Privacy Policy

1. Data controller

RunPlan operates the service. Privacy, access, correction and deletion requests may be sent to privacy@runplan.ru.

2. Data we process

• account data such as name, email address, password hash, role and profile image;
• training plans, workouts, pace, distance, duration and comments;
• coach–athlete relationships, daily reports and plan chat messages;
• session and security data required to authenticate users and protect the service;
• when notifications are enabled: the push-subscription endpoint, delivery keys, browser or device type and notification preferences;
• after the user connects Garmin Connect: connection identifiers, access tokens, activity details, duration, distance, pace, heart rate and device model within the permissions granted by the user.

RunPlan never asks for or stores a user's Garmin Connect password. Authorization is performed by Garmin using OAuth 2.0.

3. Purposes

• provide and display training plans;
• support an athlete's collaboration with a coach selected by the athlete;
• match completed activities to planned workouts;
• display activity results and heart-rate information;
• at the user's request, publish structured workouts to Garmin Connect;
• maintain security, diagnose failures and respond to user requests.

Garmin device-sourced data is not sold, used for advertising or provided to third-party artificial intelligence or machine-learning platforms.

4. Consent and coach access

Garmin access is enabled only after the user provides separate, explicit consent through Garmin's authorization flow. A coach may view an athlete's Garmin-derived results only in the context of their coaching relationship and with the athlete's authorization.

5. Service providers

RunPlan uses Jino infrastructure to host the application, database and transactional email. When Garmin is connected, data is transferred between RunPlan and Garmin only as required for the selected feature. No advertising, analytics, AI or machine-learning provider processes Garmin device-sourced data for RunPlan.

6. Retention and deletion

Account data is retained while the account remains active. Garmin connection tokens and Garmin device-sourced data are retained until the integration is disconnected, the account is deleted or a valid deletion request is received. See Data Deletion.

7. Security

RunPlan uses HTTPS, password hashing, protected server-side sessions and role-based access controls. Integration credentials are kept outside the public web directory. No storage method is completely secure, so RunPlan also limits the data it collects.

8. User rights and changes

Users may request access, correction, restriction or deletion by contacting privacy@runplan.ru from the email address associated with their account. Material updates will be published on this page with a revised effective date.