Privacy Policy

Information We Collect

Personal Information

When you create an account, we collect your name, email address, age, and training preferences. We use them to build and personalize your training plan. If you add a profile photo, we store it with your account.

When you sign up, we record your agreement to our Terms of Service, this Privacy Policy, and the assumption-of-risk acknowledgment. That record holds the date, the version you agreed to, your IP address, and your browser or app identifier. We keep it as proof of consent.

Training Data

We collect training data you provide, including workout details, performance metrics, heart rate data, and other fitness information. This data is used to generate personalized training plans and provide insights into your progress.

Apple Health (HealthKit)

With your authorization, Praxis reads workout data from Apple Health, including workout summaries, heart rate, GPS route, distance, active energy, step count, cadence, and elevation. This data is stored on Praxis servers solely to produce your training insights. Praxis reads from Apple Health and does not write to it. HealthKit data is never shared with third parties, never used for advertising or analytics, and never used to build marketing profiles.

Location

GPS routes from your runs. Runs you import from Apple Health or Garmin, or upload as activity files, include the GPS route you recorded. We store these routes with your account. We use them to show your route maps, splits, and elevation, and to analyze your training. Route maps are also saved on your device so they load quickly. That copy is deleted when you sign out.

Your current location. The iOS app asks for your precise location only while the app is open, to show the local weather forecast. The iOS app sends your location to Apple WeatherKit, and the web app sends it to OpenWeatherMap, to retrieve current conditions. We do not store your current location.

Device and Third-Party Platform Data

When you connect fitness devices or platforms (such as Garmin Connect, Apple Health, or other compatible services), we collect the activity and health data you explicitly authorize us to access. This may include workout summaries, heart rate data, GPS tracks, cadence, elevation, and other metrics recorded by your device.

Important: When you connect a third-party platform to Praxis Running, your data is submitted to and stored by Praxis Running — not by the third-party platform provider. The third-party platform provider (e.g., Garmin) is not responsible for, and has no liability regarding, the data you submit to Praxis Running through their integration. Data may be transferred between Praxis Running and the third-party platform's servers to facilitate the integration you have authorized.

How We Use Your Information

• Generate personalized training plans and recommendations
• Track your progress and provide performance insights
• Analyze workout data to deliver actionable coaching feedback
• Send you important updates about your training
• Improve our services and develop new features
• Provide customer support
• Ensure platform security and prevent fraud

We do not share your data with any third-party websites, applications, platforms, or services beyond those explicitly listed in this policy without obtaining your prior consent.

Data Sharing and Restrictions

We do not sell your personal information. We do not share your personal information for monetary or other valuable consideration. We only share personal data:

• With your explicit consent
• To comply with legal requirements
• With trusted service providers who help operate our platform (listed in the Third-Party Services section below)
• With connected device platforms (e.g., Garmin Connect) solely to facilitate the integration you have authorized
• In case of a business merger or acquisition (with prior notice)

We do not share your end-user data with any third-party websites, applications, platforms, or services that are not disclosed in this privacy policy. Any new data sharing arrangements will be reflected in an updated version of this policy, and you will be notified prior to any such changes taking effect.

Data Security

Praxis Running is solely responsible for maintaining appropriate security of all end-user personal data in our possession. We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Regular security audits and monitoring
• Role-based access controls and secure authentication via httpOnly cookies
• CSRF protection on all state-changing operations
• Rate limiting to prevent abuse
• Input validation and sanitization on all user-submitted data
• Secure cloud infrastructure with Supabase (row-level security enabled)

Your Rights

You have the right to:

• Access and download your personal data
• Correct inaccurate information
• Delete your account and data
• Restrict data processing
• Data portability
• Withdraw consent at any time

Cookies and Tracking

We use essential cookies for sign-in and site functionality. On the web signup and contact forms, Cloudflare Turnstile may set a cookie to confirm you are not a bot. We do not use tracking cookies for advertising. You can manage cookies in your browser settings.

Data Retention

We keep your data while your account is active. When you delete your account, we immediately and permanently delete your profile, training plans, logged runs, GPS routes, uploaded activity files, and profile photo.

These records remain after deletion:

• Your signup consent record (your name, email, the terms version you accepted, and when you accepted it), kept as proof of consent.
• Stripe customer and payment records, kept to meet tax and accounting obligations.
• Product analytics events in PostHog, stored under an account identifier. Email [email protected] and we will delete them.
• Encrypted database backups, which expire on our hosting provider's backup schedule.

Automated Processing

Your training plans, workout classifications, and performance insights are produced by our own algorithms running on the data in your account. Those calculations are deterministic: the same inputs always produce the same plan.

We do not use your training data, health data, or personal information to train models of any kind, and we do not share it with anyone else for that purpose. We do not build advertising or marketing profiles from your data.

No automated process we run makes decisions about you that carry legal or similarly significant effects. If you want to know how a particular plan or insight was produced, contact us at [email protected].

Changes to This Policy

We may update this policy periodically. We'll notify you of significant changes via email or through the platform. Continued use after changes constitutes acceptance of the updated policy.

GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to data processing for specific purposes
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with your local supervisory authority

Legal Basis for Processing: We process your data based on consent, contractual necessity (to provide our services), and legitimate interests (service improvement and security).

Data Controller: Praxis Running acts as the data controller for your personal information.

EU Representative: For GDPR-related inquiries, contact [email protected]

CCPA Rights (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights:

• Right to Know: Request disclosure of personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (Note: We do NOT sell personal information)
• Right to Non-Discrimination: We won't discriminate against you for exercising your CCPA rights

Categories of Personal Information We Collect:

• Identifiers (name, email, account ID)
• Personal information (age, fitness preferences)
• Internet activity (app usage, workout data)
• Biometric information (heart rate, if provided)
• Geolocation data (GPS routes from recorded runs; current location for weather, not stored)
• Photos (your profile photo, if you add one)

Do Not Sell My Personal Information: We do not sell personal information to third parties. We do not share personal information for monetary consideration.

To exercise your CCPA rights, contact us at [email protected] with "CCPA Request" in the subject line.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequate protection under applicable data protection laws
• Secure data processing agreements with service providers

Children's Privacy

Praxis Running is not intended for anyone under 16 years of age, and signup requires you to confirm that you are 16 or older. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from someone under 16, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at [email protected].

Runners between 16 and 18 must have parental or guardian consent to use our service.

Third-Party Services

We use the following third-party services to operate Praxis Running. Each service processes data only as necessary for its stated purpose:

• Supabase: Database hosting, authentication, and file storage. Your account data, training data, and uploaded activity files are stored on Supabase infrastructure. See the Supabase Privacy Policy.
• Vercel: Hosting for our website and web app. Vercel processes your requests, including your IP address, to serve pages. See the Vercel Privacy Policy.
• Apple App Store: In-app subscription purchases on iOS. Apple processes your payment. We receive a record of your subscription to confirm your access. See the Apple Privacy Policy.
• Stripe: Payment processing for web subscription billing. Stripe processes your payment information directly — Praxis Running does not store your credit card details. Stripe is PCI DSS compliant. See the Stripe Privacy Policy.
• Garmin Connect: When you connect your Garmin device or account, activity data is transferred between Garmin and Praxis Running to provide workout analysis. Garmin acts as an independent data controller and is not a data processor for Praxis Running. Data you submit to Praxis Running through the Garmin integration is our responsibility, not Garmin's. See the Garmin Privacy Policy.
• PostHog: Product analytics. PostHog receives app usage events, such as features used and crash reports, and an account identifier. Some events include training settings you chose, such as race type and training days per week. PostHog never receives HealthKit data, health measurements, GPS routes, location, or contact details. See the PostHog Privacy Policy.
• Google Sign-In: Authentication only. When you sign in with Google, we receive your name and email address to create or access your Praxis account. See the Google Privacy Policy.
• Sign in with Apple: Authentication only. When you sign in with Apple, we receive your name and email address (or an Apple relay address, if you choose to hide your email) to create or access your Praxis account. See the Apple Privacy Policy.
• Apple WeatherKit: Weather in the iOS app. Your current location is sent to Apple WeatherKit to retrieve the forecast. We do not store it. See the Apple Privacy Policy.
• OpenWeatherMap: Weather in the web app. Your current location is sent to OpenWeatherMap to retrieve the forecast. We do not store it. See the OpenWeather Privacy Policy.
• Apple MapKit: Route maps in the iOS app. To draw a map, the app requests map imagery from Apple for the area around your route. See the Apple Privacy Policy.
• CARTO: Route maps in the web app. To draw a map, your browser requests map tiles from CARTO for the area around your route. See the CARTO Privacy Policy.
• Resend: Email delivery. Resend receives your email address and the message content to send account emails, such as confirmations and password resets, and newsletters you subscribe to. See the Resend Privacy Policy.
• Cloudflare Turnstile: Bot protection on the web signup and contact forms. Turnstile receives browser signals and your IP address to confirm you are a person. See the Cloudflare Privacy Policy.

We do not share your personal data with any third-party services beyond those listed above without your prior consent. If we add new third-party integrations, this policy will be updated and you will be notified before any data sharing occurs.

How to Exercise Your Rights

To exercise any of your privacy rights:

• Get a copy of your data: Email [email protected]. We will send your data in a machine-readable format.
• Delete your account: Go to Settings → Account → Delete Account, in the app or on the web. Deletion is immediate.
• Correct your information: Edit your profile and training preferences in Settings.
• Any other request: Email [email protected].

We will respond to your request within 30 days (45 days for complex requests). We may verify your identity before processing requests.

Contact Us

If you have questions about this privacy policy or your data, please contact us:

• Email: [email protected]
• GDPR Inquiries: [email protected]
• CCPA Inquiries: Include "CCPA Request" in subject line to [email protected]
• Data Protection Officer: [email protected]