Privacy Policy

Last Updated: March 17, 2026 · Effective Date: March 17, 2026

RunCoach ("the App," "we," "us," or "our") is an AI-powered running coaching application for iOS, developed and operated by Itay Naim, based in Israel. This Privacy Policy explains what data we collect, how we use it, how we protect it, and your rights regarding that data.

By using RunCoach, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account Information

When you create a RunCoach account, we collect:

• Your name (or a display name you choose)
• Email address (provided via Apple Sign In or direct registration)
• Basic profile details you provide: age, weight, height, maximum heart rate, running experience level, and race goals

1.2 Garmin Activity Data

When you connect your Garmin account, we retrieve the following data from the Garmin Connect Developer Program API with your explicit permission:

• Run metrics: distance, duration, pace, speed, elevation gain/loss, calories, steps, lap count
• Heart rate data: average and maximum heart rate, time spent in each heart rate zone (zones 1-5), resting heart rate
• Running dynamics: cadence, ground contact time, ground contact balance, vertical oscillation, vertical ratio, stride length
• Power metrics: average power, maximum power, normalized power
• Training metrics: VO2 max estimates, aerobic and anaerobic training effect, training load
• Environment data: temperature, estimated water loss
• Location data: start and end coordinates of activities, elevation profiles. We do not store full GPS tracks or route data.
• Per-kilometer split data: pace, heart rate, cadence, ground contact time, vertical oscillation, stride length, elevation change, and power for each split segment

1.3 Daily Health Metrics

With your Garmin connection, we also retrieve daily health data including:

• Resting heart rate and heart rate variability (HRV)
• Sleep score and sleep duration
• Stress levels
• Body Battery (high and low values)
• Training readiness score
• Respiration rate and blood oxygen (SpO2) levels

Note: Much of the data described in Sections 1.2 and 1.3 constitutes sensitive information under Israeli law, as it relates to your health and physical condition. We collect and process this data only with your explicit, informed consent, granted when you connect your Garmin account and confirmed via a dedicated in-app consent screen.

1.4 User-Provided Information

You may voluntarily provide additional information through the App, including:

• Injury records: body area, injury type, severity, status, and notes
• Daily check-ins: sleep quality, energy level, muscle soreness, and free-form notes
• AI coach conversations: questions you ask the AI coach and the responses generated

1.5 Automatically Collected Information

When you use the App, we automatically collect minimal technical data:

• Device language/locale preference
• App version and iOS version (via standard HTTP headers)
• Server request logs (timestamps, endpoint accessed, response status)

We do not use any third-party analytics, tracking, or advertising SDKs. We do not collect device identifiers (IDFA), advertising identifiers, or hardware fingerprints.

2. How We Collect Your Data

2.1 Garmin Connect Developer Program API

We access your Garmin data through the official Garmin Connect Developer Program API. You must explicitly grant permission to connect your Garmin account via a dedicated in-app consent flow that clearly explains what data will be accessed and how it will be used. We access your data in read-only mode — we never write data back to Garmin or modify your Garmin account in any way.

You can disconnect your Garmin account at any time through the App settings, which will immediately stop all future data retrieval and revoke the stored access tokens.

2.2 Direct Input

Profile information, injury records, daily check-ins, and AI coach conversations are collected directly from your interactions with the App.

3. How We Use Your Data

We use your data for the following purposes:

• AI-powered coaching: Your activity data, health metrics, and training history are analyzed by AI models to generate personalized coaching recommendations, run analyses, weekly summaries, and answers to your training questions.
• Fitness scoring: We compute composite fitness scores (including aerobic fitness, training load, recovery, and running economy metrics) to give you a holistic view of your training status.
• Trend analysis: We analyze your data over time to identify performance trends, detect anomalies, and generate insights about your training.
• App functionality: To operate the App, sync your data, and provide the core features you expect.

We do not use your data for advertising, marketing profiling, or any purpose unrelated to providing you with running coaching.

We do not use your data to make fully automated decisions that produce legal or similarly significant effects on you. AI coaching recommendations are informational only and do not constitute medical or professional advice. See Section 11 (AI and Automated Processing) for details.

4. Consent

4.1 How We Obtain Consent

We obtain your consent through the following mechanisms:

• Garmin connection: When you first connect your Garmin account, you are presented with a detailed consent screen that lists the specific categories of data that will be accessed, the purposes for which the data will be used, and the third-party services that will process your data. You must actively confirm this consent before any data is retrieved.
• AI coaching: When you first interact with the AI coach, a separate notice explains that your activity and health data will be sent to AI providers for processing. You must acknowledge this before proceeding.
• Account creation: By creating a RunCoach account, you consent to the collection and processing of your account information and user-provided data for the purposes described in this policy.

4.2 Withdrawing Consent

You may withdraw your consent at any time by:

• Disconnecting your Garmin account (stops data retrieval)
• Deleting your RunCoach account (removes all stored data)
• Contacting us at itaynaim@runcoach.net

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. After withdrawal, we will stop processing the relevant data, but data previously sent to AI providers for real-time processing cannot be retroactively recalled (though it is not retained by those providers).

5. Third-Party Services

RunCoach integrates with the following third-party services. Each acts as a data processor on our behalf, operating under contractual terms that restrict their use of your data to the purposes we specify.

5.1 Garmin Connect (Garmin International, Inc.)

We use the Garmin Connect Developer Program API to retrieve your activity and health data. Our access is governed by the Garmin Connect Developer Program Agreement, which requires us to protect your data, obtain your consent, and comply with applicable data protection laws. Garmin's processing of your data on its own platform is governed by Garmin's Privacy Policy.

5.2 AI Providers (Google, OpenAI, Anthropic)

We use AI language models (currently Google's Gemini) to power the coaching features of the App. When you interact with the AI coach or receive run analyses, the following data is sent to the AI provider:

• Sent: Activity metrics (distance, pace, heart rate, cadence, training load), health summaries (HRV, sleep, readiness), recent training history, and your question or conversation context.
• Not sent: Your name, email address, Apple ID, GPS coordinates, device information, or any other personally identifiable information.

AI providers process this data in real time to generate coaching responses. Under our API usage agreements with these providers:

• This data is not used to train the providers' AI models.
• This data is not permanently stored by the AI provider beyond the duration needed to process the request (typically seconds to minutes).
• The AI provider may temporarily log request data for abuse monitoring purposes, subject to automatic deletion within 30 days.

For details, refer to Google's Gemini API Terms, OpenAI's API Data Usage Policy, and Anthropic's Privacy Policy.

The specific AI provider may change over time. We will update this policy when we make a material change to our AI provider. Regardless of provider, the same data minimization and non-retention principles apply.

5.3 Fly.io (Cloud Hosting)

Our backend server and database are hosted on Fly.io, with the primary server located in Frankfurt, Germany (EU). Fly.io provides the compute and persistent storage infrastructure. Data is encrypted in transit via HTTPS. Fly.io's privacy practices are governed by Fly.io's Privacy Policy.

5.4 Apple (App Distribution)

The App is distributed through the Apple App Store. Apple may collect data related to your download and use of the App in accordance with Apple's Privacy Policy.

6. International Data Transfers

Your data is transferred to and processed in the following jurisdictions:

Adequacy: The European Union is recognized by Israel as providing an adequate level of data protection. For transfers to the United States, our AI providers operate under API data processing terms that contractually prohibit data retention and model training on user data. Data sent to US-based AI providers is de-identified (contains no personal identifiers) and is processed transiently.

We take reasonable steps to ensure that your data receives an adequate level of protection in every jurisdiction to which it is transferred, consistent with the requirements of the Israeli Protection of Privacy Law and applicable regulations.

7. Data Storage and Security

7.1 Where Your Data Is Stored

Your data is stored on an encrypted persistent volume hosted by Fly.io in Frankfurt, Germany (EU), using a SQLite database. The volume is encrypted at rest using Fly.io's infrastructure-level encryption. Garmin authentication tokens are stored on the same secured persistent volume.

7.2 Security Measures

We implement the following security measures to protect your data:

• Encryption in transit: All communication between the iOS app and our server uses HTTPS/TLS encryption.
• Encryption at rest: The persistent storage volume is encrypted at the infrastructure level.
• Secure credential management: All API keys, passwords, and tokens are stored as encrypted environment variables — never hardcoded in source code.
• Parameterized database queries: All database operations use parameterized SQL to prevent injection attacks.
• Minimal data exposure: We send only the minimum necessary data to AI APIs, excluding all personally identifiable information.
• Access control: Server access is restricted to the developer (Itay Naim) via secure authentication. No third parties have direct access to the database or server.
• No third-party tracking: We use zero analytics SDKs, advertising frameworks, or tracking tools.

7.3 Limitations

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.

8. Data Breach Notification

In the event of a security incident that results in unauthorized access to, or disclosure of, your personal data:

• We will investigate the incident promptly and take immediate steps to contain and remediate it.
• We will notify affected users without undue delay, and in any event within 72 hours of becoming aware of the breach, by email and/or in-app notification.
• We will report the incident to the Israeli Privacy Protection Authority (PPA) where required under the Protection of Privacy Regulations (Data Security), 5777-2017.
• The notification will include: a description of the incident, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.

9. Data Retention and Deletion

9.1 Retention

Your data is retained for as long as your account is active and you continue to use the App. AI conversation history (your questions and the AI coach's responses) is stored to maintain coaching continuity. We do not retain your data for longer than necessary to fulfill the purposes described in this policy.

9.2 Deletion

You may request deletion of all your data at any time. Upon deletion, we will permanently remove:

• All activity data and per-kilometer splits
• Daily health metrics
• Training plan data and progress
• AI coaching history and analyses
• Runner profile and fitness scores
• User profile information (name, age, weight, etc.)
• Injury records and daily check-ins
• Garmin connection tokens

To request deletion, use the "Delete Account" option in the App's Settings, or contact us at itaynaim@runcoach.net. We will process deletion requests within 14 days, and no later than 30 days.

9.3 Post-Deletion

After deletion, some data may temporarily persist in server backup systems for up to 30 additional days before being fully purged. Data that has already been sent to AI APIs for real-time processing cannot be retroactively deleted from those providers, but as noted above, AI API providers do not permanently retain this data under our API agreements.

10. Your Rights

10.1 For All Users

Regardless of your location, you have the following rights:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of all your data (see Section 9).
• Withdraw consent: Disconnect your Garmin account or delete your RunCoach account at any time.
• Restrict processing: Request that we limit how your data is used while you verify its accuracy or while we assess a deletion request.
• Object to processing: Object to specific uses of your data.

10.2 For Israeli Users

If you are located in Israel, your data is protected under the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13 (5774-2024), effective August 14, 2025.

Under Israeli law:

• Much of the health data we collect (heart rate, HRV, sleep, stress, SpO2) is classified as sensitive information. We collect and process it only with your explicit, informed consent.
• You have the right to access, correct, and delete your personal data.
• You have the right to restrict processing or object to specific uses of your data.
• You have the right to be informed of the purpose of data collection and the recipients of your data at the time of collection.
• You have the right to receive your data in Hebrew, English, or Arabic.
• You may file a complaint with the Israeli Privacy Protection Authority (PPA):
  Address: 66 Kanfei Nesharim Street, Jerusalem, Israel
  Website: gov.il/privacy-protection-authority
• Under Amendment 13, you may file civil claims without proof of harm, with statutory damages of up to NIS 100,000 per violation.

10.3 For EU/EEA Users (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with your local data protection authority. Our legal basis for processing your data is your explicit consent (connecting your Garmin account, using AI coaching features) and the legitimate interest of providing the App's services.

Our server is hosted in Frankfurt, Germany (EU), meaning your data is stored within the EU.

10.4 Exercising Your Rights

To exercise any of these rights, contact us at itaynaim@runcoach.net. We will respond to your request within 30 days. If we cannot fulfill your request, we will explain why.

11. AI and Automated Processing

11.1 How AI Is Used

RunCoach uses AI language models to generate personalized coaching recommendations, run analyses, weekly training summaries, and conversational responses to your training questions. The AI analyzes your activity data, health metrics, and training history to produce these outputs.

11.2 Limitations of AI Coaching

• AI coaching recommendations are informational only. They are not a substitute for professional medical advice, diagnosis, or treatment.
• No fully automated decisions with legal or similarly significant effects are made based on your data.
• AI-generated outputs may contain inaccuracies. You should exercise your own judgment when following any recommendation.

11.3 Transparency

• The AI models receive only de-identified activity and health metrics — no personally identifiable information.
• AI recommendations are generated based on patterns in your training data, general sports science principles, and the context you provide.
• You may ask the AI coach to explain the reasoning behind any specific recommendation.
• We do not use your data to build profiles for purposes beyond your individual coaching experience.

11.4 Your Rights Regarding AI Processing

• You may opt out of AI coaching at any time by not using the AI coach feature. Core data sync and fitness scoring features function without AI.
• You may request human review of any AI-generated recommendation by contacting us at itaynaim@runcoach.net.
• You may request an explanation of how a specific AI output was generated.

12. Data Sharing

We do not sell, rent, or trade your personal data to any third party.

We share data only with the third-party services described in Section 5 (Garmin, AI providers, Fly.io, Apple), and only to the extent necessary to provide the App's core functionality. We will never share your data with advertisers or data brokers.

We may disclose your data if required by law, court order, or governmental request, or if necessary to protect our rights, property, or safety.

13. Children's Privacy

RunCoach is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at itaynaim@runcoach.net and we will promptly delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by email before the changes take effect. The "Last Updated" date at the top of this policy will always reflect the most recent revision.

Material changes include: adding new categories of data collection, introducing new third-party processors, changing AI providers, transferring data to new jurisdictions, or modifying your rights.

Your continued use of the App after any changes constitutes your acceptance of the updated policy. If you do not agree with the updated policy, you should stop using the App and request deletion of your data.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Itay Naim
RunCoach
Email: itaynaim@runcoach.net
Location: Israel

For complaints regarding data protection, you may also contact the Israeli Privacy Protection Authority (PPA) at the address listed in Section 10.2.

This Privacy Policy is written in English. In the event of any conflict between translated versions and the English version, the English version shall prevail.