Privacy Policy

RunPT is operated by Burre Nacho AB (org. no. 559499-3643), Lundagatan 46, 117 27 Stockholm, Sweden ("we," "us," or "our"). We are the data controller for personal data processed through the RunPT mobile application, the RunPT Apple Watch app, and the RunPT website (collectively, the "Service").

For privacy-related inquiries, contact us at support@runpt.app.

Short version: RunPT imports your training and recovery data, associates it with your account, and uses it, including through AI processing, to coach you. We do not sell your data and we do not share it with advertisers. Sections 4 and 10 explain how AI processing works and how to withdraw.

Account Information

When you sign up using Sign in with Apple or Google Sign-In, we collect your name and email address. You may also provide your age, date of birth, sex, city, and country in your profile. If you use Sign in with Apple and choose to hide your email, we receive an Apple relay address instead of your real email.

App Store Waitlist

Before RunPT is available on the App Store, you can join a waitlist on our website by signing in with Apple or Google. We store your email address, name, sign-in provider, where on the website you joined, when you joined, and whether you have completed the onboarding questions. We use this only to email you when RunPT becomes available to download. You can ask us to remove you from the waitlist at any time by contacting us.

Running Profile & Health Information You Enter

To personalize your coaching, we collect the answers you give during onboarding, on the website or in the app, and in settings: your experience level, weekly mileage, training days and long-run day, race goals and target times, coaching tone, strength and cross-training preferences, body weight and height, maximum heart rate and heart rate zones, threshold pace, and best effort times. You may also tell RunPT about injuries, illness, or other reasons you are pausing or reducing training, and you may add effort ratings and notes to workouts. Health information you enter, such as weight, heart rate values, injuries, or illness, is health data and is handled as described in Sections 4 and 6.

If you start on the website, your answers stay in your browser tab and are not sent to us until you create an account. They are then saved to your account so the app can continue where you left off. If you close the tab before creating an account, they are discarded.

Apple HealthKit Data

With your explicit permission, we read the following data from Apple HealthKit:

• Workouts (type, duration, distance, calories)
• Heart rate, resting heart rate, walking heart rate average
• Heart rate variability (HRV)
• VO2 Max
• Running power and cadence
• Sleep analysis
• Step count, distance walked/run, exercise time, stand time
• Body measurements (weight, height, body fat percentage, lean body mass)
• Biological sex and date of birth
• Workout routes (GPS location data)

Background health sync may occur periodically to keep your coaching data current. If you use the RunPT Apple Watch app and grant the requested permissions, RunPT also writes the workouts you record to HealthKit, including workout metrics, optional GPS routes, and effort ratings. Workout recording continues locally on your Watch when your iPhone or network is unavailable, and the completed workout syncs back to RunPT when connectivity returns.

Connected Fitness Platforms (Garmin, COROS, Polar, Suunto, Fitbit)

If you connect a supported watch platform, you authorise that platform to share data with RunPT. Garmin Connect shares data directly with RunPT through Garmin's APIs. Data from COROS, Polar, Suunto, and existing Fitbit connections is delivered through Terra, an integration service that acts on our behalf. The data is stored in your RunPT account. Data is associated with you as an identifiable user; it is not anonymised. What we receive depends on the platform, your device, and the permissions you grant on the platform's authorisation screen. For Garmin Connect, we request the Health, Activity, and Training permissions. We do not request Garmin's Women's Health or Courses data. For all connected platforms we may receive:

• Completed activities: activity type and title, start time, duration, distance, elevation gain, calories, average and maximum heart rate, time in heart rate zones, cadence, running power, laps, intervals and splits, the name of the recording device, and, where your device records it, the GPS route and per-second samples (position, heart rate, pace, elevation).
• Daily summaries: steps, active time, calories, resting heart rate, heart rate variability (HRV), and, where the platform provides them, stress and body-battery or readiness scores.
• Sleep: sleep duration and stages, sleep efficiency, and overnight HRV and resting heart rate.
• Heart and profile metrics: resting heart rate, HRV, and your maximum heart rate (used to derive heart rate zones). We do not store body weight or other body measurements from connected platforms.
• Connection details: your platform user identifier, the platform name, and connection status, so we can keep syncing and stop syncing when you disconnect. For direct Garmin connections, we also store authorisation tokens and the permissions you grant. For platforms connected through Terra, we store the corresponding Terra connection identifier.

How we process Garmin data. Garmin delivers authorised data directly to endpoints controlled by RunPT. We use it to import your training history, display activities and health metrics, calculate training and recovery insights, and personalise your coaching and plans. We store this data and your connection details in your RunPT account using Google Firebase and Google Cloud. These services process and store data on our behalf. When you consent to AI coaching, relevant Garmin activity and health information is also processed by OpenAI to generate feedback, plans, and coach replies, as described in our AI transparency section. For outdoor activity weather, we send a selected route coordinate and the relevant time to Apple WeatherKit, as described under weather context. Disconnecting Garmin stops new collection; previously imported data remains in your account until you delete it or your account, subject to the retention rules below.

Sending planned workouts to your watch. For Garmin and COROS, RunPT can send your planned structured sessions (session name, steps, durations or distances, and pace or heart rate targets) to the platform so they appear on your device. Garmin workouts are sent directly to Garmin Connect; COROS workouts are sent through Terra. This is the only data RunPT sends to a connected platform. For Garmin, nothing is sent until you turn on "Send workouts to watch" in RunPT settings (Settings → Watch); you also grant the corresponding permission on Garmin's authorisation screen when you connect. You can turn automatic sending off at any time in the same setting or by revoking RunPT in Garmin Connect.

Current public import and export capabilities are listed on the integrations page. New Strava connections are not offered. Activities previously imported from Strava remain in your training history until you delete them or your account.

Chat & Coaching Messages

When you interact with the AI coach, we collect your text messages and any images you upload. Images are stored in Firebase Storage. Your messages and coaching context (including relevant profile and training data) are sent to our AI provider to generate coaching responses, as described in Section 4.

Weather Context

For outdoor runs, we send a selected GPS coordinate from the activity, a time window around a selected time during the run, and a time zone to Apple WeatherKit to retrieve weather conditions. We normally select a route point and time near the middle of the run, using the start or end location if no suitable route point is available. The coordinate is sent at its recorded precision, without rounding. The result (temperature, humidity, wind, conditions) is stored with the activity and used in workout analysis. We do not send your full route to WeatherKit.

Location on the Website

The race search on our website can sort races by distance from you if you tap the location button and allow it in your browser. Your location is used only in your browser to sort the list. It is not stored and is not sent to us. We remember only whether you chose to share it, in your browser's local storage.

Device & Technical Data

We collect your device's push notification token (Firebase Cloud Messaging), locale, timezone, and metric/imperial preference to deliver notifications and localize the Service.

Optional Analytics & Attribution

If you consent on the relevant platform, we collect limited product-use events, page views, device and app information, crash diagnostics, performance measurements, and mobile install-attribution data. Analytics events describe what happened (for example "activity imported from Garmin" or "weekly plan generated"), not your health values: we do not include HealthKit or connected-platform health metrics, workout routes, or coach message contents in analytics, attribution, or diagnostic payloads, and we do not use them for advertising. Website analytics use manual page views only; autocapture and session recordings are disabled.

Website Storage

The website uses storage necessary for authentication, security, basic operation, and remembering your privacy choice. PostHog analytics storage is created only after you accept optional website analytics. Website and iOS analytics are separate choices.

Purchase Information

If you subscribe to RunPT Premium, we record your subscription status and expiry date. Payment processing is handled entirely by Apple through the App Store; we do not receive or store your payment card details.

Referral and Promotional Codes

If you open a referral link or apply a referral or promotional code, we record the code, the account or partner it belongs to, and when you applied it, so we can give you the offer and credit the person who referred you. If you claim the referral offer, we assign you a one-time App Store offer code. If you refer friends, we record which accounts applied your code and whether each referral has been verified, so we can give you rewards. In the app, referrers see only how many of their referrals are verified, not who those friends are.

Messages to Support

If you contact us, we keep the correspondence and the details you share so we can help you and follow up.

We use your training, recovery, and profile data to:

• Analyse each completed workout (distance, duration, pace, heart rate, splits, elevation, weather) and give you feedback on it
• Compare completed workouts with the sessions that were planned, and record what was actually done
• Estimate training load and recovery status from workouts, sleep, HRV, and resting heart rate, and adjust upcoming training volume and intensity accordingly
• Build and update your training plan (daily sessions, weekly plans, and training phases towards your race goal)
• Track progress, best efforts, and race-time predictions
• Provide conversational coaching that can refer to your recent training and recovery
• Send planned sessions to your watch, where supported and enabled

We also use personal data to:

• Provide, maintain, secure, and improve the Service
• Send push notifications about training feedback and coaching updates
• Process and manage your subscription
• Respond to support requests
• Run the referral program and promotional offers
• Send service messages about your account, security, subscription, and changes to our terms
• Comply with legal obligations
• With your consent, measure product usage, diagnose reliability issues, and understand mobile install attribution

We do not use your data for advertising, we do not sell it, and we do not use it to train or fine-tune AI models.

Profiling. To personalize coaching, RunPT evaluates your data on an ongoing basis: it estimates training load, recovery, and fitness, predicts race times, and decides which sessions to suggest and when to adjust them. Under the GDPR this is profiling. It affects only your training suggestions. It has no legal or similarly significant effect on you, such as on your access to services, credit, insurance, or employment, and we do not share it for such purposes. You can ignore, change, or discuss any suggestion, and you can stop AI processing at any time (Section 10).

The following applies to data from Apple HealthKit and, equally, to data received from Garmin, COROS, Polar, Suunto, and Fitbit:

• Health and activity data is used solely to provide and improve your coaching experience
• It is never sold to third parties
• It is never shared with advertisers or data brokers
• It is never used for marketing or advertising purposes
• It is synced to our secure servers (Google Cloud / Firebase, EU region) so that RunPT can analyse it and coach you
• It is shared with our AI provider only as part of generating coaching, and only the data relevant to the task, as described in Section 4
• It is never used to train AI models

If you are in the European Economic Area (EEA) or the United Kingdom, we process your data under the following legal bases:

• Explicit consent for health data (Art. 6(1)(a) and Art. 9(2)(a)): workout, sleep, heart-rate, HRV, and other health data from HealthKit or a connected fitness platform; injury, illness, and other health information you enter; and the AI processing of that data described in Section 4. Health data is "special category" data, and we process it only with your explicit consent. You give this consent on a dedicated screen in the app when you first connect Apple Health or a watch platform (Section 4), and through the platform's own permission screen when you grant HealthKit access or authorise a connection. You can withdraw consent at any time (Section 10); withdrawal does not affect processing that already took place.
• Consent (Art. 6(1)(a)): push notifications, optional analytics, diagnostics, and mobile attribution.
• Contract performance (Art. 6(1)(b)): creating and managing your account, delivering the Service, subscriptions, the referral program and promotional codes, service messages, and support.
• Legitimate interest (Art. 6(1)(f)): security, fraud and abuse prevention (including of referral rewards and promotional codes), operating necessary technical infrastructure, and, if our business is reorganised or sold, transferring it (Section 7), balanced against your rights.
• Legal obligation (Art. 6(1)(c)): where required by applicable law, for example accounting records.

Connected platforms (independent controllers)

The platforms below share data with RunPT only because you connect them, and each handles your data under its own privacy policy. They are not our service providers. You can revoke RunPT's access from within the platform (for example Garmin Connect → Account settings → Connected apps) or from RunPT.

Service providers (processors acting for us)

We do not sell your personal data. We do not share your data with advertisers or data brokers.

Content you choose to share

When you share a share card, image, or data export outside RunPT, for example to social media or a messaging app, you decide where it goes and the receiving service handles it under its own terms. RunPT does not post anything on your behalf.

Legal requests and protection

We may disclose data where required by law, for example in response to a valid court order, or where necessary to protect the rights, safety, or security of RunPT, our users, or others. Where the law allows, we will tell you about such a request unless doing so would put someone at risk.

Business transfers

If Burre Nacho AB is involved in a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the successor as part of that transaction. The successor must continue to protect it in line with this Policy and with the terms of the platforms your data came from. We will tell you before your data becomes subject to a different privacy policy.

A platform or provider can remain listed here when processing may continue for an existing or previously connected account. This disclosure is broader than the current feature-availability matrix and is not a promise that every connection can be newly enabled.

Necessary website storage supports Firebase authentication, security, the onboarding flow, your consent record, your choice about sharing your location for race search, and a referral code from a referral link you opened. It is not used for advertising. If you accept optional website analytics, PostHog may store pseudonymous identifiers in cookies or local storage so page views can be measured across visits. The website consent record is retained for up to 12 months, after which we ask again.

You can accept or reject optional analytics from the website banner. You can later change or withdraw that choice through Cookie settings, which remains available on the website. In the iOS app, use Settings → Privacy & analytics. Withdrawal stops future optional collection and clears the relevant PostHog identifier where supported. It does not affect the lawfulness of processing performed before withdrawal.

Enabling app analytics may be followed by Apple's App Tracking Transparency prompt. Declining ATT prevents cross-app tracking and never restricts RunPT functionality.

Your account and training data is stored in Google Cloud's EU region. Some of our providers process data outside the EEA and UK. For those transfers we rely on the following safeguards:

• OpenAI (United States): OpenAI's certification under the EU-U.S. Data Privacy Framework and its UK extension, with the European Commission's Standard Contractual Clauses (SCCs) as a fallback under our data processing agreement
• Google (United States): Google's certification under the EU-U.S. Data Privacy Framework and the SCCs incorporated in Google Cloud's data processing terms
• Terra (United Kingdom): the European Commission's adequacy decision for the UK
• AppsFlyer (only if you enable app analytics): SCCs under AppsFlyer's data processing agreement
• Apple WeatherKit: Apple's developer terms with SCCs where data leaves the EEA

PostHog is hosted in the EU. You can request a copy of the relevant safeguards by contacting us.

We keep your personal data for as long as you keep your account. The actions below have different effects; none of them requires you to delete your account unless you choose to.

Disconnecting a fitness platform

Disconnect in RunPT (Settings → Connected data) or revoke RunPT in the platform's own settings. Either way, RunPT stops receiving new data from that platform and, where enabled, stops sending planned workouts to it. We revoke direct Garmin connections with Garmin and connections managed through Terra with Terra. Activities and recovery metrics already imported remain in your training history so your plan and progress stay intact. You can delete individual activities in the app, or ask us to delete all data imported from a specific platform.

Withdrawing AI consent

Turn off AI processing of my data at the bottom of Settings in the app. RunPT then stops sending your data to OpenAI immediately, including background and scheduled processing; our servers check this setting before every AI request. Your account, training history, subscription management, data export, and data rights remain available, but because RunPT's coaching is AI-generated, new plans, workout feedback, and chat replies are paused until you turn it back on. On request we also delete the stored coaching context summary and chat history. You can separately stop new health data reaching RunPT by revoking HealthKit access in iOS Settings or disconnecting a platform. You can also withdraw by emailing support@runpt.app.

Deleting your data or account

You can export your data (Settings → Export my data) and delete your account at any time (Settings → Delete Account). On deletion we:

• Revoke your direct Garmin authorisation with Garmin, your Terra-managed connections with Terra, and your Strava authorisation if connected
• Delete your profile, activities, imported health and recovery metrics, derived metrics such as training load and predictions, training plans and suggestions, coaching context summaries, chat threads, and uploaded images from RunPT's systems
• Delete your sign-in record
• Retain only what we must: anonymised App Store transaction envelopes needed to prevent duplicate subscription processing, and accounting records required by law

Other retention periods:

• Data export files: available for 24 hours, then deleted
• Server logs and diagnostics: up to 30 days
• Backup and recovery copies of the database: overwritten within 30 days of deletion
• Data sent to OpenAI: retained by OpenAI for up to 30 days for abuse monitoring only, then deleted (Section 4)
• Referral records: kept while the referring account exists so earned rewards stay correct. They contain a random account identifier, the code, and dates, not your profile
• Consent and deletion records: kept for as long as needed to demonstrate compliance

GDPR & UK GDPR Rights

If you are in the EEA or UK, you have the right to:

• Access your personal data (use Settings → Export my data, or contact us)
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability: receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time without affecting prior processing (Section 10)
• Not be subject to solely automated decisions with legal or similarly significant effects. RunPT's coaching suggestions do not have such effects; you can always ignore, edit, or discuss a suggestion with the coach
• Lodge a complaint with your local data protection authority

U.S. State Privacy Rights

If you live in a U.S. state with a comprehensive privacy law, such as California, Colorado, Connecticut, Virginia, Texas, or Oregon, you may have the right to:

• Know and access the personal information we collect, use, and disclose
• Correct inaccurate personal information
• Delete your personal information
• Receive a portable copy of your personal information
• Opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these, and we do not sell or share personal information for cross-context behavioural advertising
• Limit the use of sensitive personal information (we use health data only to provide the Service)
• Appeal our decision on your request by replying to it
• Non-discrimination for exercising your privacy rights

California residents may use an authorised agent. We may ask the agent for proof of authorisation and ask you to verify your identity.

How to Make a Request

Use Settings → Export my data or Settings → Delete Account in the app, or email support@runpt.app, ideally from the email address linked to your account. We may ask you to confirm your identity before acting on a request. Requests are free of charge. We respond within one month; if a request is complex, we may extend this by up to two further months and will tell you why. If we cannot fulfil a request, we will explain why.

Our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY). You may also complain to the data protection authority where you live or work.

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, secure cloud infrastructure (Google Cloud/Firebase), per-user access rules, and least-privilege access for staff. However, no method of transmission or storage is 100% secure.

If a personal data breach affects your data, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where the law requires it, tell you without undue delay if the breach is likely to result in a high risk to your rights and freedoms, and notify the platform the data came from where our agreement with that platform requires it. If you notice anything suspicious in your account, contact us at support@runpt.app.

The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. We will tell you about material changes in the app or by email before they take effect, post the updated policy on our website, and update the "Last updated" date. Where a change introduces processing that requires your consent, or materially changes processing you have already consented to, we will ask for your consent before that processing begins, whether or not the affected feature is optional.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us: