Privacy
Policy

1. Who we are

Running Workout is operated by Euclide Ltd, a company registered in the United Kingdom, which is the data controller for the personal data described on this page.

For any question about this policy, write to nicolas@runningworkout.fr.

2. Categories of personal data we collect

We collect only what the service needs to work:

• Account: first name, email address, language, and optionally sex, age and the sports you follow.
• Garmin connection: your Garmin user identifier and the OAuth tokens Garmin issues when you authorise Running Workout. We never see your Garmin password. Tokens are stored encrypted.
• Activities imported from Garmin Connect, with your authorisation: date, sport, duration, distance, pace or speed, heart rate, cadence, power, elevation, laps and, when your watch recorded it, the GPS track. If you grant the corresponding Garmin permission: resting heart rate, maximum heart rate and VO2 max estimates.
• Training data you or your assistant enter: maximal aerobic speed, maximum heart rate, weight, height, race goals, constraints, coaching notes, training plans, workouts and their calendar entries.
• AI assistant connections: which assistant you authorised, when, and a log of the tool calls it made on your behalf (tool name, time, outcome and a short excerpt of the answer).
• Technical data: session cookies, server logs, and the first-visit cookie described in section 9.

Heart rate and similar measurements are sports data, but they can reveal information about your health. We collect them only because they are needed to build training sessions at the right intensity, and only after you have given your explicit consent on Garmin’s own consent screen, where each category is listed before you accept. We use them for no other purpose.

What we never collect: payment card data; government identifiers; passwords, API keys or verification codes. You sign in to Garmin on Garmin’s own website: Running Workout never sees or asks for your Garmin password.

Health information: Running Workout is a sports training tool. It does not ask for, and does not need, medical records, diagnoses or treatments. If you choose to tell your assistant about a physical limitation so that your plan takes it into account, it is stored as a training constraint in your own words, which you can end or have deleted at any time.

3. Purposes of use

• to sign you in and keep your session open;
• to show and analyse your training;
• to build workouts and training plans and send them to your Garmin Connect account;
• to answer the requests you make through the AI assistant you connected;
• to send you service messages about your account;
• to keep the service secure and to understand which pages and channels are useful.

When you use Running Workout through an AI assistant (ChatGPT, Claude, Gemini), we receive only the request the assistant sends to our tools — for example the workout to create, a date, a goal or a note you asked it to record. We do not receive your conversation history, and we do not use these requests for advertising or profiling.

Legal bases: performance of the service you asked for; your consent (Garmin authorisation, assistant authorisation, audience measurement); and our legitimate interest in securing and improving the service.

4. Data from the Garmin Connect API

Running Workout uses the official Garmin Connect API under the Garmin Connect Developer Program. With the permissions you grant on Garmin’s consent screen, we read your activities and, if you allow it, your historical data and daily metrics, and we create workouts and calendar entries in your Garmin Connect account.

You choose each permission yourself on Garmin’s screen and can withdraw Running Workout’s access at any time from your Garmin Connect account.

Workouts sent to Garmin: the workouts, plans and calendar entries you or your assistant create are transferred to Garmin and stored in your Garmin Connect account, where Garmin processes them under its own Garmin Connect privacy notice. We ask for your explicit agreement before the first transfer. Do not send data to Garmin Connect if you are not allowed to.

5. Categories of recipients

• Garmin: the workouts and calendar entries you ask us to create are sent to your own Garmin Connect account.
• The AI assistant you connect yourself (for example Claude, ChatGPT or Gemini): when you authorise an assistant and ask it a question, Running Workout returns the data needed to answer — profile, activities, plans, workouts — to that assistant. This happens only for assistants you have authorised, only on your request, and you can revoke each authorisation at any time from your dashboard. The assistant’s provider then processes that data under its own terms and privacy policy.
• Service providers acting on our instructions: OVHcloud (hosting), Backblaze (encrypted backups), Brevo (email delivery) and, only with your consent, Google Analytics (audience measurement). They access data only as far as their service requires and are bound by confidentiality.
• Stripe (payments): if you subscribe to Pro, Stripe and its Link service, merchant of record for the subscription, collect your card details, name and billing address in a secure Stripe form shown on our page (or on their own pages) and process the payment and taxes as an independent controller under their privacy policy. Running Workout never sees your card number; we keep only your Stripe customer identifier, the subscription status and its renewal date.

6. Data retention

• Account, training data and imported activities: as long as your account exists.
• Garmin tokens: until you disconnect Garmin or delete your account.
• Tool-call, authorisation and technical logs: 90 days.
• Encrypted backups: replaced on a rolling basis and kept at most 62 days.
• First-visit cookie: 30 days. Session cookie: the length of your session.

When your account is deleted, all the data attached to it is erased from our database. You can ask for this at any time (see section 8).

7. Where your data is stored

The service is hosted by OVHcloud (OVH SAS) on servers located in France, in the European Union. Nightly backups are encrypted before they leave the server and stored with Backblaze in the European Union; they cannot be read without a key we keep offline.

All traffic between your browser, your assistant and our servers is encrypted with HTTPS/TLS, and Garmin tokens are encrypted at rest.

8. Your controls and rights

You can, at any time:

• revoke an AI assistant’s access from your dashboard — access is cut immediately;
• withdraw Running Workout’s access from your Garmin Connect account;
• correct your profile data in your settings;
• refuse or withdraw audience measurement (section 9);
• delete your account and all its data yourself, at any time, from your Settings (how it works);
• ask for a copy of your data, or for the deletion of your account and all its data, by writing to nicolas@runningworkout.fr. We answer within 30 days.

Under the GDPR and the UK GDPR you have the rights of access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with a supervisory authority (in the UK, the ICO, ico.org.uk; in France, the CNIL, cnil.fr).

Running Workout is not directed at children under 13 and we do not knowingly collect their data.

9. Audience measurement and cookies

We use Google Analytics to measure site traffic and understand which pages are useful. Measurement is active from your arrival and Google places cookies on your browser for this purpose. IP addresses are anonymised.

You can switch measurement off at any time — your refusal is stored locally in your browser and never leaves it:

Turn off measurement

We also use Google Search Console, which measures nothing on the site: it only tells us which search queries lead to it. It places no cookie and loads no script.

Finally, on your first visit the site itself places a cookie named rw_src, kept for 30 days. It only records the name of the site you came from (for example google.com, never the full address or your search), the first page you opened and any campaign parameters in the link (utm_…). If you create an account, this information is attached to it so we know which channels bring new users. It contains no IP address or identifier, is never shared and is not used for advertising.

When you create your account, we also record the country you are connecting from, worked out from your IP address by a geolocation database installed on our own server: no outside service is queried and the IP address itself is not kept, only the country (for example FR). Geolocation: IP Geolocation by DB-IP.

10. Contact

For any question about this policy, or to exercise your rights: