Privacy Policy

1. Who we are

Allyson Run is a running coach app, operated by Diego Garcimartín, an independent developer based in Spain, acting as the data controller for your personal data. Allyson Run is a training tool, not medical advice. You can reach us about anything in this policy at diego.garcimartin@gmail.com; our postal address is available on request.

2. Data we collect

We collect only what the product needs to coach you:

• Account data: email address, name (if you provide one), authentication identifiers from Google sign-in or magic links.
• Training data: your goals, availability, training plans, completed workouts, post-run check-ins, and (only if you connect intervals.icu) imported running activities and wellness metrics.
• Coach conversations: your chat messages with the coach, stored so the coach has memory. Team review of anonymized transcripts happens only with your explicit beta consent.
• Product analytics:minimal usage events (e.g. "plan generated"), tied to your account so we can debug your experience. They never contain chat content.

3. How we use your data, and our legal basis

We use your data only to run the product. Under the GDPR we rely on these legal bases:

• Coaching you (plans, chat, check-ins, your account): to perform our contract with you.
• Transactional emails you expect (welcome, weekly plan summary): to perform our contract; you can opt out of non-essential ones at any time.
• intervals.icu import of your activities and wellness data: your consent, given when you connect the integration; disconnect at any time.
• Improving the coach by reviewing anonymized transcripts: only with your explicit beta consent.
• Keeping the service safe and preventing abuse: our legitimate interests in running a reliable service, and any legal obligations that apply.

We do not sell your data and we do not use it for third-party advertising.

4. Sensitive information

Allyson Run does not run a menstrual-cycle tracker and does not store cycle data in any dedicated field. If you mention your cycle, your health or how you feel in chat, that text is stored as part of your conversation like any other message, and it is deleted when you delete your account. If you connect intervals.icu, wellness metrics such as resting heart rate or sleep may be imported. We treat this kind of data as sensitive, process it only to coach you, never for advertising, and you can disconnect or delete it at any time.

5. Subprocessors and international transfers

We share data only with the providers that run the product:

• Supabase: database, authentication and storage.
• Vercel: hosting and privacy-friendly analytics (no chat content).
• Anthropic:the AI that powers your coach. Relevant training context is sent to generate responses; it is not used to train Anthropic's models per our API agreement.
• Resend: transactional email delivery.

Some of these providers process data outside the European Economic Area, including in the United States. Where they do, transfers are covered by the European Commission's Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework. This list is current at the date above; we will give notice of material changes.

6. How long we keep your data

• Account, training and chat data: while your account is active, so the coach keeps its memory.
• Product analytics: minimal and kept no longer than needed.
• Backups: deleted data is purged from encrypted backups within 30 days.

7. Data deletion

Delete your account in Settings and every table that holds your data is wiped in one transaction: profile, plans, workouts, activities, chat history, integrations. Real deletion, not a soft delete. If you ask us to delete your data by email instead, we action it within 30 days.

8. Your rights

Under the GDPR you can, at any time, ask to access, correct, export, restrict or delete your data, object to a given use, and withdraw any consent you gave. Our coaching is automated, but it does not make legal or similarly significant decisions about you.

The in-app controls in Settings cover access, export and deletion; for anything else email us at diego.garcimartin@gmail.com and we will respond within one month. If you believe we have mishandled your data, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).

9. Cookies and analytics

We use the minimum needed: essential cookies and local storage to keep you signed in, and privacy-friendly, cookieless analytics from Vercel. We do not use advertising or cross-site tracking cookies.

10. Age requirement

Allyson Run is for people aged 16 or older. We ask you to confirm this during onboarding, and the product is not designed for, or directed at, children.

11. Changes to this policy

We may update this policy as the product evolves. For material changes we will let you know by email or in the app before they take effect, and we will update the date at the top.

12. Contact

Questions, requests or complaints about your data: email Diego Garcimartín at diego.garcimartin@gmail.com. Postal address available on request.