Privacy

Who is responsible

The data controller is WEBALTERIMMO SAS, publisher of Runayo (runayo.com). For any question or request about your data, write to contact@runayo.com.

What Runayo keeps

Your account. Your mobile number, your first and last name, your language, the dates you signed up and last logged in; your email address if you add one, once confirmed with the code we send there, and the fingerprint of those codes (never the code itself). And, if you signed up from one of our plan pages or an ad, where you came from: the page name and the campaign name, read from the address, with no cookies.

Your body, if you fill it in. Your weight, height, age and sex. Each one is optional and can be erased by clearing the field.

Your activities, if you connect your watch or a service. The summary of each activity, including the ones set to private, and the file your watch recorded: laps, split times, device, and the second-by-second data — GPS track, elevation, speed, heart rate, cadence, power, temperature. Your Garmin email and password are used once to open your session and are neither stored nor logged; session tokens are stored encrypted.

Your runner profile. Your personal bests, recent volume, running days, max HR and zones, pulled from your watch or entered by you, plus the history of their changes.

Your goals and your plan. Your races and goals, your training plan, the events you report (a busy week, a trip, fatigue, pain, illness, and what you write about them), the workouts you cancel and why, the workouts you add by hand when your watch didn't record them (the sport, the day, the duration, the distance, your effort and your notes), the analyses of your workouts and what you say you felt (your effort, how it went, any pain, your notes).

The log of codes sent. For each login code: the number, its country, the IP address of the request, the time and the result of the send. It's used to block abusive sending and is deleted after 90 days.

Your phone, if you install the app and accept notifications. A device token, used only to send you the notifications you chose in your Account (your plan is ready, next week is ready, your workout of the day in the morning, at the time you pick, your Sunday workout not done yet, an activity synced from your watch), and erased when you log out of the app or delete your account. The text of a notification goes through Apple to reach an iPhone, through Google to reach an Android phone.

Technical logs. Server errors (the message and the page, kept for 60 days) and, for each call to an artificial intelligence model, its purpose, your account, its duration and its cost — never what was sent to it or what it replied.

Measuring our ads. Runayo spreads the word about the app through Google ads. On the site's public pages (the home page, our plan pages, sign-in, the legal pages), and only if you agree to it, the Google Ads tag measures whether you arrived through one of them: Google sets its cookies there, for 13 months at most. Never in your personal space or in the apps: no data from your account, your watch or your plan ever goes to Google for advertising. You can change your mind at any time via "Manage cookies", in the footer.

No advertising in your account or in the apps, no analytics tracking. Four technical cookies: your session (one year), your language (one year), your choice about advertising cookies (six months) and, for the team, the return to admin after helping on an account (8 hours).

Your health data

Your weight, your heart rate, and anything you tell us about fatigue, pain, illness or how you felt during a workout are health data. They're only used to build and adjust your training plan, and to analyse your workouts. It's up to you whether you share them: each one is optional, and you can delete them at any time.

Artificial intelligence

The Runayo coach isn't a person. Your plans, the pacing and run advice, the workout analyses and the app's translations are written by artificial intelligence models, based on your data. They don't replace medical advice: if pain persists, see a doctor.

These models come from specialised providers, which may change over time. The current ones are listed in the providers list below; if a provider changes, that list is updated, along with the date on this page.

Whatever the provider, Runayo only works with those who contractually commit to processing your data solely to answer its requests, never using it to train their models, and protecting it as the GDPR requires. If one of them is outside the European Union, the transfer is governed by the European Commission's standard contractual clauses.

What gets sent to them: your goal, your body, your runner profile, your races from the last two years, your weeks of running, the events you've reported, the workouts you've cancelled and why, and, for the analysis of a workout, the run with its laps and kilometres and how it felt — which the planning of your following weeks also reads back through, along with the workouts you've added by hand and what you said about them. Never your GPS track, never your mobile number.

Why

Your account, your activity sync, your training plan and its analyses are the service you ask for: they rely on performing that contract.

Your health data and the link with your watch or a service rely on your consent: you can withdraw it by deleting that data or unlinking your watch. The same goes for measuring our ads: you can withdraw it via "Manage cookies" in the footer.

The log of sent codes and technical logs rely on our legitimate interest: protecting the service from abuse and fixing it when it breaks.

Who can see them

Only you. Nothing is shown to other users, nothing is sold. Your activities are shown to you alone. The Runayo team can access them for maintenance and support; whenever we open your account to help you, every access is logged.

Service providers

Runayo relies on a handful of providers, each for one specific task and nothing else:

• Scaleway — server, database and backup hosting, in Paris
• Brevo — sending login code SMS messages and emails (including the code that confirms your address)
• Apple — delivery of the app's notifications on iPhones (the notification text, which may name one of your activities or a workout from your training plan; never your other data)
• Google — delivery of app notifications on Android phones, via Firebase Cloud Messaging (the notification text, which may name one of your activities or a workout from your plan; never your other data)
• Google Ads — measuring Runayo's ads on the site's public pages, and only with your consent; Google processes this data under its own policies
• Anthropic — artificial intelligence models (Claude): writing training plans, advice, analyses and translations — in the United States

Garmin isn't one of our providers: you're the one who connects your account. Whatever you record there stays governed by Garmin's privacy policy. The Garmin connection isn't an official Garmin integration: Runayo opens your session with your credentials, just like the Garmin Connect app. If you leave sending enabled in your Account, the running workouts from your plan (their title, their purpose, their steps) are written to your Garmin Connect calendar so they reach your watch, and are removed from it once they're run, or when you remove them yourself.

Where your data lives

The server and database are in France, in Paris, and backed up every hour with the same host. Exchanges between your browser, the server and the database are encrypted (HTTPS and TLS).

How long we keep it

Your data is kept for as long as your account exists. Unlinking your watch or a service immediately erases everything that came from it: activities, personal bests, analyses and profile fields filled in from them, as well as session tokens. Anything you entered yourself stays.

You can delete your account at any time, from the Account tab. Everything that identifies you is erased right away: your phone number, your email, your name, your body data, your activities, your profile, your goals, your plans, your code log; your watches and services are unlinked. All that remains is one anonymous row — your sign-up, last login and deletion dates, your language, the page and campaign you came from — and the model call log, with no content, for our statistics.

Your rights

You can access your data, correct it, delete it, receive a copy of it, restrict its use or object to it, and withdraw your consent at any time. Many of these can be handled directly in the Profile tab.

Write to contact@runayo.com: we reply within one month. If you're not satisfied with our answer, you can file a complaint with the CNIL (cnil.fr).

Age

Runayo is intended for people aged 15 and over — the age at which you can consent on your own to the processing of your data in France.

If this page changes

The date at the top of the page tells you when it was last changed in substance.