Privacy Policy

1. What we collect

Account data: your name, email address and profile picture from Google sign-in, or your email address if you use a password.

Training data: the workouts, plans, notes, shoes and settings you enter or import, including health-related information such as heart rate and body weight if you choose to log it.

Strava data (only if you connect Strava): your Strava athlete name and ID, access tokens, and details of your runs such as date, start time, distance, pace, heart rate, elevation, start location and the shoe used; and, if you turn on shoes from Strava, your Strava shoes and their mileage.

Subscription data (only if you subscribe): your subscription status, plan and renewal date. Card and payment details are handled by Stripe and Link; we never see or store your card number. Purchases made in the Android app are handled by Google Play; we only receive your subscription status and its dates, through RevenueCat.

Usage data: anonymous-by-default analytics about how the app is used (pages visited and actions such as adding a workout), linked to your account ID.

2. Why we use it

To provide the service you signed up for (performance of a contract): storing and showing your training, calculating effort and fatigue, syncing with Strava, and managing your subscription.

To improve the app and keep it secure (legitimate interest): usage analytics and error logs.

Health-related data such as heart rate and weight is processed only because you choose to enter or sync it, to show it back to you.

3. Who processes your data

Google Firebase (Google Cloud): hosting, sign-in, database and server functions. Your data is stored in the European Union (Firestore multi-region eur3; functions in Belgium, europe-west1).

Stripe and Link: payments, invoices, tax and payment support for Pro subscriptions.

RevenueCat: manages subscriptions bought through Google Play. It receives your account ID and your purchase history, and tells us your subscription status.

Google Play: payments and billing for subscriptions bought in the Android app.

Strava: only if you connect it, to import your runs. Strava may collect information about how you use its services through Running Browser (usage data), under Strava's own privacy policy.

Open-Meteo: for synced runs, we send the approximate start location (rounded to about 100 meters) and date to look up the weather condition, temperature and wind. No account details are sent.

Resend: sends our account emails, such as the welcome email when you create an account. It receives your email address and first name.

Google Analytics for Firebase: usage analytics.

Google Ads: to measure whether an ad led to a sign-up or a first workout. If you arrive from an ad, Google sets its advertising cookie, and when you create an account or add your first workout we tell Google that it happened. When you are signed in, your email address goes with that message as a one-way (SHA-256) hash made in your browser, so Google can match it to the ad; Google does not receive the address itself, and no training data is sent.

Some of these providers may process data outside the EU, under the safeguards required by the GDPR, such as the EU standard contractual clauses or the EU-US Data Privacy Framework. We do not sell your data.

4. How long we keep it

We keep your account and training data until you delete your account. Deleting your account removes your workouts, settings and Strava connection, and cancels any Pro subscription. Invoices and payment records are kept by Stripe for as long as tax law requires.

Strava data: when you disconnect Strava, revoke Running Browser's access on Strava, or delete your account, we delete everything imported from Strava: runs that came only from Strava are removed, planned workouts they filled go back to your plan, and shoes from Strava are removed. This happens right away (always within 30 days), and the app confirms it in Settings, Integrations. A run you delete on Strava is removed here within 48 hours.

5. Your rights

You can access, correct, export and delete your data. Most of this you can do yourself in the app: export your workouts with Export, and delete everything with Settings, Account, Delete account. For anything else, email contact@aeroenix.io.

You can also object to processing based on legitimate interest, and you have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your country.

6. Cookies and local storage

The app stores a few settings in your browser, such as your language and theme, and Firebase keeps you signed in. Analytics uses its own identifiers.

7. Changes

We may update this policy. We will notify you of significant changes in the app or by email.