Privacy Policy

Summary

• RunToMax is for adults aged 18 and older. Its age gate stores only the eligibility result, policy version, and confirmation time.
• No account is required. Optional Sign in with Apple account sync is available in version 1.3.5 and described below; no email login or password is required.
• Workouts, GPS routes, heart rate, and health history are stored in Apple Health and local app storage. When optional account sync is offered and enabled, a selected training archive is also stored by RunToMax using Cloudflare, without raw GPS routes.
• Basic recording is free and needs no purchase. Pro is one Apple subscription, offered monthly or annually, for ongoing coaching, including optional cloud coaching. An Apple free trial may be available to eligible subscribers.
• Cloud coaching is off until you explicitly opt in. It sends a minimized summary through a RunToMax proxy to Google Gemini; the app does not contact Gemini directly in production.
• Optional product and coaching analytics are off until you opt in. RunToMax uses PostHog US Cloud with IP geolocation disabled and does not send exact workout or health values.
• Garmin Connect is not included in App Store version 1.3.5. In supported later test builds, the integration is optional: you can connect your account, send your chosen running workouts to Garmin Connect and separately opt in to importing new Garmin runs and, separately, last night’s sleep, resting heart rate and overnight HRV for your readiness. Other all-day health data is not imported. See the Garmin disclosure below.
• App Store version 1.3.5 has no public Strava integration, RevenueCat, Lifetime purchase, advertising, or IDFA. Website analytics is optional.

Who we are

"RunToMax," "we," "us," and "our" refer to Hidai Bar-Mor, an individual sole developer who develops and operates the RunToMax iPhone and Apple Watch application. Contact: hidai25@gmail.com.

Data the app processes

Health and fitness data (Apple HealthKit)

With your permission, RunToMax reads data needed for its training and recovery features, including workouts, workout routes, heart rate, active energy, distance, steps, running speed, body mass, resting heart rate, stride length, vertical oscillation, ground contact time, heart rate variability, sleep, VO₂ max, and running power. RunToMax writes workouts and related samples that it records back to Apple Health.

RunToMax does not use HealthKit data for advertising or sell it to data brokers. You can review or revoke Health access in iOS Settings → Privacy & Security → Health.

Location and routes (Core Location)

During an outdoor workout, RunToMax processes precise GPS coordinates, elevation, speed, and the resulting route. Location is used only while you are using the app or actively recording a workout. It is not used to track you outside an active workout. Completed routes are stored in Apple Health as part of the workout.

Profile and training settings

Details such as your first name, avatar, birth year, biological sex, body mass, heart-rate settings, race goals, plan answers, shoes, and unit preferences are stored locally in an Apple App Group shared by the iPhone app, Watch app, and widgets. When optional account sync is offered and enabled, selected settings and health-profile values are included in its archive as described below; your profile first name and avatar are excluded.

A profile birth year is optional physiology data for heart-rate-zone and calorie calculations. It is separate from the adult-eligibility check. The eligibility check does not ask for or retain a date of birth; it records only whether you confirmed you are 18 or older, the policy version, and the confirmation time.

Account sync (optional)

Account sync is available in App Store version 1.3.5 and is off until you choose to connect. The following describes this optional feature. You can use RunToMax without a sync account. A French version of this disclosure is available below.

Choosing Continue with Apple beside the sync explanation gives your consent to save the training data described here with RunToMax for recovery after reinstalling or changing phones. This includes your explicit consent to sync health data. Uploads then run automatically when connectivity and iOS scheduling allow; you do not approve each upload. Health access, optional analytics, and AI coaching have separate permissions. Enabling sync does not enable either analytics or AI coaching, and recovery does not restore those permissions on a new phone.

The archive includes workout details and summaries, workout heart-rate measurements, pace, cadence, elevation, splits and intervals, training plans and progress, effort ratings, selected settings, and short workout stories and saved coaching decisions, including accepted plan changes. The health profile includes saved weight, birth year, biological sex, maximum, resting and threshold heart-rate settings, threshold pace, and manual VO₂ max. Saved training-intake answers about breaks, discomfort or returning from injury, training days and goals, units, supported Watch preferences, shoes, and workout or plan labels are also included.

Sync excludes raw GPS coordinates and routes, the profile first name, avatar and Contacts data, sensor diagnostic logs, Apple Weather readings, separate archives of daily HRV, resting-heart-rate and sleep readings, and detailed reasons behind historical coaching decisions. Saved resting-heart-rate and other physiological profile settings remain included. This is not a copy of your complete Apple Health database. Recovery restores the latest completed sync; an unfinished upload or data lost before sync was enabled may not be recoverable.

Sign in with Apple supplies the identifier used to reconnect to your account. We do not request your name or email from Apple. A protected account identifier derived from that Apple identifier, account and consent records, encrypted Apple credentials, session records and short-lived request-limit counters support authentication and security. The account identifier is still linked to you; hashing it does not make your training anonymous. Sign in with the same Apple account to recover your saved history.

Cloudflare processes and stores sync data on our behalf. The service uses HTTPS and encrypts training objects, the archive index and Apple refresh credentials before storage. The RunToMax service holds the keys and can decrypt this data for authenticated recovery; this is not end-to-end encryption. Training objects and the account database use Cloudflare storage configured for the European Union. Cloudflare Workers and associated security processing can operate globally, so EU storage does not mean that all processing occurs in the EU. See Cloudflare's Privacy Policy and Data Processing Addendum, including its international-transfer safeguards. We use synced data for training-history recovery and operating and securing sync, not advertising, tracking, product analytics, or training AI models. This sync service does not send the archive to Google or PostHog.

Turn off Automatic sync in Settings → Account & sync to withdraw consent to new uploads. Your last saved history stays in the account until you delete it. Delete sync account removes the server history while keeping training on this phone. Delete My Data also removes local app data, with a separate choice for RunToMax workouts in Apple Health. Neither action cancels an App Store subscription. Uninstalling the app alone does not delete a sync account.

When the service accepts an account-deletion request, it blocks normal account access and further uploads before cleanup. If cleanup or Apple credential revocation fails, deletion remains pending and is retried; the app shows that status. After successful cleanup, minimal account deletion records are retained to prevent late uploads from recreating data. Their removal is targeted for 90 days after completion, subject to a successful final cleanup check. Pending cleanup records and credentials needed for revocation remain until those retries succeed; 90 days is not a maximum for unresolved failures. Completed deletion records contain no workout archive. During normal sync, training objects more than seven days old that are no longer referenced by the current archive are eligible for cleanup.

Cloudflare's database recovery history can retain earlier database records for up to 30 days, depending on the Cloudflare plan, after they are removed from the live database. Those recovery records are separate from the live service and do not make deleted training objects available through the app. This database window is not a promise about physical erasure of every provider-managed storage copy. For access, correction, a copy of your sync data or deletion help, contact hidai25@gmail.com.

Garmin Connect (optional, later test builds)

This section applies when Garmin Connect is offered in your build. It is not available in App Store version 1.3.5.

An optional connection lets you send selected RunToMax running workouts and scheduled dates to your Garmin Connect account for use on compatible devices, and, if you choose, import your new Garmin runs into RunToMax. Visiting the authorization callback page on its own does not connect an account or send any workouts.

You choose whether to connect Garmin Connect and which workouts to send. We explain this transfer before authorization. Garmin handles your sign-in and permissions; RunToMax never requests or receives your Garmin password. The connection is associated with your authenticated RunToMax account. Connecting does not enable cloud backup, product analytics or AI coaching, and connecting alone does not upload a training plan.

For authorization, our service processes an internal RunToMax account identifier, consent version and time, short-lived authorization codes and security values, Garmin's user identifier, granted permissions, and access and refresh credentials. We store a protected identifier to associate the connection with you, permission and connection status, and encrypted credentials. These records are account-linked, not anonymous. Authorization codes are used for exchange and are not retained in our application database or application logs. Temporary connection attempts expire after ten minutes and are removed by scheduled cleanup.

When workout delivery is enabled and you approve a send, the data sent to Garmin consists of the workout name and description, running steps such as warm-up, intervals and recovery, prescribed duration or distance, selected pace or heart-rate targets, and scheduled calendar dates. These targets can reflect your training settings. Delivery also requires records of the corresponding RunToMax session, Garmin workout and calendar identifiers, and send or update status. It does not require sending your raw workout history, GPS routes, sleep, HRV or other raw HealthKit samples. Historical backfill is not imported.

You can separately enable Import Garmin runs. After your watch syncs with Garmin Connect, Garmin sends new running activity identifiers, names, dates, distance, duration, GPS route, heart rate, cadence, running power, device temperature, ascent and descent, recording device and lap boundaries when available. RunToMax uses these to show your runs, prevent duplicate records, match completed runs to your plan and update plan progress. On-device calculations provide training-load and recovery estimates and adapt your plan; RunToMax identifies its own estimates separately from Garmin measurements. Your iPhone downloads available imports while RunToMax is active or when you check for new runs.

Imported activity data is encrypted in temporary Cloudflare storage for up to seven days while your iPhone downloads it. This is a sync buffer, not a history archive. Your local runs remain until you delete them. Turning import off stops new imports and clears retained server activity copies. Disconnecting also stops imports. You can separately revoke Activities permission in Garmin Connect. No historical backfill is included. Read the import details.

You can separately enable Import Garmin health data, which is off by default. With it on, and Daily Health Stats allowed in Garmin Connect, Garmin sends daily summaries after your watch syncs. RunToMax keeps three values from them, with their dates: last night’s time asleep, your resting heart rate and your overnight HRV average. Steps, stress, Body Battery, respiration, Pulse Ox, sleep stages and every other value in those summaries are discarded on receipt and never stored. RunToMax uses the three values on your iPhone for your morning readiness and recovery tiles when Apple Health has no value for that night; each source keeps its own baseline. The values are encrypted in the same temporary Cloudflare storage for up to seven days while your iPhone downloads them, then kept on your iPhone. Turning health import off, disconnecting, or revoking Daily Health Stats in Garmin Connect stops new health imports and clears the server copies and the health values on your iPhone. Health values are not included in account backup.

Cloudflare hosts the RunToMax authorization and delivery backend and processes and stores connection records on our behalf. Traffic uses HTTPS; stored authorization credentials are encrypted with keys held by our service, which can decrypt them to operate the connection. This is not end-to-end encryption. Cloudflare may process network and security information, including IP addresses, to deliver and protect the service. Our callback uses no advertising, analytics scripts or tracking cookies, and application request-URL logging is disabled to avoid recording authorization parameters. Cloudflare processing may occur globally. See its Privacy Policy and Data Processing Addendum.

Garmin receives the workouts and calendar dates you choose to send and operates your Garmin Connect account as an independent data controller under its Garmin Connect Privacy Policy. Cloudflare and Garmin support the connection and delivery service. Optional maps and weather send the needed coordinates or region to Apple. Choosing terrain for a flyover sends tile coordinates covering the route area to AWS. A run image, video or activity file is shared only with the destination you choose and includes Garmin source attribution. These recipients do not receive Garmin connection credentials. See the map, weather and flyover disclosures in this policy. Connection credentials and identifiers are not sent to Google Gemini, PostHog, advertising services or data brokers, and neither are Garmin activity records: Garmin data is processed by AI only on your iPhone, as described under Garmin data and AI. If you separately enable RunToMax account backup, local imported-run records may be included under the account-sync disclosure; connection credentials are excluded. We do not sell Garmin user data.

Garmin data and AI. RunToMax never sends Garmin data, or results derived from it, to Google Gemini or any other cloud AI provider. AI processing of Garmin data is off unless you turn on “Apple Intelligence with Garmin data” in RunToMax. With that explicit consent, Apple’s on-device model (Apple Intelligence) writes your daily brief and run analysis from your Garmin runs and figures derived from them (pace, distance, heart rate, laps, cadence and training load) and, if you turn on Garmin health import, last night’s sleep, resting heart rate and HRV, on your iPhone; the data does not leave the device for this. Neither RunToMax nor Apple uses Garmin data, or the answers written from it, to train, test, evaluate or improve AI models, and we build no AI dataset or knowledge base and keep no logs or quality measurements of those answers. You can withdraw this consent at any time in RunToMax Settings → Privacy or on the Garmin Connect screen; disconnecting Garmin withdraws it too. Without it, or on an iPhone without Apple Intelligence, personalized coaching on Garmin data stays unavailable; on-device guidance and plan progress remain available, and disconnecting or deleting one run does not remove Garmin contributions from saved training context. Runs recorded with RunToMax on Apple Watch may still use Google Gemini under the AI coaching disclosure. We update this statement when laws, regulations or Garmin’s policies change.

You can withdraw Garmin authorization through your Garmin Connect account settings or in RunToMax Settings → Connections → Garmin Connect. Disconnecting stops new operations. Garmin permission-change notifications stop the affected processing: removing Activities stops imports and clears temporary server activity copies; removing Training stops workout delivery without stopping permitted imports. A Garmin deregistration notification removes connection credentials. Minimal hashed notification records prevent stale events from restoring revoked access; records without a remaining connection grant are eligible for removal after 30 days. Our service requests revocation from Garmin and removes the stored credentials after confirmed revocation. If Garmin is unavailable, encrypted credentials and the minimum pending cleanup records remain for retry until revocation succeeds; contact us for help with an unresolved request. Inactive connection records with no credentials or pending authorization are eligible for removal after 24 hours.

Disconnecting or deleting RunToMax does not automatically erase workouts already transferred to Garmin. You can manage or delete those copies in Garmin Connect under Garmin's controls and retention policies. Disconnecting also does not cancel an App Store subscription. Cloudflare database recovery history may retain earlier database records for up to 30 days, depending on its plan; this is separate from the live database. For access, correction, a copy or export of your connection data, deletion, or withdrawal assistance, contact hidai25@gmail.com. We will update this disclosure and request the necessary permissions before adding materially different processing.

Cloud coaching (optional, included with Pro)

Cockpit and cloud coaching are included in the same Pro subscription; cloud coaching is not a separate subscription. A Pro entitlement alone does not send data. You must also explicitly enable cloud coaching. If you do not enable it—or if the secured service is unavailable—the app uses its deterministic on-device coaching instead.

When enabled, RunToMax prepares a minimized coaching context from finalized, validated facts. It may include pace, heart-rate summaries, cadence, elevation gain, running-form averages, time in heart-rate zones, splits, training load and readiness, sleep and recovery summaries, recent comparable-run summaries, plan context, and weather. The language model is asked to explain those supplied facts; it is not the source of record for distance, pace, splits, recovery, or plan calculations.

The app sends that context over HTTPS to a RunToMax coaching proxy, which checks that the request is well-formed and forwards it to a billing-enabled Google Gemini service. The production app does not contain a Gemini API secret and does not call Gemini directly, so the key cannot be extracted from the app. The proxy does not log or store the prompt or the response; it records status codes and timings only, and it does not keep coaching content in any RunToMax database.

We do not include your name, email address, raw GPS coordinates, route polyline, contacts, photos, or individual heart-rate samples in the coaching request. Google may process the request and limited technical or abuse-monitoring logs under its Gemini API Additional Terms and Privacy Policy. RunToMax uses a paid Gemini service so Google states that prompts and responses are not used to improve its products. Google states that it retains prompts, their context, and responses for 55 days for abuse detection, security, and required legal disclosures. If content is flagged, authorized Google employees may review it.

Google's current Gemini API terms require users of API clients to be at least 18. RunToMax 1.0 is therefore an adult-only product, not merely an app with an adult-only coaching toggle. You can withdraw cloud-coaching consent at any time in Settings → Privacy → AI coaching; future cloud requests stop immediately.

Weather and map services (Apple)

RunToMax may send the coordinate or map region needed to Apple Maps or WeatherKit to render a map, obtain elevation context, or request temperature, humidity, and wind for heat-aware guidance. It does not send your training history or RunToMax identity with that query. See Apple's Weather privacy notice.

3D flyover ground modes (Apple Maps, AWS, Esri)

The 3D flyover replay of a run is available to every user from version 1.3.2. Its ground modes are off by default: nothing is fetched until you choose one in the Flyover view, and fetched tiles are cached on your device. Terrain downloads elevation tiles from the public Terrain Tiles dataset hosted by Amazon Web Services; AWS receives the tile coordinates covering your route — a coarse indication of where you ran — and no identity or training data. Realistic draws Apple Maps satellite imagery around your route inside the app only; it is not included in exported videos, and Apple receives the map region needed to render it, as described above. In versions before 1.3.2 the satellite ground mode requested imagery tiles from Esri World Imagery instead, with the same tile-coordinate request going to Esri.

Subscriptions and the coached-run offer

Basic recording needs no purchase. RunToMax offers Pro as a monthly or annual auto-renewing subscription through Apple StoreKit; Pro includes ongoing coaching and cloud coaching. To offer the three free coached runs once per eligible user, the app keeps a minimal local record of activation, used-run count and completion in protected storage and the device Keychain, mirrored to the paired Apple Watch. That record contains no health values or run identifiers, is separate from your workout history, and is not restored by deleting runs or reinstalling. The app also reads your StoreKit purchase history on the device to check eligibility; it is not sent to RunToMax. Apple processes payment and provides the app with purchase and entitlement status. RunToMax never receives your full card number, billing address, or Apple ID through StoreKit. Optional Sign in with Apple account sync uses a separate account identifier as explained above. The launch build does not use RevenueCat and does not offer a Lifetime purchase.

Bluetooth heart-rate monitors

If you pair a compatible Bluetooth heart-rate monitor, its name and peripheral identifier are stored locally for reconnection. Samples are used during the workout and may be written to Apple Health. Recorded workout heart-rate measurements are included if you enable optional account sync; the monitor name and peripheral identifier are not.

Apple Watch, iPhone, and widgets

WatchConnectivity and the shared App Group transfer workout data and settings between your Apple devices. Widgets read local Apple Health and App Group data. These features do not send your training history to a RunToMax account server.

Workout-detail archives, the per-run records the Apple Watch sends to your iPhone, use iOS data protection and are included in your own iCloud or computer device backup, so restoring that backup can preserve each run's type and analysis. iCloud backups are encrypted. Computer backup encryption is optional; we recommend enabling it. Your backups are controlled by your device and backup settings and are not themselves sent to a RunToMax server. Optional account sync is a separate service for the selected training archive described above. Deleting your data in RunToMax removes these archives from the device; device backups made earlier keep them until you delete or replace those backups. Derived fingerprints, generated coaching caches, imported-run files, RPE ratings, plan execution feedback, and manually entered sleep also use iOS data protection and are excluded from device backups. After reinstalling or restoring a device, that data may be rebuilt from Apple Health or recovered from the Watch where available. Imported runs that were not written to Apple Health may need to be imported again. Apple Health backup and synchronization are controlled separately by Apple and your device settings.

Consent-based product analytics

RunToMax uses PostHog US Cloud only after you explicitly opt in. Analytics may include a random installation identifier, app, build and device information, categorical feature events, and categorical or broad-bucket fitness and coaching events. Examples include workout type, broad completion ranges, training-plan feedback, and whether you confirmed or corrected an interpretation. RunToMax configures PostHog not to use the request IP for geolocation. Autocapture is off, and session replay is disabled in production.

We do not send your name, email, exact pace, distance, heart-rate or sleep values, location, route, workout identifier or workout time, or coaching text to PostHog. You can turn analytics off at any time in Settings → Privacy → Optional analytics. See PostHog's Privacy Policy.

Website

With your consent, this website uses Google Analytics to understand website visits and usage. Google receives information such as pages viewed, browser and device information, approximate location, and referral source. Google Analytics uses cookies to distinguish visits. We do not send your workout or health data to website analytics.

You can accept or reject analytics using the website banner, or change your choice using Analytics settings. If you reject analytics, the Google Analytics tag is not loaded. Withdrawing consent stops future collection and removes first-party Google Analytics cookies. Your choice is stored in your browser. Google may process information outside your country; see Google’s privacy policy. Contact hidai25@gmail.com about website privacy.

Links to the App Store are handled by Apple under Apple's privacy policy.

What App Store version 1.3.5 does not use

• No advertising, IDFA, or third-party advertising trackers.
• No public Strava integration in App Store version 1.3.5; supported TestFlight builds may offer it.
• No RevenueCat subscription processing.
• No Lifetime purchase or separate AI Coaching subscription.
• No RunToMax email/password account. Optional training-history sync with Sign in with Apple is available in version 1.3.5 and requires your opt-in.
• No contacts or calendar access.

Service providers

• Apple — HealthKit, Core Location, Maps (including the flyover's satellite imagery), WeatherKit, StoreKit, WatchConnectivity, Sign in with Apple for optional account sync, and App Store services ( privacy).
• Google — optional website analytics after you accept, and paid Gemini processing, only after an eligible Pro user explicitly enables cloud coaching ( privacy).
• Amazon Web Services — the public Terrain Tiles dataset behind the flyover's Terrain mode, only after you choose it ( privacy).
• Esri — World Imagery for the satellite ground mode in versions before 1.3.2, only after you chose it ( privacy).
• PostHog US Cloud — minimized product analytics, only after opt-in ( privacy).

Cloudflare also provides processing and EU-configured storage for optional account sync, with global service and security processing as explained in the sync disclosure. The optional Garmin Connect service also uses Cloudflare hosting and storage; Garmin receives the workouts you choose to send, as described in the Garmin disclosure.

Retention and deletion

• Deleting RunToMax removes its local settings and cached app data. Workouts in Apple Health remain until you delete them in the Health app. Uninstalling the app does not delete an optional sync account; use Delete sync account or contact us. Sync retention and pending deletion are detailed above.
• The coaching proxy does not maintain a RunToMax training-history account or intentionally persist prompt and response content. Google may keep limited paid-service logs as described above.
• Turning analytics off stops future PostHog events. To request deletion of analytics associated with your random install identifier, contact us.
• Emails you send to us are kept only as long as needed to answer them and handle any follow-up; ask and we delete the thread.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of personal data. Most training data is already under your control on your device. For analytics, cloud-coaching or optional account-sync questions, or to request a copy of data held by RunToMax, email hidai25@gmail.com.

Age eligibility

RunToMax 1.0 is intended only for adults aged 18 and older. We do not knowingly provide the app to or process personal information from anyone under 18, and parental consent does not make an under-18 person eligible for this release. The iPhone app fails closed until an adult eligibility result is established. On iOS 26 or later, you may use Apple's Declared Age Range service, which shares a coarse range rather than a birth date. RunToMax immediately reduces the response to an eligibility result and does not retain the range or its declaration source. If Apple's service is unavailable or declined, the app offers an explicit adult confirmation. The Apple Watch app requires the phone's current eligibility result before a workout can start, and complications hide cached run statistics until that result is current.

If we learn that an under-18 person has used RunToMax or provided data, we will disable access and take appropriate steps to delete data under our control. Contact hidai25@gmail.com for an age-eligibility or deletion concern.

International processing

Apple, Google, PostHog, and Cloudflare may process data outside your country, including in the United States. Their safeguards and transfer practices are described in the policies linked above. RunToMax minimizes what is sent and requires separate opt-in for cloud coaching, product analytics, and account sync. The EU storage configuration for sync does not restrict all Cloudflare processing to the EU; its transfer safeguards are linked in the sync disclosure.

Security

Apple Health protects health and route data on your devices. Network requests use HTTPS. Cloud coaching uses a server-side credential rather than embedding a Gemini secret in the app. The proxy validates request shape, applies a strict body-size ceiling, and uses a capped credential. No system is perfectly secure; if we learn of an incident that requires notice, we will notify affected users as required by law.

Changes to this policy

We may update this Privacy Policy as the product changes. The effective date above identifies the current version. Material changes will be announced in the app or by email when we have an appropriate address.

Contact

Questions, requests, or concerns: hidai25@gmail.com.