Privacy Policy
1. Data Controller & Contact
Zinq ("we", "us", or "our") is a running-partner matching service operating as a mobile and web application. The data controller responsible for your personal data is Ivan Kharitonenko, trading as Zinq, a sole trader established in Maastricht, the Netherlands.
Rotterdam is the first city Zinq serves. That is where our runners are, not where the service is established — a distinction that matters only if you need to know who is legally accountable for your data.
For any question about your personal data, or to exercise your statutory rights under the GDPR, contact us at hello@joinzinq.com. We will respond within one month, as Article 12(3) requires. A postal address for formal correspondence is available on request at the same address.
We have not appointed a Data Protection Officer. We are not required to: we are not a public authority, our core activity is not large-scale systematic monitoring, and we do not process special categories of data at scale.
2. Personal Data We Collect
Account Data: Your email address, used via our authentication service to verify your identity and manage your sign-in.
Profile Data: Your first name, an optional profile picture, and an optional bio description or route notes.
Running Parameters & Availability: Your preferred pace range (minimum and maximum pace in min/km), your selected running days and times of day, and your neighbourhood area.
Gender & Matching Preferences: Your self-reported gender and matching preference (anyone, women only, or men only). This is used exclusively for algorithmic matching and is never displayed publicly on your profile.
Run Proposals & Direct Messages: When you propose a run, we record the agreed date, time, meeting point, and messages exchanged between matched runners or within club chat channels.
Safety Data: Bi-directional user blocks and safety reports submitted regarding other users.
Preferences & Technical Data: Email notification toggle states and essential session authentication tokens required for secure platform operation.
3. What Is Required and What Is Optional
Required to use Zinq at all: your email address, your first name, your pace range, at least one available day, and your neighbourhood. Without these there is nothing to match on, and an account missing them would appear in other runners’ results as a dead end. If you do not wish to provide them, you cannot use the Service — there is no consequence beyond that.
Entirely optional: your profile photo, your bio and route notes, and your email notification preferences. You can use Zinq fully without any of them, and you can add or remove them at any time in your profile. Withdrawing them does not affect the lawfulness of anything we did with them beforehand.
Your gender and matching preference are required only if you wish to use gender-based matching filters. Setting your preference to "anyone" means your gender is not used to filter who sees you.
4. What We Never Collect or Track
Live GPS Tracking: We never track, record, or monitor your live location before, during, or after runs.
Exact Home Address: We only store your neighbourhood centroid (e.g. Kralingen, Rotterdam). Distances are calculated between neighbourhood centres, never from where you live.
Financial Details: Zinq is free to use. We do not collect credit cards or bank account details.
Third-Party Ad Tracking: We do not sell, rent, or trade your personal data to data brokers, ad networks, or third-party marketing companies.
No Non-Essential Cookies: Zinq sets no cookies, on either the website or the app, and uses no tracking pixels. Simply visiting stores nothing on your device. Two things are stored once you act, both kept in your own browser and never sent to us or anyone else: the app keeps a session token so that you stay signed in, and the website remembers your light or dark theme and your language from the moment you choose them. That is why you are shown no cookie banner — under the ePrivacy Directive, storage that is strictly necessary, or that only records a preference you set yourself, does not require consent.
5. Legal Bases for Processing (GDPR Article 6)
Contractual Necessity (Art. 6(1)(b)): Processing your account data, pace range, availability, neighbourhood, and messages is essential to deliver the core Zinq matching service and enable communication.
Consent (Art. 6(1)(a)): We process optional profile details (such as your photo and bio) and email notification preferences based on your explicit consent, which you can modify or withdraw at any time in your profile settings.
Legitimate Interests (Art. 6(1)(f)): We process safety reports, block lists, and security logs to protect our community against harassment, abuse, spam, and technical fraud. We have weighed this against your interests and consider it proportionate: the data involved is minimal, and the alternative is a platform that arranges meetings between strangers with no way to act on a complaint.
Legal Obligation (Art. 6(1)(c)): We may process data where required to comply with statutory legal duties or legitimate requests from competent authorities under Dutch and EU law.
6. What Other Runners Can See
Visible to matched runners: Your first name, profile picture, bio, neighbourhood name, pace range, availability days, and the number of runs you have completed through Zinq.
Strictly private: Your email address, exact address, gender, matching gender preference, and blocked lists are never disclosed to other users.
Bi-directional blocking: If you block another runner, both profiles immediately disappear from each other’s discovery feeds and matches. Neither party is notified of the block.
7. Automated Matching & Algorithmic Transparency
How matching operates: Discovery matching is an automated database heuristic that compares your pace range overlap, your shared available days and times, and the geographic proximity between neighbourhood centroids.
No profiling or secret scoring: We do not perform credit scoring, behavioural tracking, psychological profiling, or hidden reputation ratings. The run count is an objective completed tally, not a quality score.
No legal effect: Matching decisions have no legal or similarly significant effects within the meaning of Article 22. The algorithm merely orders discovery suggestions; you maintain full autonomy over whom you propose runs to or accept invites from.
Right to explanation: You can ask how your matching parameters function at any time by contacting hello@joinzinq.com.
8. Data Recipients & International Transfers
We use a small number of infrastructure providers, each bound by a Data Processing Agreement. We name them so you can check them yourself rather than take "trusted providers" on faith.
Supabase, Inc. — database, authentication, and file storage for your profile photo. Our primary database is hosted in the West EU (Ireland) region, inside the European Union.
Resend — delivery of transactional email only: sign-up confirmation, password reset, and run notifications. Resend receives your email address and the content of that message. It is a United States provider, so this transfer relies on European Commission Standard Contractual Clauses.
Vercel, Inc. — application and website hosting, plus Vercel Web Analytics and Speed Insights on our marketing site. Both measure traffic and page performance in aggregate. Neither sets a cookie, neither writes anything to your device, and neither identifies an individual visitor or follows you to any other site.
We do not use any other recipient. We do not sell or share your data with advertisers, data brokers, or analytics companies. Where a subprocessor processes data outside the European Economic Area, that transfer is governed by Standard Contractual Clauses to maintain GDPR-equivalent protection.
9. Security & Data Protection Measures
We employ technical and organizational security measures including HTTPS/TLS encryption in transit, encrypted storage at rest, row-level security enforced in the database itself rather than only in the application, and parameterized query execution, to safeguard your personal data from unauthorized access, alteration, or disclosure.
Breach notification: In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority within 72 hours as Article 33 requires, and notify you directly without undue delay where Article 34 requires it.
10. Data Retention & Account Deletion
Retention period: Your personal data is retained only for as long as your Zinq account remains active.
Immediate account deletion: You can permanently delete your account at any time using the "Delete Account" button in your profile, or by emailing hello@joinzinq.com. Deletion is immediate and cascades: your profile, availability, photos, proposed runs, chat messages, safety reports, and block lists are erased from our operational database.
What this means for other runners: Because a conversation belongs to the run it concerns, deleting your account also removes your messages from the other runner’s view of that conversation. There is no way to delete your account while leaving your side of a chat behind, and no way for another runner to retain it.
Encrypted backups: Deleted data may persist in encrypted database backups for up to 30 days before those backups rotate out. Backups are not accessible to the application and are used only for disaster recovery.
11. Waitlist Sign-ups
Before Zinq launched, we ran a waitlist on joinzinq.com. If you signed up, we hold your email address and the city you selected, and nothing else.
Legal basis and purpose: consent, given when you submitted the form, for the single purpose of telling you when Zinq became available in your city. We have never used this list for anything else, and we have never shared it.
Retention: waitlist entries are deleted on request, or twelve months after launch, whichever comes first. Creating a Zinq account does not carry your waitlist entry over — the two are separate, and deleting your account does not delete your waitlist entry.
Withdrawing: every email we send from the list carries an unsubscribe link, and emailing hello@joinzinq.com asking to be removed has the same effect. Withdrawal is immediate and costs you nothing.
12. Your Statutory Rights Under the GDPR
Access (Art. 15): obtain confirmation and a copy of all personal data we hold about you. Rectification (Art. 16): correct inaccurate or incomplete data. Erasure (Art. 17): request full erasure of your personal data. Restriction (Art. 18): restrict processing under certain legal conditions. Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format. Objection (Art. 21): object at any time to processing based on legitimate interests. Withdraw consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of processing carried out before you did.
Exercising any of these rights is free and requires nothing more than an email to hello@joinzinq.com.
Supervisory authority: If you believe our data handling violates applicable law, you have the statutory right to lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens, Bezuidenhoutseweg 30, 2594 AV Den Haag.
13. Age Requirement
Zinq is strictly intended for individuals who are 16 years of age or older (the statutory age of digital consent in the Netherlands under Article 8 GDPR and the Dutch UAVG). We do not knowingly collect personal data from individuals under the age of 16.
If you believe someone under 16 has created an account, tell us at hello@joinzinq.com and we will remove it and erase the associated data.
14. Changes to This Policy
We may update this Privacy Policy as Zinq changes. The date at the top of this document always reflects the current version.
For any change that materially affects how we handle your data — a new purpose, a new recipient, a new legal basis — we will notify you by email before it takes effect, and where the change requires your consent we will ask for it rather than assume it. Minor clarifications and corrections take effect on publication.