Privacy policy

1. Controller

Juri Hoyer
Reichertshalde 13
71642 Ludwigsburg
Germany
E-mail for privacy requests: datenschutz@backyardcontrol.com
General contact: kontakt@backyardcontrol.com

These addresses are mailboxes at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Whatever you send us by e-mail — including access and deletion requests — is held in this mailbox; IONOS processes it on our behalf (Art. 28 GDPR).

For now, the app still sends its e-mails (codes, invitations, see 3 o) via a mailbox at Google (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Replies to these e-mails and messages to our former contact address backyard.ultra.app@gmail.com are held in this Google mailbox; Google processes them as the e-mail provider under its own privacy policy and may also transfer data to the USA in the process (EU-US Data Privacy Framework).

2. The key points in brief

• No advertising, no third-party analytics or tracking tools, no sale and no disclosure of data for advertising purposes. Our own server only counts anonymous daily totals (see 3 a). Error reports from the app and your feedback go only to our own server (see 3 m).
• The only cookie is the login cookie. It is technically necessary.
• Location data is only collected while you yourself are running a runner recording.
• The camera is only used to scan barcodes; the image does not leave your device.
• You can download your data in the settings at any time (JSON) and delete your account there yourself (see section 7).

3. Which data we process

a) Accessing the website and the app (server logs)

Each time the app is accessed, the server processes technically necessary information: IP address, date and time, requested address, amount of data transferred, status code and browser or device identifier (user agent). Purpose: delivering the app, operational security, preventing misuse (e.g. limiting login attempts). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). The web server logs are deleted after 14 days; the application server logs are stored on a rotating basis and automatically overwritten.

Our own anonymous counting: To see whether the app is working and being used, our own server — without third-party tools — counts anonymous daily totals: how often the app was opened (in the browser or in the Android app, with or without login, with which app version), how often the login and registration pages were shown and the registration form was submitted, how many registrations and logins succeeded per day (separated by method: password, Google, login link), how many Backyards were created, joined, started and finished per day, how many accounts and Backyards exist, how many accounts were active in a given period, how many accounts registered per day and per week and how many of them were still active later (as a total per registration week), as well as the number of requests, the number of errors and response times per server function. Only these totals are stored: no profile per person, no device identifier, no cookies and nothing additional on your device. IP addresses are not stored for this; the server only uses them transiently to limit misuse of the counting. The totals are stored without names and without any link to an account or device and therefore remain even if an account is deleted. With very few users, a total may in rare cases be traceable to one person – for example if only a single account registered on a given day. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working service geared to actual demand).

b) Account

Username, display name (optional), password (stored only as a non-reversible hash), time and version of your consent to the terms of use, privacy settings and — optionally — a profile picture. The profile picture is reduced on the server to 512 × 512 pixels; metadata of the image file (e.g. location where it was taken, camera data) is removed in the process. Purpose: providing the account. Legal basis: Art. 6(1)(b) GDPR (contract of use).

c) Login and sessions

After you log in, your device receives a random session token (in the browser as a cookie, in the Android app in the app storage). On the server we only store a hash of the token, the time of login and of last use, the IP address at login and the browser or device identifier — so that sessions are secure and can be ended after a password change. A session ends 30 days after its last use, when you log out or when the account is deleted. Legal basis: Art. 6(1)(b) and (f) GDPR.

d) Backyards, loops and nutrition

What you or your team create in a Backyard: name, location (place name and coordinates, if provided), start and end time, loops and loop times, an uploaded course (GPX), to-dos and who ticked them off, nutrition entries with nutritional values (carbohydrates, sodium, fluid, caffeine), your personal hourly targets for them, supplies and portions, packing and food lists, plans and templates, personal notes (“Takeaways”), memberships with role (runner or crew) and invitations. Purpose: planning and supporting the race. Legal basis: Art. 6(1)(b) GDPR. The app does not collect health data such as heart rate.

Photos of the venue

Members of a Backyard and whoever created it can add up to 20 photos of the venue (e.g. camp, course, start). The image, who uploaded it and when are stored. The app already reduces the image on your device; the server saves it anew and removes all metadata in the process, including camera details and the location where it was taken (GPS). The photos can be seen by whoever is allowed to see the Backyard: those involved and, depending on the visibility the runner has chosen for the Backyard, his or her followers or all logged-in users. The image file itself is located at a random, unguessable address so that the app can display it; a list of the photos is only available when logged in. A photo can be deleted by whoever uploaded it and by whoever created the Backyard. Purpose: showing what the venue looks like. Legal basis: Art. 6(1)(b) GDPR. Only upload photos to which you hold the rights, and only show other people with their consent. Organisers can add a description and up to 12 photos of the venue to their event; these are visible to anyone with the event’s race code and to its participants.

e) Location during the runner recording

Only if you start a recording in runner mode and grant the location permission does your device continuously record your exact position (latitude and longitude, accuracy, altitude) with a time stamp as well as the device’s battery level, and the app calculates loop progress, pace and forecasts from this. This data is transmitted to the server and is visible to the other members of this Backyard (crew) — also live, and during the race the crew can request a current position. In the Android app, the recording continues even when the screen is switched off; a persistent notification indicates this. Other people (feed, profile) are shown at most the shape of the course, and only according to your visibility setting; with “Hide map” not even that. You can revoke the location permission at any time in your device’s settings. If you pair a phone as a runner device, we store its device name and the times of login, confirmation and last use. Legal basis: Art. 6(1)(b) GDPR.

Smartwatch: If you run with a watch running the Backyard Control watch app, the watch records position and loop times instead of the phone. A Wear OS watch passes them over the direct connection between watch and phone (Google Play services) to the Android app on your paired phone, which transmits them to our server as described above. A Garmin watch sends them via the Garmin Connect app on your phone directly to our server; for this, you enter the race code of your Backyard on the watch, and the watch receives a device token from us that is valid only for this race. For this we store the name of the watch or watch app and the times of pairing and last use. The heart rate measured by the watch is not accepted or stored by our server. Legal basis: Art. 6(1)(b) GDPR.

f) GPX import and GPX download

If you upload a GPX file of a past Backyard, the server analyses it. Only the values derived from it are stored: start and end, loop times, the camp location and the shape of the course. The file itself is not stored. Conversely, as a runner you can download your own recorded course of a Backyard as a GPX file (e.g. for uploading to Strava or Garmin). For this purpose, the file is generated from the stored positions and delivered only to you — in the Android app via a short-lived, single-use link that your browser opens; no file is kept on the server. Crew and other users cannot download your course as a file. What you do with the file afterwards is up to you. Legal basis: Art. 6(1)(b) GDPR.

g) Profile, following and notifications

Your username, display name and profile picture are visible to all logged-in users (via the profile link also without an account, see below); you can be found via the search. Your follower and following lists can be seen by all logged-in users if your profile is public; if you set your profile to “private”, only you and your confirmed followers see them, and anyone who wants to follow you needs your approval. Your Backyards appear on your profile and in the feed only according to your setting per Backyard (team only, followers or public: all logged-in users and, via the profile link, also visitors without an account). You decide in the settings under “Privacy” who sees you in a Backyard’s “Who was there” list. If someone follows you, sends you a request or invites you to a Backyard, you receive a notification in the app (in the Android app additionally as a push notification, see 3 k). Legal basis: Art. 6(1)(b) GDPR.

Profile link (accessible also without an account): Every profile has its own address (app.backyardcontrol.com/app/#u=username), which you can pass on via “Share profile”. Anyone who opens this address sees, even without an account and without logging in: your profile picture, your display name, your username, the number of your followers and of the profiles you follow, and the Backyards you have set to “public” (name, date, location, loops, distance, your role) together with the figures derived from them. Not accessible this way are: your e-mail address, the follower and following lists, locations and courses, nutrition, and Backyards that are shared only with the team or with followers or are in the trash. How to prevent it: set a Backyard to “followers” or “private”, then it does not appear there; under “Privacy” you specify how new Backyards are created (default: private). A private profile shows via the link only picture, names, username and figures — and still the Backyards you yourself have made public. You can remove the profile picture at any time. The page is blocked for search engines (noindex). Legal basis: Art. 6(1)(b) GDPR.

h) Weather and place search

For weather data at the race location and for the place search, our server queries the Open-Meteo service (open-meteo.com). Only coordinates rounded to about one kilometre (two decimal places) or the place name entered are transmitted. The coordinates are those of the race location (camp or course start) — during an ongoing recording also the runner’s last position, so that the weather is correct where the running takes place. The request comes from our server, not from your device, and contains neither your IP address nor your name or your account.

i) Login with Google (optional)

Instead of username and password, you can log in with your Google account or link it to your account in the settings. If you tap “Continue with Google”, Google’s login page (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) opens in your browser; you log in to Google there. Google then only transmits to us: your Google account ID, your e-mail address together with the information whether it is verified, and your name. Of this, we store the Google account ID, the e-mail address and the time of linking — exclusively in order to assign you to your account the next time you log in and to show you in the settings which Google account is linked. Nobody else sees the e-mail address, we do not send e-mails to it and we do not link accounts via it. We only offer you the name as a suggestion for your display name; we do not take over your Google profile picture. The app does not request access to any other Google data (contacts, calendar, files or similar). Google thereby learns that you are logging in to Backyard Control; Google’s privacy policy applies to this. Legal basis: Art. 6(1)(b) GDPR. You can remove the link in the settings at any time (your account needs a password for this); when the link is removed and when the account is deleted, the Google account ID and e-mail address are deleted.

j) Barcode scanner and nutritional values (Open Food Facts)

To record food, you can scan the barcode of a package with the camera or type in the number. The camera image is analysed only on your device and is neither stored nor transmitted. Only the barcode number goes to our server; our server uses it to query the name and nutritional values of the product from Open Food Facts (openfoodfacts.org, a free food database of a non-profit association in France). The request comes from our server and contains no information about you. Our server keeps the response for a barcode number for up to 24 hours, without any link to your account. Only what you yourself adopt is stored for you (see 3 d). Legal basis: Art. 6(1)(b) GDPR.

k) Push notifications (Android app only)

The Android app can show you notifications (e.g. “@name is now following you”, follow requests, invitations to a Backyard) as push notifications. For this it uses Firebase Cloud Messaging from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your device receives a device address (registration token) from Google; we store it together with your account, the associated login, the platform (“android”) and time stamps. When sending, we transmit this token and the text of the notification (username of the person who triggered it, where applicable the name of the Backyard) to Google, which delivers the message to your device. Location data is not included. The token is deleted when you log out, when the session ends, when the account is deleted or when Google reports it as invalid; you can switch off notifications in the settings of the app or of your device. Legal basis: Art. 6(1)(b) GDPR. For the settings under “Notifications”, we store for your account which types you have switched off, your quiet hours and your device’s time zone (e.g. “Europe/Berlin”), so that the quiet hours match your local time; they are deleted together with the account.

l) Contact form

If you write to us via the contact form in the legal notice (possible without an account), we store your name and your e-mail address (both optional), your message and the time of receipt — solely in order to answer your enquiry. We do not store an IP address for this; to protect against misuse, the server counts submissions per IP address only briefly in its working memory. We are informed of receipt by push notification; its text contains no information from your message. The message is deleted once dealt with, at the latest after 6 months. Legal basis: Art. 6(1)(b) GDPR insofar as it concerns a contract or your account, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

m) Error reports and feedback

If the app crashes or a program error occurs, it sends an error report to our own server, without third-party services: error text and technical error location, the page of the app (without invitation and event codes), platform (web or Android), app version and device model or browser, and, if you are logged in, your account. No location data, no content of your Backyards; we do not store an IP address for this. Identical errors are grouped and deleted 90 days after they last occurred. If you send us a message via “Send feedback”, we store your text, an image you attached (the server removes metadata such as the location where it was taken), the same technical details and, if you are logged in, your account. We are informed of receipt by a push notification without content. Feedback is deleted once dealt with, at the latest after 12 months. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in an error-free app and in your feedback).

n) Reports and blocking

If you report a profile, a photo or a post in the feed, we store your account as the reporting person, the account whose content you are reporting, what was reported (type and identifier of the profile, photo or post), the reason, your optional text (at most 500 characters), the time and the processing status (open, resolved or dismissed, with our note). If you block someone, we store who blocked whom and since when. Purpose: protection against misuse, harassment and impermissible content — the app stores require these functions for content that users post themselves. Only we as the operator see reports; the reported person does not learn who reported them, and a blocked person does not learn that you have blocked them. A block is deleted when you lift it or when one of the two persons deletes their account. Reports are automatically deleted 12 months after they are closed (resolved or dismissed); open reports remain stored until processed. If you delete your account before then, the link to you is removed from your reports, while the report itself remains stored with us until that deadline. Reports about you likewise remain stored until then after your account has been deleted and then refer to “Deleted account” or, if your account is removed completely, to no one at all. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a safe app) and Art. 6(1)(b) GDPR (terms of use).

o) E-mail address and confirmation codes

When registering, you provide an e-mail address; we store it with your account. Purpose: login (instead of the username, you can also log in with the e-mail address), resetting the password (“Forgot password”) and confirmation when you change the address in the settings. For this, we send you a 6-digit code by e-mail — when resetting, to the address on file; when changing the address, to the new address. For now, the e-mails are still sent via a Google mailbox (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google thereby receives your e-mail address and the content of the e-mail (code and a short note) and processes them as the e-mail provider under its own privacy policy. We store the codes only as a non-reversible hash; they are valid for 15 minutes and are invalidated after use. We do not send advertising or newsletters. Nobody else sees the e-mail address. It is deleted together with the account and is included in the data export. Legal basis: Art. 6(1)(b) GDPR.

If an organizer (or their helper) invites runners via “Invite by email”, we send one e-mail through the same route (Google) to each address entered, containing the event’s name, date, place and description, a link and the code; replies go to the organizer’s e-mail address, which the recipient sees in the process. We do not store the recipients’ addresses, only the number and time of the sending (for the limit of 500 e-mails per day); the legal basis is Art. 6(1)(f) GDPR (the organizer’s legitimate interest in inviting their runners), and the organizer is responsible for choosing the addresses.

An organizer’s participant list: An organizer can upload the participant list of their event (e.g. from their registration system). The file is read in the app; we store for each person only the name (and first name, if given), bib number and e-mail address, where available, plus a personal code that can be redeemed only once, whether and when an invitation was sent and whether the code was redeemed. By uploading, the organizer confirms that they are allowed to use the addresses for this invitation. Purpose: to give each runner their own code, to invite them by e-mail at the organizer’s request (sent as above via Google, replies go to the organizer; at most 2,500 e-mails per organizer and day) and, once the code is redeemed, to list them with name and bib number in the start list, live ranking and results list. When a runner redeems their code, their account is linked to this entry; if they sign up with the general event code and their confirmed account address is on the list, they are likewise assigned to this entry. The list is visible only to the organizer and — name and bib number, as with the start list — their helpers. We automatically delete the e-mail addresses 30 days after the end of the event (immediately if the event is deleted); name, bib number and result remain with the event. The legal basis is Art. 6(1)(f) GDPR (the organizer’s legitimate interest in inviting their registered runners and running the race); the organizer is responsible for the lawfulness of passing on the list.

p) Purchase in the Android app (Google Play)

The Android app can offer the creation of your own Backyard as a purchase through Google Play. As long as this purchase is not enabled, none of the following processing takes place. If you buy, the payment runs entirely through Google Play (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; payment processing by Google Payment Ireland Limited) as an independent controller under the Google Play Terms of Service and the Google Privacy Policy; we do not see your payment method or billing address. Google hands the app a purchase receipt (purchase token); our server verifies it with Google, acknowledges the purchase and stores with your account: product, purchase token, Google order number, state (purchased, pending, cancelled or refunded — our server takes the state from Google), time stamps and, once redeemed, the Backyard created with it. So that Google can assign the purchase to your account, the app passes Google only a non-reversible checksum of your account identifier, no name and no e-mail address. The purchase records remain stored as a receipt for as long as your account exists; when the account is deleted, the link to you is removed and the record remains without an account assignment. Legal basis: Art. 6(1)(b) GDPR (purchase contract).

q) Waitlist on backyardcontrol.com

If you join the waitlist on the website, we store your e-mail address, the role you picked (runner, crew or organiser), which page you joined from, your device type (Android, iPhone or other) and the date and time you joined. We derive the device type from the technical information your browser sends anyway when you join (the user agent), so we can invite Android users first: the Android app is ready sooner. Only the result is stored, not the browser information itself. We use your e-mail address only to send you the invitation to the app and information about the launch. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by e-mail to the address in section 1; we then delete your entry. The withdrawal applies to the future. The data is held on our server at Hetzner (see 4); we do not sell it and do not pass it on. We delete your entry on request, at the latest 6 months after the launch of the app.

4. Recipients and services used

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Server and database are located in a data centre in Nuremberg. Hetzner processes the data on our behalf (Art. 28 GDPR).
• E-mail mailboxes: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, operates our mailboxes at backyardcontrol.com (e.g. kontakt@ and datenschutz@). IONOS processes e-mails you send to these addresses, and our replies, on our behalf (Art. 28 GDPR).
• Network and protection against attacks: Requests to the address backyard.neutoma.com (the app’s former address, which older versions of the Android app still use) pass through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. In doing so, Cloudflare processes in particular your IP address and the request data in order to deliver the site and protect it against attacks. Cloudflare processes this data on our behalf (Art. 28 GDPR) on the basis of the Cloudflare Data Processing Addendum. Legal basis: Art. 6(1)(f) GDPR. For the transfer to the USA, we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which Cloudflare is certified; in addition, the EU Standard Contractual Clauses that form part of this addendum apply. The addresses backyardcontrol.com and app.backyardcontrol.com do not pass through Cloudflare.
• Map tiles: When a map is displayed, your device loads the map images from tile.openstreetmap.org, operated by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address, the device identifier and the displayed map section are transmitted in the process. An adequacy decision of the European Commission exists for the United Kingdom. According to its privacy policy, the OpenStreetMap Foundation uses service providers (content delivery network) to deliver the tiles; details are given in the privacy policy of the OpenStreetMap Foundation (osmfoundation.org). Legal basis: Art. 6(1)(f) GDPR.
• Login with Google (only if you use it): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, see 3 i. Google may also transfer data to the USA; Google is certified under the EU-US Data Privacy Framework.
• Push notifications (Android app only): Firebase Cloud Messaging from Google Ireland Limited, see 3 k. Google processes this data on our behalf (Art. 28 GDPR) on the basis of the Firebase Data Processing and Security Terms. Here, too, Google may transfer data to the USA (EU-US Data Privacy Framework, in addition the EU Standard Contractual Clauses).
• Sending e-mails (codes for resetting the password and for changing the address, organizers’ invitations): for now, a Google mailbox (Gmail), Google Ireland Limited, see 3 o — Google operates it as the e-mail provider under its own privacy policy. Here, too, Google may transfer data to the USA (EU-US Data Privacy Framework).
• Purchase in the Android app (only if you buy): Google Play, Google Ireland Limited; payment processing by Google Payment Ireland Limited — as independent controllers, see 3 p.
• Weather and place search: Open-Meteo, see 3 h — only rounded coordinates or place names, no information about you.
• Nutritional values for barcodes: Open Food Facts, see 3 j — only the barcode number, no information about you.
• List of real Backyards: For the “Pick from list” option, our server regularly retrieves the public race list from bigsbackyardultra.com. The request comes from our server and contains no information about you. Your device only accesses this site if you yourself tap the source link.
• Other users: see your data only to the extent described above and according to your settings.

Beyond this, we do not pass on any data. The app, including its map library (Leaflet), comes exclusively from our server; apart from the map tiles mentioned above, your device loads nothing from third-party servers — except Google’s login page, if you yourself tap “Continue with Google”, and, in the Android app, the connection to Google’s push service (see 3 k). Analytics, crash reporting or advertising services (including from Firebase) are not built in. Fonts are not loaded from third parties (the app uses your device’s system font). The website backyardcontrol.com, too, loads its fonts and scripts only from our own server.

5. Storage on your device

The app only stores on your device what it needs in order to work: the login cookie or, in the Android app, the session token, the most recently selected Backyard, the selected colour scheme, whether push notifications are on, a cached copy of the display for starting without a network, the buffer of the runner recording (so that nothing is lost in dead spots), during a login with Google for a few minutes a random value that binds the login to your device, and — via a service worker — the app’s program files for offline use. This is strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). There are no tracking or advertising cookies. The website backyardcontrol.com stores nothing on your device.

6. Permissions of the Android app

• Location (also in the background): only for the runner recording, see 3 e.
• Notifications: show that a recording is running and display push notifications (see 3 k).
• Camera (optional, only requested on the first scan): only for reading barcodes, see 3 j. Without the camera, you can type in the number.
• Alarms (exact alarms) for the minute reminders before the loop start, as well as speech output and vibration, run only on your device; nothing is transmitted in the process.
• You choose a profile picture and photos of the venue (see 3 d) via your device’s file picker; there you can also take a photo directly with the camera. The app does not read any photos or files on its own and only receives the images you select.

7. Storage period and deletion

We store your data for as long as your account exists. You can delete individual content (lists, notes, profile picture) yourself at any time. If you remove a Backyard from your profile, it stays in the trash for 30 days and can be restored; after that, your membership is permanently deleted. The data of the Backyard itself (loops, positions, entries) is deleted as soon as all those involved have removed it and their 30 days have expired.

Photos of the venue remain stored until they are deleted: by you (your own photos) or by the person who created the Backyard. They are also deleted when the Backyard itself is deleted (see above), and your own photos in all Backyards are deleted when you delete your account.

Organizers’ participant lists: We automatically delete the e-mail addresses in them 30 days after the end of the event (see 3 o); the entries themselves go with the event or when the organizer removes them.

Deleting your account: Open the app (Android app or in the browser at app.backyardcontrol.com/app/), log in and choose Settings → “Delete account”; to confirm, you enter your password (for an account with Google login only, your username). If you can no longer access your account, an e-mail with your username to the address given in section 1 is sufficient; we will then delete the account after verifying that the request comes from you. On deletion, profile, profile picture, e-mail address together with any open codes, password, Google link, sessions, push tokens, paired devices, follows, notifications, notes, lists, targets, templates and plans as well as all Backyards in which nobody but you is a member are deleted immediately. If you were part of other people’s Backyards (as runner or crew), these Backyards remain for the others — together with the loops, positions and entries belonging to them. There you will then only appear as “Deleted account”, without name, picture or profile.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can obtain a copy of your data (including your e-mail address) yourself at any time under Settings → “Your data” as a JSON file; for everything else, an e-mail to the address given above is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Miscellaneous

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Providing a username, an e-mail address and a password — or instead logging in with Google — is required for an account; all other information is optional.