Privacy Policy

1. Who we are

Runapt ("we", "us", or "our") operates the Runapt mobile application, the Runapt Garmin Connect IQ watch app, and the website at runapt.com. We are the data controller responsible for your personal information under applicable privacy law.

If you have questions or concerns about this policy or our practices with regard to your personal information, please contact us at legal@runapt.com.

2. What information we collect

Information you provide to us

• Account data: name, email address, and password (stored as a bcrypt hash). If you choose Sign in with Apple, we receive the identifier and email address (or private relay email) Apple provides. If you enable a passkey or two-factor authentication (2FA), we store the passkey's public key credential or your TOTP secret and backup codes to secure your account — we never see or store your biometric data itself, which stays on your device under Apple/Google's control.
• Runner profile: optional fitness details (age, weight, heart-rate zones, training background) and daily check-in wellness logs (subjective fatigue, soreness, and stress). These are cached on your device and synced to our servers when you save them, so we can generate training plans, coaching notes, and readiness metrics.
• Run data: GPS coordinates, distance, duration, pace, heart rate, and strength training workout completion records. This includes runs you record in the mobile app and runs recorded on a paired Garmin watch through the Runapt Connect IQ app (GPS route, distance, pace, heart rate, and timing), which the watch sends to your Runapt account on our servers.
• Plan data: race goals, training preferences, and workout completion records.

Information collected automatically

• Device data: device type, OS version, and app version for crash reporting.
• Location: GPS coordinates during active runs and for loop route generation from your start point. We do not track your location in the background except during an active workout. You can configure up to 5 custom Route Privacy Zones (e.g., Home or Work) in the app to clip/mask your GPS coordinates on shared runs, activity exports, or synced third-party platforms.
• Push token: an Expo push notification token to deliver run reminders (stored until you disable notifications or uninstall the app).
• Error and crash data: sent to Sentry to help us fix bugs. No personally identifiable data is included.
• App usage data: which screens of the app you open and for how long, and signs that something went wrong — errors shown to you, requests to our servers that failed or were slow, and repeated taps on the same spot. Screens are recorded by name (for example “plan builder”), never with your runs, routes or location. Before you have an account these events are tied to a random identifier created when the app is installed; when you sign up they are linked to your account. You can turn usage analytics off at any time in Settings → Privacy.
• Screen recordings on errors (off unless you turn them on): if you enable this in Settings → Privacy, a short recording of the app screen around an error is sent to Sentry. All text, images and graphics are blacked out on your device before anything is sent.
• “What stopped you?” survey: if you stop opening the app for 7 to 21 days, we may ask you once — by push notification, or by email if you have no notifications — why. Answering is optional; we store the reason you pick and anything you choose to write.

Information from third parties

• Apple HealthKit: if you grant permission, we read sleep, resting heart rate, and HRV data from HealthKit to support recovery tracking. From these we calculate a daily readiness score. If you use the AI coach chat, a short summary of these recovery figures (sleep hours, resting heart rate, HRV, and the readiness score) is included in the context we send to our AI provider under a zero-retention configuration — it is not stored, logged, or used to train models — so the coach's reply can account for how recovered you are — see Section 3. We never send your raw HealthKit records. Runapt can also write completed workouts and route data to HealthKit after a run so your Apple Health activity history stays complete. We will never use HealthKit data for advertising, marketing, or share it with third parties for any purpose other than providing the Runapt service to you.
• Strava and Garmin Connect: completed activity data (distance, pace, route, heart rate) if you connect your account, used only to import that activity into Runapt. These OAuth integrations are import-only — we never post or write data back to Strava or Garmin Connect on your behalf.
• Suunto: if you connect your Suunto account, we receive your completed running workouts from Suunto (distance, duration, pace, heart rate, and timing) and import them into Runapt. Unlike Strava and Garmin Connect, this integration also writes to Suunto: if you have Pro, we send your planned sessions for the next 14 days (session name, steps, and target pace or heart-rate zone) to your Suunto account as SuuntoPlus Guides so they appear on your watch. We send nothing else. Disconnecting in Settings → Connections removes the guides we created and revokes our access at Suunto.
• Garmin Connect IQ watch app: if you pair the Runapt app on your Garmin watch with your Runapt account, the watch loads your planned sessions from our servers and sends finished run data (GPS route, distance, pace, heart rate, and timing) back to your Runapt account. You can disconnect the watch or delete your data at any time in the Runapt mobile app under Settings → Connections → Garmin watch (and via account deletion / data tools).
• Spotify: if you enable in-run playback controls, we use Spotify's App Remote SDK to control playback on your device and, via a short-lived authorisation token, start/resume/pause your music during a run. We do not access your playlists, listening history, or account data beyond what is needed to control playback.
• RevenueCat: subscription status and purchase events for Pro plan management.

3. How we use your information

• To create and manage your account.
• To generate personalised training plans, adaptive coaching notes, and AI coach chat replies using third-party large language models accessed via OpenRouter (we may route requests to providers such as Google, OpenAI, Anthropic, or others depending on the model in use).
• To generate loop running routes based on your GPS location and workout distance.
• To adjust pace targets and workout guidance for current weather, using your run location's coordinates to fetch a forecast. No account or device identifier is sent with this request.
• To send run reminder push notifications (you can disable these in your device settings or in the app).
• To process subscription payments via RevenueCat and Apple/Google in-app purchase systems.
• To diagnose bugs and improve the product via aggregated, anonymised crash data.
• To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising.

For AI coach chat, we send only the training context needed to answer your question, such as active plan type, current week, recent aggregate progress, upcoming workout type, distance, and target pace. If you have connected Apple HealthKit or Android Health Connect, this context also includes a short recovery summary derived from that data — sleep hours, resting heart rate, HRV, and your daily readiness score — so the coach can factor in how recovered you are. We do not send raw health records, your name, email address, user ID, GPS route geometry, race location, or free-text run notes as coach context.

Your permission comes first. We ask for your explicit in-app consent before any of this data is sent to our AI provider. Until you turn on AI coaching, no training or recovery context leaves our servers for the AI provider. You can withdraw consent at any time in the app under Settings → AI coaching, which immediately stops any further sharing.

4. Lawful basis for processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

• Performance of a contract: processing your account data, run data, and plan data is necessary to provide the Runapt service you have signed up for.
• Consent: accessing HealthKit data, sending push notifications, and processing optional runner profile details. You may withdraw consent at any time via your device settings or by contacting us.
• Legitimate interests: collecting anonymised crash and error data to maintain service quality and security, and in-app usage data (described in Section 2) to find and fix what makes the app hard to use. You can object to usage analytics at any time by turning it off in Settings → Privacy. These interests do not override your privacy rights.
• Legal obligation: where we are required to process or retain data to comply with applicable law.

5. Data sharing

We share data only with the service providers necessary to operate Runapt:

• OpenRouter: AI routing platform for coaching notes, coach chat replies, weekly training digests, and related AI features. OpenRouter may forward your request (and the limited training context we include) to the underlying model provider we select (for example Google, OpenAI, or Anthropic). We send only the context needed for the feature — which for coach chat can include the recovery summary described in Section 3 (sleep, resting heart rate, HRV, and readiness score) if you have connected HealthKit or Health Connect; we do not send your name, email, raw health records, or full GPS route geometry. These requests are configured for zero data retention: the underlying provider is instructed not to store, log, or train on the data we send, and requests are routed only to providers that honor this policy. OpenRouter and the underlying model providers are contractually bound to protect your data to a standard at least equal to the protections described in this policy, and to process it only to generate your requested AI response. We obtain your explicit in-app consent before sending any personal data to these AI providers.
• Google: Google Maps for map display on Android. If a Google model is selected via OpenRouter, limited coaching context may also be processed by Google under OpenRouter's terms.
• RevenueCat: subscription management.
• Sentry: anonymised crash and error reports, and — only if you turn them on — masked screen recordings around errors.
• Expo: push notification delivery.
• Open-Meteo: run-location coordinates only, to fetch weather forecasts used to adjust pace guidance.
• Strava, Garmin Connect, Suunto, the Garmin Connect IQ watch app, and Spotify: only if you connect or pair these yourself, as described in Section 2.
• Google Analytics: aggregate, cookie-based visit statistics for the Runapt marketing website (runapt.com) only — never inside the mobile app — and only after you accept our cookie banner. See Section 7.

All providers are contractually required to process data only on our behalf and in accordance with our instructions.

6. International data transfers

Our service providers — including OpenRouter, Google, Sentry, Expo, and RevenueCat — are based in the United States (and underlying AI model providers may process data in additional regions depending on the model selected). When we transfer personal data from the EEA to these providers, we do so under Standard Contractual Clauses (SCCs) approved by the European Commission, or under another recognised transfer mechanism, to ensure your data receives an adequate level of protection.

By using Runapt, you acknowledge that your data may be transferred to and processed in countries outside your country of residence.

7. Cookies and similar technologies

The Runapt mobile app does not use cookies. The Runapt marketing website (runapt.com) uses the cookies and local storage listed below, and nothing else. We do not use advertising cookies, third-party tracking pixels, or cross-site analytics.

Google Analytics runs only after you accept the cookie banner shown on your first visit. If you decline, or before you make a choice, no analytics cookie is set and no data is sent to Google Analytics. You can withdraw or change your choice at any time via the "Cookie preferences" link in the site footer.

8. Data retention

We retain your account and run data for as long as your account is active. If you delete your account, all your personal data — including runs, plans, and profile information — is permanently deleted within 30 days. In-app usage events (screens, errors, repeated taps) are deleted after 180 days; events from an install that never created an account are deleted after 90 days. Anonymised, aggregated usage statistics may be retained indefinitely.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Request deletion of your personal data (you can do this directly in the app under Profile → Delete account).
• Delete GPS map data selectively from all your logged runs directly in-app, while retaining key statistics like distance, pace, time, and heart rate.
• Inspect and manage connected integrations and view their privacy scores in the Data Vault.
• Object to or restrict certain processing.
• Data portability — receive a copy of your data in JSON format.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
• Lodge a complaint with your national data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

California residents (CCPA)

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; and non-discrimination for exercising your privacy rights. We do not sell personal information. To exercise your rights, contact us at legal@runapt.com.

To exercise any of these rights, email legal@runapt.com. We will respond within 30 days.

10. Children

Runapt is not intended for children under 13 (or under 16 in jurisdictions where a higher age threshold applies under local law, including certain EU member states). We do not knowingly collect personal information from children below the applicable age. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

11. Security

We use industry-standard security measures including bcrypt password hashing, HTTPS-only communication, and JWT authentication. No method of transmission over the internet is 100% secure — we cannot guarantee absolute security but we take every reasonable precaution to protect your data.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If changes are material, we will notify you via email or an in-app notice at least 14 days before the changes take effect. Continued use of Runapt after the effective date constitutes acceptance of the updated policy.

13. Company information & Contact

Runapt is a service provided by Voscey. For privacy-related questions, requests, or complaints, contact us using the details below:

• Company Name: Voscey
• Registered Address: Herenweg 146, 3648CN Wilnis, The Netherlands
• Chamber of Commerce (KVK): 99994070
• VAT ID (BTW): NL005423874B69
• Email: legal@runapt.com