Privacy Policy & Terms of Service – RUNVIA

Runvia (“the App”) is an AI-powered running assistant that provides training insights, performance analysis, and workout recording. By accessing or using Runvia, you agree to this Privacy Policy and Terms of Service.

PART I – PRIVACY POLICY

1. Data Controller (GDPR)

For the purposes of Regulation (EU) 2016/679 (GDPR), the Data Controller is:

Runvia
Email: fabio.barbieri@runvia.it

The Data Controller determines the purposes and means of processing personal data described in this document.

2. Overview of Data Processing

Runvia follows a Privacy-by-Design approach. We process only the minimum data necessary to:

• Provide AI-powered training insights.
• Maintain secure authentication and cloud synchronization.
• Record in-app GPS workouts during active sessions (including background processing).
• Improve app performance and stability.

3. Location Data and Background Access (Google Play Compliance)

Runvia collects location data to enable fitness tracking, route mapping, and real-time pace analysis even when the app is closed or not in use, but strictly only when a workout recording session is actively running.

• Foreground Service: The App uses a foreground service with a persistent notification to ensure the user is always aware that location tracking is active.
• Purpose: This data is used solely to generate your workout map and activity metrics. It is not used for advertising or shared with third-party brokers.
• User Control: Tracking starts only upon your explicit "Start" command and ceases immediately when you "Stop" or "Save" the session.

4. Sensor Data & Activity Recognition

During an active in-app GPS workout, Runvia may use on-device sensors:

• Android: the ACTIVITY_RECOGNITION permission for step count / cadence when a hardware pedometer is available.
• iOS: Motion & Fitness (Core Motion) for the same purpose, including cadence estimates when GPS is poor.
• Barometer (if present) for elevation; accelerometer for map heading.

This data is processed on the device to improve workout metrics. It is not used for advertising. Summaries may be stored with the activity and synced to your cloud backup if you are logged in.

Optional Bluetooth sensors (heart rate, cadence, power) are used only if you connect them in the app. That is a separate permission from ACTIVITY_RECOGNITION. Health Connect / Apple Health import is described in Section 6.7, not here.

5. Data Retention & Deletion

You can request full account and data deletion at any time by emailing fabio.barbieri@runvia.it. Data stored in Supabase, Strava, Garmin Connect, and Suunto tokens will be purged within 30 days. Apple Health / Health Connect data imported into Runvia will also be deleted from our storage; you can revoke Health access at any time in the iOS Health app or Android Health Connect settings.

6. Data Integration & Storage

6.1 Strava API Integration

With your OAuth authorization, Runvia may access your Strava athlete profile (including Athlete ID) and activity data: activity list and details, GPS/maps, distance, duration, pace, elevation, heart rate, cadence, and related streams. Runvia may also update an activity description on Strava when you choose a coaching/share action that writes back (activity:write).

This data is used for coaching insights, progress tracking, and displaying activities in the app. Use, AI processing (Google Gemini), sharing, storage, disconnection, and deletion follow the same rules as Sections 6.2, 6.3, 6.5, and 5. Strava tokens are stored only to sync on your behalf and are revoked when you disconnect in app settings.

6.2 Supabase – Cloud Backup

Runvia uses Supabase for authentication and automatic cloud backup. Access is restricted via Row Level Security (RLS); only you can access your data.

6.3 Google Gemini AI (third-party AI)

Runvia uses Google Gemini, a third-party AI service operated by Google LLC, to generate coaching replies, workout suggestions, and activity summaries.

When data is sent: only after you tap Allow in the app (the permission dialog the first time you send a coach message or request an AI activity summary; the same explanation is also shown on the first-launch screen). GPS recording, the calendar, and activity history work if you decline.

Who receives it: Google LLC, through the Gemini API, over encrypted HTTPS. Runvia does not sell this data and does not share it with advertising networks or data brokers.

What is sent:

• Messages you write to the coach, and the recent conversation needed to answer.
• Profile saved in the app, such as goals, experience, sex if you provide it, heart-rate zones, and race targets.
• Activities and plans stored in the app: sport, date, distance, duration, pace, elevation, heart rate, cadence, training load, and readiness when those values exist.
• Photos or files you attach to a coach message.
• Data already imported into Runvia from Strava, Garmin, Suunto, Apple Health, or Health Connect, if you connected those sources.

How it is collected: you type it, you record it with in-app GPS, or you import it after authorizing a partner or Apple Health / Health Connect.

Use: to produce the coaching reply, workout suggestion, or activity summary you asked for. Google processes the data as the AI provider under its own terms. Runvia does not use your content to train its own public model.

Your control: you can decline. You can withdraw permission later in the app under Settings → Legal. Withdrawal stops new sends. It does not delete data Google has already processed. To delete data Runvia stores, email fabio.barbieri@runvia.it (see Section 5).

6.4 Analytics

Firebase Analytics collects limited technical usage data to monitor app stability.

6.5 Garmin Connect Integration

With your OAuth authorization, Runvia accesses the following data from your Garmin Connect account:

• Activity data: running activities, GPS coordinates, distance, duration, pace, cadence, and elevation.
• Health metrics: resting heart rate, heart rate variability, stress levels, Body Battery energy monitoring, sleep duration and quality, and SpO2.
• Bidirectional workout sync: Runvia can push structured workouts and training plans to your Garmin device, and receive completed activity data from Garmin Connect.

How we use Garmin data:

• To provide AI-powered coaching insights, performance analysis, training load monitoring, and recovery readiness assessments.
• To display your activity history, workout metrics, and health trends within the app.

Third-party AI processing: Garmin device-sourced data is transmitted to Google Gemini API (see Section 6.3) via encrypted HTTPS to generate personalized coaching insights and training recommendations. This data is not used to train public AI models.

Data sharing: Garmin data is not sold, rented, or shared with any third party other than Google Gemini API as described above. No advertising networks or data brokers receive your Garmin data.

Data storage: Garmin data is stored locally on your device (SQLite database) and backed up to your secure Supabase cloud account (see Section 6.2). Access is restricted via Row Level Security (RLS); only you can access your data.

Disconnection and deletion: You can disconnect your Garmin Connect account at any time from the app settings. Upon disconnection, Garmin OAuth tokens are immediately revoked. You can request full data deletion by emailing fabio.barbieri@runvia.it; all Garmin-related data will be purged within 30 days.

6.6 Suunto Integration

With your OAuth authorization, Runvia may access activity data from your Suunto account (supported workouts, GPS, distance, duration, pace, cadence, heart rate, elevation, and FIT files) and may push structured workouts (SuuntoPlus guides) to your device.

Use, AI processing (Google Gemini), sharing, storage, disconnection, and deletion follow the same rules as Sections 6.2, 6.3, 6.5, and 5. Suunto tokens are stored only to sync on your behalf and are revoked when you disconnect in app settings.

6.7 Apple Health, Health Connect, and Apple Watch

There is no Apple or Google health “account login.” Access is only via system permission dialogs (HealthKit on iOS; Health Connect on Android). You may deny or revoke them at any time.

With your authorization, Runvia may read eligible workouts (running, treadmill, walking, hiking, and similar), associated GPS routes, heart-rate samples, and on Android also distance, steps, and active energy if granted. Runvia does not request menstrual, clinical, or unrelated Health categories.

Imported workouts appear in your activity history and may be used for coaching. If calendar sync is on, WorkoutKit may schedule planned sessions on a paired Apple Watch; that is not a Health archive upload. A watch used as a live remote during an in-app GPS session (pause/resume) is not HealthKit import.

Health and fitness data from Apple Health or Health Connect is not used for advertising or marketing, not sold, and not shared with data brokers. AI, storage, and deletion otherwise follow Sections 6.3, 6.2, and 5. Revoke access in iOS Health (Data Access & Devices → Runvia) or Health Connect permissions, or turn off import in Runvia settings.

PART II – TERMS OF SERVICE

7. Medical Disclaimer

Runvia is not a medical provider. The App provides informational AI-generated suggestions only. Always consult a healthcare professional before starting a new exercise program.

8. Assumption of Risk & Liability

Running involves inherent physical risks. You voluntarily assume full responsibility for injuries. To the maximum extent permitted by law, the independent developer shall not be liable for personal injury, loss of data, or interruptions in third-party API services (Strava, Garmin Connect, Suunto, Apple Health / Health Connect, WorkoutKit, Google, Supabase, Firebase).

🇮🇹 VERSIONE ITALIANA (INTEGRATA)

1. Titolare: Runvia – Sviluppatore indipendente (fabio.barbieri@runvia.it).
2. Posizione in Background: Runvia raccoglie i dati sulla posizione per consentire il monitoraggio dell'attività e la mappatura dei percorsi anche quando l'app è chiusa o non in uso, ma esclusivamente durante una sessione di allenamento attiva avviata dall'utente.
3. Dati Trattati:
   • Backup cloud (Supabase): backup automatico per la persistenza dei dati.
   • Strava: previa autorizzazione OAuth, profilo atleta, attività (GPS, ritmo, cadenza, FC) e, se richiesto, aggiornamento della descrizione dell’attività su Strava. Dettaglio: sezione 6.1.
   • Garmin Connect: previa autorizzazione OAuth, attività (GPS, ritmo, cadenza, dislivello), metriche di salute autorizzate (es. frequenza a riposo, HRV, stress, Body Battery, sonno, SpO2) e sincronizzazione bidirezionale degli allenamenti. Dettaglio: sezione 6.5 (versione inglese).
   • Suunto: previa autorizzazione OAuth, attività (GPS, ritmo, cadenza, FC, FIT) e invio di allenamenti strutturati (guide SuuntoPlus). Dettaglio: sezione 6.6.
   • Apple Health / Health Connect: previa autorizzazione di sistema, import di allenamenti compatibili, tracciati e frequenza cardiaca. Apple Watch: pianificazione allenamenti con WorkoutKit. I dati Health non sono usati per pubblicità. Dettaglio: sezione 6.7.
   • Sensori: in una sessione GPS, ACTIVITY_RECOGNITION (Android) e Motion (iOS) per passi/cadenza; barometro per il dislivello. Fasce BLE solo se collegate. Health: sezione 6.7.
   • AI (Google Gemini, Google LLC): solo dopo il consenso in app, e solo quando invii un messaggio al coach o chiedi un riassunto attività. Vengono inviati, in HTTPS, i messaggi al coach e la conversazione recente, il profilo salvato (obiettivi, esperienza, sesso se indicato, zone di frequenza cardiaca, gare), attività e piani (sport, data, distanza, tempo, ritmo, dislivello, FC, cadenza, carico, readiness se presenti), foto o file allegati, e i dati già importati da Strava, Garmin, Suunto, Apple Health o Health Connect se collegati. Finalità: risposte del coach, proposte di allenamento e riassunti. Runvia non vende questi dati. Il consenso si revoca in Impostazioni → Legale: si interrompono i nuovi invii. Dettaglio: sezione 6.3.
4. Responsabilità: Runvia non fornisce consulenza medica. L'utente si assume ogni rischio. Lo sviluppatore non risponde di infortuni o malfunzionamenti di servizi terzi (Strava, Garmin Connect, Suunto, Apple Health / Health Connect, WorkoutKit, Google, Supabase, Firebase).
5. Diritti: cancellazione dell’account scrivendo a fabio.barbieri@runvia.it. Si può revocare Health in Impostazioni iOS / Health Connect; si possono disconnettere Strava, Garmin e Suunto dalle impostazioni dell’app.