Privacy Policy

This policy explains how Run with ME collects, stores, uses, and deletes personal data, including data imported from Strava and from Apple Health via the iOS app. It is written to meet the GDPR, the UK GDPR, and Strava API Policy sections 2.1, 2.2, 6.5, 7.3, 7.4, 7.5, and 7.6.

Who is the controller

Privacy requests about Run with ME go to contacts@runwithme.pl.

Relationship with Strava

This policy does not modify, conflict with, or supersede the Strava Privacy Policy. If this policy and Strava's policy conflict, the Strava Privacy Policy controls for Strava's processing.

Run with ME and Strava are separate, independent controllers. We are not joint controllers. Each party decides its own purposes and means and is responsible for its own compliance. Privacy requests about Strava's processing should be sent to Strava; requests about Run with ME should be sent to us. Apple is an independent controller for Apple Health on your device and for the App Store.

Connecting Strava sends you to Strava's OAuth page. Strava then authenticates you and, if you authorize us, gives us tokens and activity data. That hop is Strava's processing, described in Strava's privacy policy. We do not upload your Run with ME activities to Strava.

Data we collect from Strava

If you connect Strava we collect, via OAuth, the Strava API, and webhooks: activity name, sport type, distance, elapsed time, moving time, average and maximum heart rate, GPS points taken from the activity map, Strava activity id, and athlete id. We request the activity:read_all scope only. We do not read other athletes' Strava accounts.

Legal bases and how we use the data

Connecting Strava and sharing imported activities with friends or challenge participants is based on your consent. Creating and operating your Run with ME account (email, profile, uploaded TCX or manual activities, photos, messages, challenges) is based on performing our contract with you. Security, fraud prevention, and legal obligations are based on legitimate interests or a legal duty.

We store imported activities in your Run with ME profile so you can review them and, if you consent, share them with friends and use them in challenges. Default import privacy is Friends unless you choose Only me. Activities marked private on Strava stay Only me.

From an activity we may calculate a personal best: a time or distance and the date, without the route. That record is ours, not a record downloaded from Strava. It can remain after you delete the activity or disconnect Strava. It is deleted when you delete your Run with ME account.

We do not sell, rent, license, or trade Strava data. We do not use Strava data to train, fine-tune, or operate AI or machine-learning models, and we do not use it for targeted advertising.

Accessing your data

You can see the Strava data we imported in your activities list, activity detail, and profile. You may also email contacts@runwithme.pl to request a copy of the personal data we hold. This does not limit your right to export your own Strava data, free of charge, with Strava's Bulk Data Export.

Withdrawing consent and deletion

You can withdraw consent by disconnecting Strava in your profile, by revoking Run with ME in your Strava settings, or by deleting your Strava account. Disconnecting in the app revokes our access at Strava on a best-effort basis and permanently deletes imported Strava activities and tokens from our systems at that time. If you delete an activity on Strava, or revoke access there, we remove our copy when we receive Strava's notice. Deleting your Run with ME account removes the account, the local Strava connection, and imported activities, and revokes our access at Strava on a best-effort basis. If that call does not reach Strava, revoke Run with ME in your Strava settings.

After a successful disconnect we show a confirmation in your profile. Deleting your account signs you out and returns you to the login page. Email us if you need a written confirmation that deletion completed.

Retention

Account data is kept while your account is open. Imported Strava activities are kept only while your Strava connection and consent remain in place and only as long as needed to provide the import, friends, and challenge features you asked for. After you disconnect, revoke access, or delete the account we delete as described above, unless a law requires a longer hold. After account deletion we may still hold an audit-log entry that includes the email address, IP address, and browser or device identifier, with no fixed retention period; a password-reset record keyed by that email; and a team photo that stays with the challenge team.

Strava usage data

Strava may monitor and collect usage data about our API access and may use that data for any business purpose, including support, compliance, and improving the Strava API. See the Strava Privacy Policy for how Strava processes personal data.

Processors, transfers, and security

Processors act for us to host the service and its database, to store photos you upload, to send email, and to deliver messages and notifications in real time. Strava and Apple are independent controllers for their own services, not our processors. Your browser loads map tiles from OpenStreetMap. On request we will provide the names, roles, and processing locations of our processors. We are responsible for those processors as if their acts were our own.

If personal data moves from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision, the transfer uses the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent mechanism.

Strava access and refresh tokens are encrypted at rest. We use commercially reasonable technical and organizational measures to protect personal data. No method of transmission or storage is completely secure. See Security for how to report a vulnerability.

Your rights

You may request access, rectification, erasure, restriction, objection, or portability of your personal data, and you may withdraw consent at any time without affecting prior lawful processing. You may complain to your supervisory authority (in Poland, the President of the Personal Data Protection Office / UODO).

Children

Run with ME is not directed to children under sixteen (16). We do not knowingly collect Strava or other personal data from children below that age.

Other account data

We store the account details you provide: email, a hash of your password, display name, and profile fields you choose to enter (first name, last name, gender, weight, height, date of birth, bio, and profile photo). We also store uploaded TCX or manual activities, photos and captions, activity notes, messages, reactions, friendships, challenge participation, and the time you were last seen online. You can hide online status in your profile. In-app notifications stay with the account until you delete it. An administrator can archive read notifications older than 30 days and delete archived notifications older than 90 days.

A session cookie keeps you signed in on the web. It is an httpOnly cookie. We do not use advertising cookies. The iOS app stores access and refresh tokens in the device Keychain. On the server we store only a hash of the mobile refresh token, for up to 30 days, together with the user agent of the client that signed in. The browser may keep a cache of activity-type categories and dismissed friend invitations in local storage, and a short-lived home-screen cache or a dismissed notification prompt in session storage.

Apple Health / HealthKit

The iOS app reads workouts, workout GPS routes, heart rate, running and cycling distance, and active energy from Apple Health on your device, only after you grant those permissions. We do not write data back to Apple Health. We do not request clinical health records.

Imported workouts are stored on your Run with ME account like any other activity so they can appear on your profile and count toward challenges whose date window includes the workout. The first sync imports up to the last 30 days. Heart rate and route are optional; indoor workouts without GPS are stored without a map.

We do not sell, rent, license, or trade Apple Health data. We do not use it to train, fine-tune, or operate AI or machine-learning models, and we do not use it for targeted advertising. Health data stays in your account until you delete the activity or the account. A personal best calculated from a workout can remain after the workout is deleted, until you delete the account.

Related: Terms of Service.