Privacy Policy

• Approval
• Notifications
• Your rights

Last updated: 2026-10-18

Controller

The controller responsible for data processing through V.Runner is:

1.1 Data protection contact

For data protection questions and requests, contact sc@susv.xyz. The controller is reviewing its DPIA and DPO obligations under GDPR and German law before public App Store launch. A completed assessment or DPO appointment is not claimed here.

Overview

V.Runner is an adaptive running coach for iOS and Apple Watch. You set a race (date, distance, time) or a target time. The app estimates fitness from Apple Health, builds a Daniels VDOT plan, and can schedule sessions to the system Workout app on Apple Watch. It is a fitness and wellness product — not a medical device and not a diagnostic or treatment tool.

This website is a static marketing and legal site. It does not create accounts, set analytics cookies, or collect training data. App processing depends on the relevant permissions and consents. Website hosting and support correspondence are described separately below.

2.1 Beta and future purchases

Your first four training weeks are free, including your starting partial week. After that, one credit per planned run is used together when the current week is ready. No subscription. The five-credit pack has a US base price of $0.99; Apple shows your local price. Public sales require App Store approval. TestFlight uses separate sandbox balances without real charges. Apple processes payments; we do not receive card details. We store the free period’s starting week, its end and covered weeks with your account, separately from the monetary wallet. Free weeks create no purchase or revenue entries. These dates stay with your account across devices and reinstalls.

To provide credits and prevent duplicate charges, we record Apple-verified transaction and product identifiers, quantity, purchase time, currency and signed price, a random app-account token, credit grants, unlock debits and refunds. These records use a separate account reference. Accounting entries contain an opaque workout reference, with no Health measurements, route, heart-rate samples or Coach conversation. Balance and purchases remain manageable from Privacy when AI coaching is paused.

Legal bases

• Art. 6(1)(a) and Art. 9(2)(a) GDPR — explicit consent: for health-derived cloud backup and the required AI-coach approval. The approval covers cloud coaching, personal training updates and de-identified improvement-data sharing together. It is a condition of normal app use; improvement sharing is included in this scope, not a separate optional choice in the current approval flow.
• Art. 6(1)(a) GDPR — separate consent: for optional technical crash reports through Firebase Crashlytics. This choice is off by default and does not form part of AI-coach approval. Reports must exclude training numbers, GPS and heart-rate recordings.
• Art. 6(1)(b) GDPR — contract performance: for necessary account and requested service operations, including Firebase Authentication, backup restore and delivery of Coach notifications you enable and the purchase, recovery and use of workout credits.
• Art. 6(1)(c) GDPR — legal obligation: for separate purchase and credit accounting records needed for tax and bookkeeping. This does not authorize retaining Health data in the accounting ledger.
• Art. 6(1)(f) GDPR — legitimate interest: for service security and attestation. We do not rely on legitimate interest for health-derived training information.

Health-derived VDOT, load and recovery records remain special-category personal data. De-identification does not make them anonymous. The controller is reviewing the required approval, including its combined purposes and the conditions for freely given consent, as part of the legal/product assessment before public launch.

Your approval and permissions

1. Apple Health permission allows the app to read workouts and the relevant health measurements on your iPhone. It does not authorize cloud processing by itself.
2. Cloud-backup consent permits derived training records to be backed up. Cloud backup, with Sign in with Apple, must be enabled before AI coaching can start.
3. Required AI-coach approval is an explicit acceptance of cloud coaching, personal training updates and de-identified improvement sharing together. The app presents the purposes, data details and this policy before acceptance. The recorded approval includes its version, identifier and time, with corresponding cloud-coaching and improvement-sharing consent records.
4. Crash reports have a separate optional choice, off by default. Notification permission and Coach reminder settings are also separate controls.

Earlier separate grants are not treated as acceptance of the combined scope. Existing users must review and explicitly accept the current AI-coach approval before using that flow. The implementation retains the scope of older records until this fresh acceptance; this policy does not broaden those grants retroactively.

You can withdraw AI-coach approval in Privacy. Cloud coaching, personal training updates and improvement uploads then stop, and removal of linked improvement records is requested. Normal app use returns to the approval screen until you accept again. Turning off cloud backup also pauses coaching and normal app use. Saved training is retained unless you choose deletion; export and account deletion remain accessible from the approval screen.

A temporary network or cloud outage with a previously verified, still-valid approval is different: the saved on-device plan may remain usable while cloud features are unavailable. A pending withdrawal does not reuse a cached approval to continue coaching. You can revoke Apple Health access independently in iOS settings. Withdrawal does not erase Apple Health or Apple Workout records.

Data We Process

5.1 On the device (HealthKit) — not uploaded as samples

The app may read running workouts (including metres climbed stored on the workout), workout routes, walking/running distance, running speed, stride length, heart rate, resting heart rate, heart-rate variability, breathing rate, sleep analysis, VO2 max, height, body mass, and workout effort scores (estimated and user, 1–10). Effort scores stay on the device and are not used to set paces, kilometres, or VDOT. Routes are used on-device to identify continuous stretches of a run for fitness estimation. Extraction runs in memory. We do not upload GPS routes, raw heart-rate time series, or HealthKit sample dumps to our servers, crash logs, or analytics. In Settings → Privacy you can export a training snapshot you chose (workouts, optional vitals and in-workout samples). That JSON stays on your iPhone until you share it. We do not receive it unless you send it. GPS routes are never included.

5.1a Coach notifications and local reminders

With your iOS notification permission and Coach reminders enabled, the app can schedule local reminders and register for remote Coach updates, such as a completed weekly review. Local reminders are generated on your iPhone. Remote delivery uses our Firebase backend, Expo Push Service and Apple Push Notification service (APNs).

The app sends an Expo push token, your Firebase account identifier, time zone, chosen reminder time and dates reserved for local reminders to the backend. Backend records also include enabled/expiry settings, message identifiers, delivery attempts and receipt status. The outbound Expo request contains the token, a Coach title, a short preview, the account identifier and event/message identifiers used to open the matching note. It does not send the full weekly review or raw Health recordings in the notification.

Standard weekly-review notifications use a generic lock-screen preview, such as “Open Coach for your update and next steps.” The detailed note is read inside the app. Notification titles and any custom previews must avoid health details. Delivery providers may process routing data outside the EEA; a European Firestore region is not a promise that every push operation stays in Europe.

The sender limits remote delivery to one notification per registered device per local day and avoids days reserved for local reminders. It checks the queue every five minutes and sends within a two-hour window after the chosen reminder time, subject to availability. Messages are eligible for remote delivery for up to 48 hours; delivery is not guaranteed. Turn Coach reminders off in Me → Settings, or change iOS notification permission. The app disables its remote registration when reminders are turned off; Coach notes can still appear in the app.

5.2 In the cloud (Google Cloud Firestore, region eur3)

After health_derived_sync consent, we store derived records under a Firebase Auth user id (anonymous until you link Sign in with Apple for backup), including:

• profile (coaching mode, race, target, or improve; birth month and year used to derive age; optional height and weight for economy; personal best; days per week; VDOT);
• consent events (grant / withdraw, policy version, timestamps);
• plan weeks and sessions (prescriptions, phase, acceptance);
• execution summaries (prescribed vs completed distance and in-band ratio — no GPS or HR series);
• advisor logs (derived feature vector in, plan adjustment out).

Example scalars: VDOT, training phase, weeks to race, 7- and 28-day load, resting-heart-rate and HRV deltas, overnight breathing-rate medians, average sleep hours, session counts.

5.2a De-identified improvement records

Improvement sharing is included in the required AI-coach approval. The records support internal development and evaluation of the training algorithm, including test cases and simulations. They are never used for advertising.

The scope includes workout totals and other activities; recovery trends; your goal; issued training plans and later adjustments; age band, sex, height and weight if provided, running experience, personal-best performance and training availability; derived fitness, calibration and learned planning state; pace and heart-rate targets; Watch scheduling and cue settings; structured feedback; derived pace/heart-rate timelines in intervals of up to 30 seconds; recorded lap, segment and activity boundaries as relative timings; and a de-identified link to the scheduled Watch workout.

GPS routes, raw sensor recordings, free-text feedback, HealthKit identifiers, your name, your Firebase account identifier, and birth month and year are excluded from these improvement records. Age is represented as a band midpoint, runner identifiers are replaced and dates shifted by whole weeks. A private account link allows linked records to be located for deletion. This is de-identification, not irreversible anonymity.

Records are processed in restricted Google Cloud Firestore and Cloud Storage infrastructure. Earlier optional snapshots retain their original scope; neither an old snapshot opt-in nor an old cloud-coaching grant authorizes the current combined approval. Withdrawing AI-coach approval stops new improvement uploads and initiates deletion of linked legacy snapshots, expanded records and internal derived artifacts. Cleanup is retried if necessary. Exported copies or material sent outside the service cannot be automatically recalled; contact us for help.

5.2b Crash reports (optional analytics consent)

If you agree, Firebase Crashlytics may collect a technical crash report when the app fails: device model, OS version, and a stack trace. Collection is off until you grant this consent (and is turned off again if you withdraw). We do not set your name or email on the report, and we do not include training numbers, GPS tracks, or heart-rate recordings. This is diagnostics, not product analytics. Firebase Analytics and PostHog are not used.

5.3 Identity

The app starts with Firebase Anonymous Authentication. We do not request your name or email for backup restore. Cloud backup is required for coaching and uses Sign in with Apple so the backup can be restored after a reinstall or on a new iPhone. Without that sign-in, reinstall continuity is not guaranteed.

5.3a TestFlight beta testing

If you test through TestFlight, Apple processes beta installation, usage, crash and feedback information under its own TestFlight terms. Apple may share that information and feedback you submit with us for improving the app. This is separate from the optional Crashlytics setting inside V.Runner. Do not include sensitive Health information in feedback unless it is needed. See Apple TestFlight and Privacy.

5.4 This website

The marketing site is static. We do not use analytics cookies, session replay, or advertising pixels. To deliver and protect this site, Vercel processes technical request data such as IP address, requested page, request time and browser information. Our purpose is reliable, secure website operation (Art. 6(1)(f) GDPR). Hosting and security logs are subject to the provider’s retention and deletion rules; they are separate from app account records. See Vercel’s Privacy Notice.

Recipients

The following providers receive or process data for the purposes shown. Their contractual roles, legal entities and applicable safeguards are part of the controller’s review before public launch.

Not in use: Firebase Analytics (auto-collection off), PostHog. We do not use ad networks. There is no PaperStork backend in this product.

EU hosting of training records does not mean every provider operation remains in the EEA: authentication, attestation, notifications, diagnostics and support can involve international processing. Where transfers require safeguards, the applicable provider terms and standard contractual clauses govern them. Contact us to request information or a copy of the relevant safeguards. Provider terms: Google Cloud Data Processing Addendum and Vercel Data Processing Addendum.

Apple Watch

When you tap to schedule or re-sync a week, Apple receives custom workout prescriptions (pace range, distance, type, fire dates) so the system Workout app can run them on Watch. We do not send your Firestore profile, VDOT history, or GPS to Watch.

Automated processing and AI

Training paces and session prescriptions are calculated by the app’s training engine. Gemini, through Google Cloud Functions and Vertex AI, provides coaching explanations and constrained suggestions from derived training information and feedback. The cloud service requires both enabled backup and the current AI-coach approval. AI-generated coaching notes are identified in the app. The product does not diagnose injury, overtraining or medical risk.

Personal forecasting compares possible future training options. Automatic personal-policy publication and calibration rollout remain held in the current release; approval is not a promise that every planned feature is active. There is no promise of a new simulation after each run or of live changes to pace targets on your Watch. You decide whether to follow a session and review changes where the app requires approval.

A cloud outage with valid approval can leave saved on-device training available. Withdrawing approval or turning backup off pauses normal use and returns you to the approval gate, with export and deletion still accessible. The app does not make decisions with legal or similarly significant effects under Art. 22 GDPR.

Retention and deletion

Account, backup and consent records remain until account erasure or a valid erasure request. Consent and approval records document acceptance, withdrawal and version changes. Turning backup off stops new writes but does not itself erase existing cloud records. Uninstalling alone does not erase them either.

Improvement records and linked internal artifacts are retained until withdrawal of the relevant approval or account erasure initiates removal. Cleanup can require retries; if it remains incomplete, contact us. Withdrawing approval retains your saved training while pausing normal use. Previously submitted crash reports follow Crashlytics retention rules; disabling new collection does not itself erase those reports.

Push registrations expire 30 days after their last registration refresh. Backend device registrations and delivery records are scheduled for cleanup daily after expiry, and invalid device tokens are removed when the provider reports them. The 48-hour remote-delivery window does not mean the saved Coach message is deleted after 48 hours: message text remains in the account until erasure. Account deletion also initiates removal of related push messages, registrations and delivery records. Provider-held routing information and receipts follow the providers’ own retention policies.

Account deletion removes unlocked-workout identities and coaching access immediately after server confirmation. Separate production purchase, credit and anti-replay records remain for the active credit account and through ten complete calendar years after closure or a later accounting entry for accounting and refunds, then a daily cleanup removes them. TestFlight-only closed accounts are removed after 30 days. Contact support about unused credits before deleting: a new coaching account does not automatically recover a deleted account’s consumed App Store purchases. Apple handles refund requests; statutory rights remain unaffected.

Your rights

You have the rights of access, rectification, erasure, restriction, portability, and to withdraw consent (Art. 7(3), 15–20 GDPR).

• Access / portability: export of the users/{uid} tree as machine-readable JSON (unencrypted when exported). Separately, Settings → Privacy can write a Health training snapshot you chose; that file stays on the iPhone until you share it, and we do not receive it unless you send it.
• Rectification: edit profile fields in the app. Measurement data is corrected in Apple Health, then refreshed.
• Erasure: Settings → Privacy starts deletion of the cloud tree, research copies and the Firebase Auth user. If a request fails or a research copy remains, contact us so we can complete it. Apple Health and Watch workouts are not deleted — they were never ours.
• Withdraw approval: in Privacy, withdraw the combined AI-coach approval to stop cloud coaching, personal training updates and improvement sharing together. Removal of linked improvement data is requested, including legacy and derived copies. The app returns to the approval gate; export and deletion remain accessible. Turning cloud backup off pauses normal use and stops new backup writes, while existing cloud data stays until erasure. Crash reports can be disabled separately without withdrawing AI-coach approval.

To exercise these rights, use the in-app Privacy screen or email sc@susv.xyz. We normally respond within one month. If a complex request needs an extension permitted by Art. 12(3) GDPR, we explain it within that month. If you already uninstalled the app, contact us from that address and we will help identify the account where possible.

Withdrawal does not affect processing that was lawful before withdrawal. You may object to processing based on legitimate interests under Art. 21 GDPR. If you contact support, we process your email address and the information you supply to answer the request (Art. 6(1)(b) GDPR for contractual support; Art. 6(1)(f) for other enquiries). Please do not send Health exports unless needed for your request. If you choose to send health information, we request the relevant explicit consent. Correspondence is retained while the request is being handled and where needed for legal obligations or claims.

Cookies

This website does not set analytics or advertising cookies. Essential hosting cookies, if any, are limited to what Vercel requires to deliver the pages.

Security

• TLS in transit
• Firestore security rules scoped to the authenticated user id
• Firebase Authentication and App Check enforcement on the AI-coach approval APIs
• No raw GPS or heart-rate series in cloud documents
• Crash SDK off until separately consented; product analytics SDKs not shipped

Children

V.Runner is not directed at children. We do not knowingly create accounts for users under 16 in Germany. If you believe a child has used the app, contact us and we will erase the cloud record.

Right to complain

You may lodge a complaint with the competent supervisory authority:

Changes

We may update this policy when our processing changes. Material changes will be reflected by a new last-updated date and, in the app, a new consent policy version. The current version is always available at this URL.