Privacy policy

Who is responsible

The app is run by Cayetano Biehler, an individual based in Spain, who is the data controller. For any privacy question or request, write to cayetano.biehler@gmail.com.

What we collect

• Account: your name, email address and a hashed password (the password itself is never stored).
• Training setup: race goals, target times, available run days, plans and any changes you make to them, and preferences such as units, time zone and appearance.
• Runs and health data: for each run, the date, distance, duration, heart rate (average, maximum and samples over time), GPS route with elevation, your effort rating (RPE) and notes. This is health-related data, and it is only processed because you choose to send it to the app.
• Imports: the raw data received from connected sources (see below), kept so an import can be re-processed if something went wrong.
• Usage events: a small set of in-app events (for example “run logged” or “plan created”) linked to your account, used only to understand which features are used. No third-party analytics or advertising trackers are used.
• Technical data: session cookies to keep you signed in, IP address for rate limiting and security, and a few preferences stored in your browser (for example whether you dismissed a tip).

Where the data comes from

• What you type into the app.
• Apple Health via Health Auto Export: if you set up an import token, that app sends your workouts to us.
• Garmin Connect: if you connect your Garmin account, Garmin sends us your activities (summaries, heart rate and GPS samples) after you authorise it on Garmin’s site. We only keep running activities; other activity types are discarded. We do not receive your Garmin password, and we do not send any data back to Garmin.

Connecting a source is optional, and you can disconnect it at any time from Settings.

Why we use it

• To provide the service you signed up for: build and adapt your plan, show your runs, statistics, records and race predictions (GDPR art. 6(1)(b), performance of a contract).
• Health data (heart rate, routes, effort) is processed on the basis of your explicit consent, given when you connect a source or enter it yourself (GDPR art. 9(2)(a)). You can withdraw it by disconnecting the source and deleting the data or your account.
• To keep the service secure and working, and to improve it through the usage events above (legitimate interest, art. 6(1)(f)).
• To send emails you need, such as password resets.

We do not sell your data, use it for advertising, or use it to train AI models. Nothing is made public unless you choose to share it (for example a plan share link or an image you export).

No AI system processes your data. Plans, adjustments, statistics and predictions are calculated by fixed rules in our own code, and your data (including anything received from Garmin) is never sent to an AI service. If that ever changes, we will update this policy and ask for your explicit consent first, which you could withdraw at any time.

Who processes it for us

• Vercel hosts the app (servers in Paris, France).
• Oracle Cloud hosts the database (servers in Madrid, Spain) that stores your account and training data, including runs imported from Garmin.
• Resend delivers account emails (it receives your email address and the message).
• OpenStreetMap serves the map tiles behind route maps; your browser requests them directly, so OpenStreetMap sees your IP address but not your run data.
• Garmin and Health Auto Export send data to us only if you connect them; their own privacy policies apply to what they hold.

Your data is stored in the European Union. Where a provider may access it from outside the EU, it does so under the European Commission’s standard contractual clauses or an equivalent safeguard.

How long we keep it

Your data is kept while your account exists. Deleting your account (Settings → Profile → Delete account) permanently removes your account and everything linked to it: goals, plans, runs, routes, imports, usage events and connections. If you disconnect Garmin without deleting your account, we stop receiving data and delete the access tokens; runs already imported stay until you delete them or your account. Database backups that may still contain deleted data are overwritten within a limited period.

Security

All traffic uses HTTPS. Passwords are hashed, import tokens are stored only as hashes, and access tokens for connected services are encrypted at rest. Each user can only see their own data.

Your rights

You can ask to access, correct, export or delete your data, to restrict or object to its processing, and withdraw consent at any time. Most of this you can do yourself in the app; for anything else, email cayetano.biehler@gmail.com and you will get an answer within one month. You also have the right to complain to the Spanish data protection authority (AEPD) or the authority in your country.

Children

The app is not meant for children under 14, and we do not knowingly collect their data.

Changes

If this policy changes in a way that matters, the date at the top will change and signed-in users will be told in the app.