Privacy policy
Last updated 28 October 2026
1. Who is responsible
BonusBurn is operated by STRKK LTD, which is responsible for your personal information. We are registered in England and Wales, company number 13503997, at 86-90 Paul Street, London, EC2A 4NE, United Kingdom. We are registered with the Information Commissioner’s Office as a data controller, registration number ZC279052. For privacy questions, use our contact form or email [email protected].
2. Adults only
BonusBurn is for people aged 18 and over. We do not offer accounts to children. If you believe someone under 18 has provided information to us, please contact us.
3. Account, purchase and support information
We collect the details you give us to create and manage your account, including your name, email, login details, language and preferences. We also keep subscription and consent records, support messages, and device and network information needed to protect your account. Payment providers tell us about purchases, renewals, cancellations and refunds. We do not receive your full card details. Please do not send passwords, card details or unnecessary medical information in support messages.
4. Health and activity information
If you explicitly consent to health and activity processing, we store the profile information you choose to provide, such as date of birth, sex, height and weight, together with body measurements, water entries, workout records, exercise feedback, goals, activity preferences, progress and rewards. This information may reveal your health. We use it to personalise exercise and calorie estimates, save and synchronise your activity, calculate progress and provide reminders you request. We do not use your health or activity information for advertising.
5. Your health-data choice
We ask for your explicit consent before you use personalised health and activity features. You can decline and still manage your account and subscription, export your information or delete your account. You can withdraw consent in Settings at any time. Once confirmed, this stops health tracking and reminders and permanently deletes your saved health, activity and progress information. Your account, billing records and limited evidence of your consent choice remain. Keeping that consent evidence does not mean keeping the health history you have asked us to erase. Other devices update when they reconnect; notifications already sent cannot be recalled. If you consent again, you start with a clean history. Withdrawal does not cancel your subscription or change the lawfulness of earlier use of your information. Backup copies are covered below.
6. Location, maps and device health services
If you choose outdoor route features, location permission allows us to plan or record your route, including during an active background workout where you allow this. Mapbox receives map or routing requests and the coordinates needed to provide those features. Saved outdoor records can contain precise route coordinates. You can stop a workout and change location permissions in device settings. Device permissions are separate choices and do not replace your explicit consent to our health-data processing. Separately, if you enable health export, the native app writes BonusBurn workouts to Apple Health or Health Connect. The Apple Watch app can use heart rate and energy readings during a BonusBurn workout. We do not import prior or passive activity history. Turning export off stops future exports; manage previously exported records in your device’s health settings.
7. Leaderboards and notifications
Leaderboards are off by default. Sharing requires a separate, explicit opt-in, which you can withdraw without losing your account or subscription. If you opt in, other signed-in users can see your display name, selected country, ranking and activity totals such as calories, minutes or XP. You can turn participation off in Settings. When you enable notifications, we use your reminder preferences, timezone and a device push token to deliver them through Apple or Google. You can turn reminders off in BonusBurn or revoke device notification permission.
8. Why we use information and our legal bases
Under UK GDPR Article 6(1)(b), we use account and subscription information to perform our contract with you: signing you in, managing billing and providing account support. Health and activity processing, including personalisation and activity synchronisation, relies on your consent under Article 6(1)(a) and explicit consent under Article 9(2)(a). Website analytics relies on your consent under Article 6(1)(a). We rely on legitimate interests under Article 6(1)(f) for necessary security, abuse prevention and error reporting, and Article 6(1)(c) for legal obligations. Legitimate interests alone do not authorise health-data processing. Where specific health information is necessary to establish, exercise or defend a legal claim, Article 9(2)(f) may apply alongside an appropriate Article 6 basis. This does not justify keeping an entire health history indefinitely for hypothetical claims. We do not make decisions with legal or similarly significant effects solely by automated processing; exercise suggestions and calorie estimates are not medical decisions.
9. Cookies and analytics
We use cookies and similar storage for sign-in, security, preferences and keeping your activity available between visits. Our contact form, web sign-in and registration use Cloudflare Turnstile to reduce spam and automated abuse. Payment providers also use technologies needed to protect and deliver their services. Blocking necessary browser storage may prevent account or payment features from working.
On bonusburn.com we use Google Analytics to understand which pages help people and which links bring them to BonusBurn. It only runs if you choose Accept on our analytics banner; until then, nothing is sent to Google. If you accept, Google Analytics sets cookies and receives information such as the pages you visit, the buttons and campaign links you use, your device and browser type and your approximate location. Google’s advertising features and Google signals are switched off, so this information is not used for advertising or ad personalisation. We rely on your consent for this, and we never send health or activity information to Google Analytics. Your choice is saved in your browser; to change it, clear this site’s cookies and storage and the banner will appear again.
The BonusBurn app does not currently use analytics or advertising tracking. If we introduce them, we will update this notice and ask for your choice first.
We use Sentry, provided by Functional Software, Inc., to receive error and crash reports from the app, this website and our servers so we can find and fix faults. A report describes what went wrong and the type of device or browser involved. Personal details such as your name, email address and account are stripped before it is sent, and reports are stored in Sentry’s EU region. We rely on our legitimate interest in keeping BonusBurn working for this.
10. Cloudflare Turnstile
Turnstile uses technical browser and device signals to distinguish people from automated traffic. Cloudflare processes these signals on our behalf to protect our forms. It also acts as a separate controller when using signals to improve its own bot detection. That use is covered by Cloudflare’s Turnstile Privacy Addendum. We rely on our legitimate interest in protecting accounts and preventing abuse for our use of this security check.
11. Service providers and other recipients
We use Cloudflare to deliver and protect the website and store backups; Google Analytics, if you accept it, to measure how the website is used; Sentry to receive error and crash reports; Resend to deliver account emails and contact-form messages; and Google Workspace to handle support email. Web purchases are sold through Link, Stripe’s checkout service, which acts as the seller and uses your details under its own privacy notice. Apple or Google handle store purchases; RevenueCat links native purchase status to your BonusBurn account. Google and Apple deliver requested notifications. Mapbox provides maps and routes when you use those features. Providers receive information needed for their role. Some, particularly payment and app-store providers, also use it under their own privacy notices. We may share information where legally required, to protect rights and safety, or as part of a business transfer with appropriate protections. We do not sell your personal information.
12. International processing
Some providers process information outside the UK or your home country, including in the United States. We use the safeguards required by data protection law, such as recognised adequacy arrangements or approved contractual protections. You can contact us for details or a copy of the safeguards that apply to your information.
13. Retention and deletion
We keep your account and activity information while your account is open, unless you remove it or withdraw health-data consent. An account-deletion request has a seven-day grace period in which you can change your mind. After that, we process health and activity erasure even if billing cleanup is still unresolved. Limited account and billing records may remain until the payment provider cleanup is complete, alongside records kept for the purposes described below. You can contact us to request earlier erasure. Apple or Google subscriptions must be cancelled separately.
Protected backups follow a rolling 30-day recovery window. Copies needed to support that window may be older, so deleting information from your account does not immediately remove every backup copy.
14. Records we may keep longer
We normally keep accounting and tax records, including necessary payment records, for six years from the end of the last company financial year they relate to, or longer where the law requires. Payment providers may keep their own records under their legal duties. Security, dispute and limited consent records are kept only as long as needed for the specific purpose or legal obligation, with restricted access. We do not retain a whole health history indefinitely in case a claim might arise. Support messages are kept only as long as needed to resolve the request and related legal obligations.
15. Your rights and how to contact us
You can ask to access, correct or delete your information, limit how we use it, object to use based on our legitimate interests, or receive a portable copy, subject to applicable law. Settings lets you edit your profile, export account information, withdraw health-data consent and request account deletion. For other information or help with your rights, use our contact form. We may need to verify your identity. We normally respond within one month and will explain any lawful extension or limit to your request. You can also complain to the UK Information Commissioner or your local data protection authority.
16. Privacy complaints
If you are concerned about how we use your information, please use our contact form or the contact details above. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed of progress and explain the outcome. This acknowledgement period does not extend the separate deadlines for requests to exercise your data rights. You can also contact the UK Information Commissioner or your local data protection authority.
17. Changes to this notice
We will update this notice when our data practices change and draw significant changes to your attention. If a new purpose requires your consent, we will ask before using your information for that purpose.