if you choose the map view, from OpenStreetMap; water areas, shorelines and buildings in the 3D view come from OpenFreeMap (tiles.openfreemap.org). For sessions in the Netherlands or Bavaria, official aerial imagery is additionally loaded from PDOK (Kadaster, Netherlands) or the Bavarian Surveying Administration (Landesamt für Digitalisierung, Breitband und Vermessung). For the 3D terrain view, elevation data (Terrain Tiles) is loaded from Amazon Web Services (Amazon Web Services EMEA SARL or Amazon.com Inc., USA). Program libraries for maps and 3D display and for unpacking data exports are loaded from the content delivery networks unpkg.com, cdnjs.cloudflare.com (Cloudflare Inc., USA) and cdn.jsdelivr.net (jsDelivr, operated via Cloudflare Inc. and Fastly Inc., USA). Your IP address is transmitted to the respective provider; transfers to the USA are based on the EU-US Data Privacy Framework or the EU standard contractual clauses. For spot names, Nominatim (OpenStreetMap Foundation) receives the start coordinates but no information about you. We do not sell data or share it with any other third parties.

4a. Access by the operator

For administration the operator can see account data (name, email, sign-up and last activity time, app usage and version), the number and metadata of your sessions and your settings. Access to the content of individual accounts (e.g. data access requests, blocking, deletion) only happens for a specific reason and is logged (Art. 6(1)(f) GDPR, operation and security of the platform). The operator does not read direct messages.

5. Retention

Your data is kept until you delete individual sessions or your account. Of deleted sessions we only keep the checksum, start time and, if applicable, the Garmin ID, so that watch, USB and Garmin imports don't recreate them; this is deleted together with your account. Deleting your account immediately removes all sessions, FIT files and data uploaded from the watch, comments, messages (sent and received), blocks, friendships, paired watches and Garmin tokens and deregisters the Garmin connection. Pairing codes expire after 15 minutes, one-time codes for app sign-in after 2 minutes. Beta reservations are deleted once the device has been delivered or you withdraw the reservation, at the latest at the end of the beta phase. We keep backups for no longer than 30 days.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent. You can download all your data including your FIT files and messages under "Settings → Your data" and delete your account at any time via "Delete account". You may also lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA).

Last updated: October 2026. German version: Datenschutzerklärung.