WillToRun — Privacy Policy

Last Updated: April 29, 2026

1. Introduction

WillToRun is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

2. Information We Collect

2.1 Account Information

• Email address
• Password (stored as a one-way cryptographic hash; we cannot see your password)
• Account role (athlete or coach)

2.2 Strava Data (with your authorization)

• Activity summaries: date, distance, duration, pace, heart rate, power, cadence, elevation
• GPS route data: latitude, longitude, altitude for each recorded point
• Activity metadata: name, type, gear, device
• We access this data through Strava's API using read-only permissions

2.3 Data We Generate

• Terrain classification for your routes
• Terrain-adjusted performance metrics (TerraPace, TerraPower, TerraScore)
• Race predictions and course analysis results
• Usage analytics (page views, feature usage)

2.4 Technical Data

• IP address (for rate limiting and security only; not stored long-term)
• Browser type and version
• Device information (from uploaded FIT files: watch manufacturer and model)

3. How We Use Your Information

We use your information to: - Provide and maintain the Service - Compute terrain-adjusted performance metrics for your activities - Generate race predictions and training insights - Send account-related emails (verification, password reset) - Send optional daily digest emails (you control this in Account Settings) - Improve our algorithms and Service quality using aggregated, anonymized data - Detect and prevent fraud or abuse

4. Data Processing and Storage

4.1 Where Your Data Is Stored

• Application server: Railway (cloud hosting, US-based)
• Database: PostgreSQL (Railway-managed)
• Activity files: Railway persistent volume
• Geospatial data: Amazon Web Services S3 (US East)

4.2 Geospatial Data Sources

We query several datasets to classify terrain for your routes:

These queries use your GPS coordinates. The coordinates are processed in real-time and are not shared with or stored by these services.

4.3 Third-Party Services

• Strava: Activity data sync (governed by Strava's Privacy Policy)
• Resend: Transactional email delivery
• Sentry: Error tracking (may receive anonymized error context)
• Anthropic: AI coaching insights (activity summaries only, no raw GPS data)

5. Data Sharing

We do not sell your personal data. We may share data only in these circumstances: - With your consent: Coach-athlete relationships you explicitly authorize - Service providers: Third-party services listed in Section 4.3, bound by confidentiality agreements - Aggregated data: We may share anonymized, aggregated statistics that cannot identify you - Legal requirements: If required by law, court order, or governmental authority

6. Data Retention

• Your data is retained for as long as your account is active.
• Strava activity files are stored on our servers to enable offline analysis.
• You may disconnect Strava at any time; this stops new data from syncing but does not delete previously synced data.
• You may request complete account and data deletion by contacting us.
• Upon deletion request, personal data is removed within 30 days.

7. Your Rights

You have the right to: - Access: View your data through the Service dashboard - Correction: Update your email and password in Account Settings - Deletion: Request deletion of your account and data - Portability: Export your activity data and race plans - Opt-out: Disable daily digest emails in Account Settings or via unsubscribe links - Disconnect: Remove Strava integration at any time through Account Settings

8. Security

We implement industry-standard security measures including: - Passwords hashed with bcrypt (one-way, salted) - CSRF protection on all forms - Rate limiting on login attempts - HTTPS encryption for all data in transit - Server-side session management

9. Cookies and Local Storage

We use browser local storage to: - Cache your activity data for faster page loads - Store dashboard preferences - Track whether you've dismissed the Getting Started guide

We do not use third-party tracking cookies.

10. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use after notification constitutes acceptance.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at: willtoruncoaching@gmail.com