🏃 Running Coach — Privacy Policy

When you start a live run, the app records your precise GPS location to draw your route and compute distance, pace, and elevation. In the Android app this includes collecting location in the background — while the app is closed or the screen is off — so your run keeps recording.

• Location is collected only while a run is actively recording. Stop the run and collection stops. The app never tracks you in the background at any other time.
• A persistent notification is shown the entire time a run is recording, so it is always clear when location is being collected.
• Your route is saved to your own account and is shown only to you.

You can optionally share a run as it happens. This is off by default. You turn it on on the device you are recording with, before you press Start. That device remembers the choice for your next runs — it is shown to you on the start screen every time, and stays visible on screen the whole time a run is being shared, so you can always see and change it. The choice is never carried over to your other devices.

• While it is on, your position and the route so far are sent to our server during the run, so that your own other signed-in devices can follow along.
• Your account has one standing share link, which you send to the people you choose. Anyone holding it can watch a run of yours while it is recording with the switch on, and nothing else: no history, no position at rest, and no name, email or account identifier — the page shows a run, not a person. Between runs, and with the switch off, the link shows the same "nothing live" as a link that was never issued.
• Replace link (in the pre-run panel, and in Settings → Account) is how you cut people off. It takes effect immediately and permanently: the old link stops working for everyone holding it, and is never reissued to anyone.
• The shared copy is deleted as soon as you save or discard the run. If the app is closed by your phone mid-run, it is deleted the next time you open the app on that device, and your other devices stop showing it after six hours. What remains afterwards is the ordinary saved run and route, visible only to you.
• With sharing off, your position is never sent anywhere during a run. The route is uploaded only when you save it.
• We count visits to the share page, to know whether a shared link gets opened. The count is anonymous: nothing is stored on the visitor's device (no cookies, no local storage), no account or identifier is attached, and visitors are only told apart within the same day, through a one-way code (built from their IP address and browser) that changes every day, so no one can be followed from one day to the next. We record the page, where the visit came from (for example LinkedIn), browser, device type and approximate country. A visitor who has declined analytics in this browser is not counted.
• This is not a safety or emergency feature. Updates depend on your phone having signal and can stop without warning, so never rely on it to get help.

On the Android app you can optionally capture your heart rate during a run, so you don't have to type it in. This is off by default; you turn it on in Settings → Profile → Heart-rate sensor.

• Bluetooth sensor. If you pair a Bluetooth heart-rate sensor (a chest strap, an armband, or a watch that broadcasts heart rate), the app reads your heart rate from it only while a run is recording. Bluetooth is used solely to find and read your sensor — never to determine your location.
• Health Connect. If you choose Health Connect, the app reads your heart rate from Android's Health Connect only for the time period of a run you recorded, after you finish it. It requests read access to heart rate — and nothing else.
• Heart-rate readings are saved on your run, in your own account, exactly like a value you type in. They are not shared with any third party, not used for advertising, and not sold. We do not transfer Health Connect data anywhere beyond storing it in your account.
• You can turn either source off at any time in Settings, and revoke access in your Android Bluetooth or Health Connect settings. Deleting a run — or your account — deletes its heart-rate data too.

We keep your data only for as long as you keep your account. Nothing is kept "just in case" once you have deleted it.

• Your account data — your email address, name, runs, GPS routes, heart-rate readings, training plan, race settings, Coach memory and coach logs. Kept for as long as your account exists, then deleted. There is no automatic expiry and no inactivity cut-off: it stays until you delete it, one item at a time or all at once.
• Anything you delete. Kept no longer than the moment you delete it. Deleting a run deletes its route and heart-rate data with it; deleting your account deletes the account and everything attached to it in the same operation. Neither is a "soft delete", and the only copy that outlives it is the time-limited backup below.
• Live run broadcasts. Kept for at most 6 hours, then deleted. The shared copy goes as soon as you save or discard the run, and in any case stops being served to anyone — your own devices and any link holder alike — 6 hours after the last update it received.
• Share links. Your current link is kept until you replace it. A replaced link is kept indefinitely as a permanently revoked entry: that record is precisely what stops the old link from ever working again. It contains no personal data, and it is detached from your account when you delete the account.
• Encrypted database backups. Kept for at most 30 days, then deleted automatically (the 7 most recent are always retained). Data you delete can therefore remain in a backup for up to that window before it ages out. Backups are used only to restore the service after a failure.
• Feedback and diagnostic reports you choose to send (the feedback button, a coach "This isn't right" report, or a diagnostic report you send from the developer log). Kept for at most 24 months, then deleted — and sooner if you delete your account, which deletes them with it.
• Optional analytics and crash diagnostics, off unless you switch them on. Kept for at most 12 months, then deleted. Switching them off stops collection straight away. The anonymous visit counts of the share page are kept for the same 12 months.
• The copy on your own phone, which is what lets the app work offline. Kept for at most 7 days, then replaced or dropped; a change you make offline is held until it reaches the server. All of it is erased when you sign out, and when you uninstall the app.