Privacy Policy

RunBuddy ("RunBuddy", "we", "us") provides a personal training tracker: workout logging, training plans, and an optional AI running coach. This policy explains what data we collect through the RunBuddy web app and mobile app, why we collect it, who else sees it, and the choices and rights you have over it.

For any privacy question or to exercise a right described below, contact us at [email protected]. RunBuddy is the data controller for the personal data described in this policy.

1. Data we collect

We only collect data you give us directly or that your workouts generate:

• Account & sign-in. Email address, name, and profile image; a password (stored hashed) if you sign up with email; or an identifier from Google, Apple, or your organization's SSO provider if you sign in that way. We also keep session records (session token, IP address, browser/device user agent, expiry) to keep you signed in and to detect suspicious activity — these, along with short-lived email-verification/sign-in tokens, are automatically deleted once they expire, not kept indefinitely.
• Workouts & GPS tracks. Activity type, start/end time, duration, distance, pace, heart rate, elevation, calories, and — for GPS-tracked activities — the underlying route (latitude/longitude, altitude, speed, cadence at each recorded point).
• Fitness & physiological data. Anything you enter in Settings to power training-load and heart-rate-zone calculations — birth year, weight, sex, resting/max/threshold heart rate — plus any other fitness metrics you sync (e.g. HRV, VO2max, sleep, steps, weight over time). This is training data you provide to get more accurate coaching and analytics, and we only process it because you've chosen to use the features that need it (see "Legal basis" below).
• Plans, goals & records. Training plans and individual planned sessions, goals you set, personal records, custom route segments, and any feedback you log on a session (perceived exertion, how you felt, notes).
• AI coach conversations. If you use the coach, we store your chat messages and its replies, plus durable "facts" the coach saves about you (e.g. an injury, a goal, a preference) so it doesn't need to re-ask every conversation. You can review and delete these in Settings.
• Strength & exercise data. Exercises you create in the exercise library and any votes you cast on library exercises.
• Subscription data. If you buy premium through the App Store, we store the subscription status, product, and Apple transaction identifiers needed to unlock premium features. Apple is the seller of your subscription and handles payment, receipts, and tax entirely — we never see your card number, and this data is just our entitlement record of what Apple tells us, not a financial record we independently keep.
• API keys & connected apps. Keys you generate to connect the mobile app, and, if you explicitly connect a third-party AI assistant to RunBuddy (via our MCP integration), the OAuth authorization and consent record for that connection.
• Diagnostics. Basic technical logs (e.g. AI usage/cost per coach turn) used to keep the service running reliably and within budget. We don't run any advertising or analytics trackers.

2. How we use it

• Operate the core features you use: logging workouts, building plans, tracking goals and records.
• Compute derived analytics — training load, heart-rate zones, grade-adjusted pace, run/walk segmentation — from your workouts and physiological settings.
• Power the optional AI coach: your messages and relevant training data are sent to our AI provider to generate a response.
• Verify and manage App Store subscriptions for premium features.
• Sync data with the RunBuddy mobile app and, if you enable it, a read-only calendar feed of your plan.
• Secure your account: authentication, session management, rate limiting, fraud/abuse prevention.
• Communicate with you about your account when necessary (e.g. security notices).

We do not sell your data, and we do not use it for advertising or share it with data brokers.

3. Legal basis for processing (GDPR)

• Contract: processing needed to provide the core tracking and planning features you sign up for, and processing your acceptance of this policy at signup.
• Consent: the fitness and physiological metrics you choose to add or sync (heart rate, HRV, weight, and similar), and use of the optional AI coach, both of which you opt into. You can withdraw consent at any time by removing that data or not using the coach; this doesn't affect processing already carried out.
• Legitimate interest: account security, fraud prevention, and keeping the service running reliably.

4. Who we share data with

We share data only with the processors needed to run the service:

• AI provider. When you use the coach, your messages and the training context needed to answer them are sent to the AI model provider we've configured (by default an OpenAI model or an OpenAI-compatible provider) to generate a reply. They process this on our behalf and do not use it to train their own models under our configuration. Your routes' GPS coordinates are never sent: workout detail shared with the coach covers distance, time, pace, heart rate, elevation, and cadence, but not where you went.
• Apple. If you sign in with Apple or purchase premium through the App Store, Apple processes your sign-in and payment information, and notifies us of subscription events (renewals, cancellations) so we can update your access.
• Google. If you sign in with Google, Google processes your authentication request and shares your basic profile (name, email) with us.
• Third-party AI assistants you connect. If you deliberately authorize an external AI assistant to access RunBuddy through our MCP integration, that assistant can read or write the data covered by the scopes you grant it (as with our own coach, GPS coordinates are not included). You control this connection and can revoke it at any time in Settings.

We don't run analytics, advertising, or tracking scripts, and map tiles and exercise images are served from our own infrastructure rather than a third-party tracker.

5. Data retention

We keep your data for as long as your account is active. Deleting your account (Settings → Account → Delete account) permanently removes your profile, workouts, plans, coach conversations, and everything else tied to it. This is immediate and cannot be undone, so we recommend exporting your data first (see below) if you want a copy. If you used free coach messages, we keep one thing to prevent misuse: a one-way, keyed hash of your sign-in identity (email address and Apple/Google account ID) together with the number of free messages used, so a new account with the same identity doesn't start a new free allowance. It can't be turned back into your email address or account ID.

6. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS), hashed passwords and API keys, and scoped access tokens for connected apps. No system is perfectly secure, but we work to keep your data safe and will notify you if we become aware of a breach affecting your account.

7. Your rights

Subject to applicable law (including the GDPR if you're in the EEA/UK), you can:

• Access & export your data — Settings → Data lets you download a full copy (GPX + JSON) at any time.
• Correct inaccurate data directly in the app (profile, workouts, settings).
• Delete your account and all associated data from Settings → Account.
• Withdraw consent for fitness-data processing or the AI coach at any time.
• Object to or restrict certain processing, and request portability of your data.
• Lodge a complaint with your local data protection authority.

To exercise any right not available directly in the app, email [email protected].

8. International transfers

Our processors (e.g. our AI provider, Apple, Google) may process data outside your country of residence. Where required, we rely on appropriate safeguards such as standard contractual clauses for these transfers.

9. Children

RunBuddy is not directed at children under 16, and we don't knowingly collect data from them.

10. Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you in the app.

11. Contact

Questions about this policy or how we handle your data: [email protected].