Privacy Policy

1. Data controller

The controller of your data is IT Kreatywni, [to be completed: registered office address], tax ID (NIP) [to be completed: tax ID (NIP)], [to be completed: KRS or REGON number]. For matters concerning personal data, including exercising your rights and contacting the data protection officer, write to prywatnosc@runvolo.com. We reply within 2 business days.

2. What data we process and where

Runvolo works on a “phone first” model: your workouts and health data are stored in the app on your device, and our server stores only what is necessary to run your account and connections to services.

Only on your device (in the Free version they do not reach our server):

• Sports profile: year of birth, height, body weight, level, goals, available training days.
• Activities and routes: GPS track, pace, distance, elevation, cadence, laps, records and analyses.
• Health data: heart rate, HRV, sleep, resting heart rate, SpO2, breathing — only the data you agree to.
• Training plan and your answers in the well-being survey.
• Strava access tokens — in the iOS keychain (Keychain) on your device.
• Share images (stat stickers, year, record and form cards): the app makes them on your phone and does not send them to our server. It saves them without metadata (EXIF, location), and the route on a sticker leaves out the first and last 200 m. You pick a photo from your library in the system picker — the app has no access to your whole library. An image goes only where you share it, under that service’s rules.

iPhone backup: the app’s data on your device (workouts, routes, health data, plan) is included in your iPhone backup in iCloud or on your computer, like the data of other apps. Apple or your computer creates and stores that backup, not us — we have no access to it. iCloud Backup is encrypted by Apple, and end-to-end once Advanced Data Protection is turned on. You can turn off the backup for Runvolo in the iPhone Settings (Apple Account → iCloud → iCloud Backup). Temporary files, the map cache and export files are not included in the backup. Sign-in tokens, Strava tokens and encryption keys in the keychain do not move to another phone with the backup: after restoring the backup on a new iPhone you sign in again, reconnect Strava and, with Premium, enter your recovery code.

On our server:

• Account: e-mail address, password hash — never the password itself, Sign in with Apple identifier, creation date.
• Acceptance of the Terms: the version of the Terms and the date of acceptance (including confirmation of the safety rules) — as proof of concluding the agreement, until the account is deleted.
• Subscription: status, product and period from the App Store. We do not process your card details — payments are handled by Apple.
• Devices: the Apple push notification token (APNs) and the public key of each device (max. 10 devices) — needed to wake the app and encrypt data for it.
• Connected services: the identifier of your account with the provider (e.g. Strava or Garmin), so that we can match the provider’s notifications to you.
• Garmin: access tokens, encrypted (AES-256) with a server key, and the status of the history import.
• Premium, only once you turn on device sync: encrypted copies of your runs, plan and profile for sync between your iPhones (details in section 5).
• Challenges with friends (only when you create or join a challenge): the alias you chose for that challenge, the goal type, goal and dates, a hash of the invitation code and — only when you turn on sharing your progress — one number: your total of kilometres, runs or active days, capped at the goal. No routes, pace, heart rate or workout dates. Other participants see your alias and this number, with no ranking.
• Invitations: your referral code, whose code you entered and who entered yours, and the App Store offer codes assigned to you.
• Shared heatmap (only if you turn on contributing in the app): the grid cells of about 12 × 12 m you ran through — without routes, order, time, pace, start or finish — and the public key of your contribution pseudonym. The private key stays only on your phone, and the contribution is not linked to your account (it is not in the account export either). The public map shows a cell only once at least 5 different people have run through it, and it is rebuilt once a day.
• Temporarily: a one-time password reset link (only its hash is in the database, valid for 30 minutes) and encrypted events waiting to be delivered to a device (max. 14 days).
• Technical data: server logs (request address without parameters, response code, time) — without content, passwords or tokens.

3. Health data (special category)

Health data is a special category of data within the meaning of Article 9 of the GDPR (EU Regulation 2016/679). We process it only on the basis of your explicit consent (Article 9(2)(a) GDPR), given separately for each source and type of data.

• Consent is voluntary; without it, the app works in a limited scope (e.g. without the readiness score).
• You can withdraw consent at any time in the app: Profile → Privacy and data, or in the Health settings on your iPhone. Withdrawal does not affect the lawfulness of processing carried out before it.
• We analyse health data in the app on your device. It is used only to analyse training, readiness and the plan, not for diagnosis, advertising or marketing profiling.
• Data from Apple HealthKit is not shared for advertising purposes or with data brokers. It reaches our server only in Premium, and only encrypted with a key we do not know.

4. Purposes and legal bases

• Running the account and providing the service, including connections to services, notifications for the app and Premium sync — Article 6(1)(b) GDPR (contract); health data — Article 9(2)(a) (consent).
• Handling subscriptions and billing — Article 6(1)(b) and (c) GDPR.
• Contributing to the shared heatmap — Article 6(1)(a) GDPR (consent, which you can withdraw in the app at any time).
• Challenges with friends and invitations — Article 6(1)(b) GDPR (contract). We show your progress to other participants only after you turn this on in the challenge; you can turn it off at any time.
• Security, abuse prevention, error diagnostics and backups — Article 6(1)(f) GDPR (legitimate interest).
• Account e-mails (e.g. a password reset link) — Article 6(1)(b); marketing information only with consent.
• We do not run any visitor analytics on the website or in the app.

5. Strava, Garmin, Apple Health and Premium sync

We connect only through the providers’ official interfaces (Strava API, Garmin Connect Developer Program, Apple HealthKit). We do not use unofficial methods of signing in or downloading data.

• Apple Health: the app reads and writes data directly in Health on your iPhone; nothing passes through our server.
• Strava: our server only mediates the exchange of the sign-in code for tokens (because this requires the app key) and stores nothing from this exchange. The tokens go to the keychain on your device, and the app downloads workouts directly from Strava. The server keeps only the identifier of your Strava account, so that it can wake your device after a notification from Strava.
• Garmin: the integration works through our server, because Garmin’s program requires this. We store Garmin tokens encrypted. The server immediately encrypts data downloaded from Garmin with the public keys of your devices and passes it on to them; it deletes the data as soon as receipt is confirmed, and after 14 days at the latest.
• We only download data from Strava (read-only access). We send nothing to Strava — neither from your phone nor from our server.
• When you disconnect a service, we delete the tokens and the link to your account with the provider.
• We do not use data from the Strava and Garmin APIs to train AI models, and we process it in line with these providers’ terms.

Premium sync (runs, plan and profile) is end-to-end encrypted and you turn it on yourself: Profile → Device sync. Data is encrypted on your device with a key that only your devices have. The key reaches your next iPhone through your iCloud Keychain (Apple encrypts it end to end; we have no access to it) or through the recovery code, which you keep. We do not have this key, so we cannot read the content; the server sees only the size, time and type of the encrypted records. Deleting your account erases the encrypted copies on the server, and the app then also removes the copy of the key from your iCloud Keychain. If you lose all your devices, access to your iCloud Keychain and the recovery code, the copies on the server cannot be decrypted.

6. AI coach

Reports, comments on runs and plan changes are produced by rules, in the app on your device, without external language models. On devices that support it, the text may be reworded by Apple’s language model running locally on the device.

Chatting with the coach, by voice too, works in the app on your device, by the same rules and without external language models. Your iPhone recognises speech locally, and recordings are never sent or stored. A chat with an Anthropic language model in Premium is planned and not available yet. Before it launches, we will update this section: we will describe the scope of the context that is passed on, the data processing agreement and the retention period, and we will inform you about the change at least 14 days in advance.

7. Recipients of data

• Hosting: OVHcloud, a dedicated server in Warsaw (Poland). We do not use external databases, data clouds or analytics tools.
• Sending account e-mails (e.g. a password reset link) from no-reply@runvolo.com: an e-mail provider acting under a data processing agreement, which receives only the recipient’s address and the content of the account message ([to be completed: name of the e-mail provider]).
• Apple — sign-in (Sign in with Apple), push notifications (APNs), App Store payments and offer codes, and iCloud Keychain (the copy of the sync key, end-to-end encrypted), as a separate controller. The push notifications we send do not contain your data.
• Other participants of your challenges — only your alias and, if you turn it on, your progress total.
• Garmin and Strava — only for the connections you turn on yourself.
• We do not sell data and do not share it with advertisers.

8. Transfers of data outside the EEA

Our server and backups are in Poland. Data leaves the European Economic Area only when you use the services of Apple, Strava or Garmin, under these providers’ rules (the European Commission’s standard contractual clauses or an adequacy decision, e.g. the EU–US Data Privacy Framework).

9. How long we keep data

• Data on your device — until you delete it; signing out and deleting your account clear it from the app.
• Account data on the server, including Premium encrypted copies — until the account is deleted. Deleting the account erases it immediately, without a grace period.
• Challenges — up to 30 days after they end (a challenge with no participants disappears at once); your participation is deleted at once when you leave the challenge or delete your account.
• Invitation data — until the account is deleted.
• Encrypted events for devices — until receipt is confirmed, 14 days at the latest.
• Password reset link — 30 minutes, single use.
• Your contribution to the shared heatmap — until you withdraw consent; the app deletes it when you withdraw consent, sign out or delete your account, and a contribution from a phone you no longer use expires after 12 months without activity.
• Backups of the server database — encrypted, kept for 14 days, including a copy outside the server (in the EU); after this time, the data of a deleted account also disappears from the backups.
• Technical logs — without request content, passwords or tokens; overwritten automatically when the size limit is exceeded (5 files of 20 MB per service).
• Billing documents — for the period required by tax law.

10. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability (export in GPX and JSON formats), to object, and to withdraw consent at any time.

You can export your data and delete your account yourself: you export data from your device in the app, and you download what we store on the server on the “Account” page. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa).

11. Security

• Encryption in transit (TLS); we store passwords as an Argon2 hash, and session tokens in the iOS keychain (Keychain).
• Premium sync and data passed on from Garmin are encrypted with keys that only your devices have.
• We encrypt database backups with a public key; the key needed to read them is not stored on the server.
• The privacy zone hides the start and end of routes when you share them.

12. Profiling and automated decisions

The readiness score, recommendations and plan are produced automatically from your data. They do not produce legal effects concerning you or similarly significant effects (Article 22 GDPR). You can see every recommendation with its reasoning, and a change to the plan requires your acceptance.

13. Children

The service is intended for people aged 16 or over. We do not knowingly collect data from younger children; if we become aware of it, we will delete the account.

14. Cookies

runvolo.com stores one strictly necessary cookie (rv_lang) only when you choose the site language yourself, and konto.runvolo.com uses only strictly necessary cookies — details in the Cookie Policy. The mobile app does not use cookies or cross-app tracking (App Tracking Transparency).

15. Changes to the policy

We will inform you about significant changes in the app and by e-mail at least 14 days in advance. We make archived versions available on request.