Privacy Policy

This Privacy Policy explains how RunZones (“RunZones”, “we”, “us”) collects, uses and protects your personal data when you use runzones.com and the RunZones service. RunZones is a running analytics and coaching platform operated by its founder, Stephen Scullion. We take your data — particularly your health and fitness data — seriously, and we only collect what we need to run the service.

What we collect

Depending on how you use RunZones, we may hold:

• Account details — your email address. Sign-in is passwordless (a magic link sent to your email), so we do not store a password.
• Training & activity data — distance, duration, pace, heart rate, cadence, power, GPS route/polyline, elevation and timestamps for your runs.
• Training context — your goals, training zones and race results.
• Subscription & billing status — whether you are on the free or paid tier, and your subscription state. Card payments are handled by Stripe; RunZones never sees or stores your full card number.

Why we collect it, and our legal basis

We use your data to provide the service you have asked for: to import your training, calculate your zones, analyse fitness and fatigue, generate coaching reports and plans, and manage your account and subscription.

• Contract — we process your account, activity and billing data to deliver the RunZones service you have signed up for.
• Consent — connecting a third-party account (for example Strava, Garmin or COROS) and importing your health and fitness data happens only with your explicit authorisation, which you can withdraw at any time.

Health & fitness data

Heart rate, GPS routes and related metrics can be considered sensitive personal data. We only import this data when you authorise a connection or upload it yourself, we use it solely to power your analytics and coaching, and we do not sell it or use it for advertising. You can disconnect a data source or delete your data at any time.

Sub-processors we use

To run RunZones we rely on a small number of trusted service providers, who process data on our behalf:

• Stripe — payment processing and subscription billing.
• Strava — OAuth sign-in and activity import, with your authorisation.
• Terra — the wearable data pipeline that syncs Garmin and COROS activities.
• OpenAI — generates the text of your coaching reports (GPT-4o).
• Resend — sends transactional email, including your magic-link sign-in.
• Mapbox — renders the route maps for your activities.
• Supabase — hosts our PostgreSQL database on EU infrastructure.
• Meta — receives advertising conversion events and matching data such as hashed email/account ID, Meta click/browser identifiers, IP address, user agent and the relevant RunZones source page.

Cookies

RunZones uses necessary cookies for sign-in, CSRF protection and administrator support. We also use first-party attribution cookies and the Meta Pixel to understand which advertising led to visits, checkout and purchases. These cookies can include _fbc, _fbp and rz_meta_attribution.

International transfers

Our database is hosted on EU infrastructure. Some of our sub-processors (for example Stripe, Meta and OpenAI) may process data outside the EU/UK. Where that happens, we rely on appropriate safeguards such as the providers’ standard contractual clauses and data-processing terms.

How long we keep your data

We keep your data for as long as your account is active. You can delete your data at any time — RunZones includes a self-service account reset/delete option — or you can email us to request erasure. When you close your account we remove your personal data, except where we are required to retain limited billing records for legal or accounting purposes.

Marketing attribution stored by RunZones expires after 90 days unless refreshed by a new visit. Stripe may retain checkout metadata for billing and fraud purposes under its own retention obligations.

Your rights

Under GDPR and UK GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• port your data to another service;
• object to or restrict certain processing;
• withdraw consent for any connected data source.

To exercise any of these rights, open a support ticket in the app (Help). You also have the right to complain to your local data-protection authority.

Children

RunZones is not intended for children. You must be at least 18 to hold a paid subscription, and at least 16 to use the service at all. We do not knowingly collect data from anyone under these ages.

Changes to this policy

We may update this policy as the service evolves. When we make material changes we will update the date at the top of this page and, where appropriate, notify you by email.

Contact

Questions about your privacy or this policy? Open a support ticket in the app (Help).

This policy is provided for transparency; for formal legal questions contact us through the in-app Help (a support ticket).