Privacy Policy

This policy explains what data Zone 2 Running Coach ("the app", "we", "us") collects, why we collect it, how it is used, and the choices you have.

The app is operated by M10N LIMITED, company number 12638508, registered in England and Wales. Our registered office is Salisbury House, London, United Kingdom, EC2M 5SQ.

If anything here is unclear, email stefan@m10n.co.uk.

Who we are

M10N LIMITED is the operator of Zone 2 Running Coach and the data controller for the purposes of UK data-protection law.

Our details are:

• Company: M10N LIMITED
• Company number: 12638508
• Registered office: Salisbury House, London, United Kingdom, EC2M 5SQ
• Email: stefan@m10n.co.uk

What we collect

Account information

When you sign in, we create an account identified by your email address.

We may store profile information that you provide, such as your name, age, preferred distance unit, running goals and heart-rate zones.

Strava activity data

If you connect Strava, we import running activities through Strava's official API.

Depending on what is available for a particular activity, this may include:

• Activity name
• Date and time
• Distance
• Duration
• Moving time
• Pace
• Heart rate
• Elevation
• Per-mile or per-kilometre splits
• Pauses
• Other activity information made available through the authorised Strava connection

We store the access and refresh credentials supplied through the Strava authorisation process so the app can sync on your behalf.

We request only the Strava permissions needed to provide the app's available features.

Health and fitness data

Heart-rate and activity information may constitute health data and special-category personal data under UK GDPR.

We process this information to calculate your training metrics and provide the coaching features you request.

We do not:

• Sell this information
• Use it for advertising
• Share it with data brokers
• Use it to determine eligibility for insurance, employment, credit or essential services

Conversations with the coach

We store the messages you send to the coach and the coaching responses so that your conversation can remain available across sessions.

The app may also store short factual notes relevant to future coaching, such as a race goal, preferred training pattern or recurring issue that you have mentioned.

Technical information

Our infrastructure and hosting providers may process standard technical information as part of operating and securing the service.

This can include:

• IP address
• Device or browser information
• Request logs
• Error information
• Approximate request time
• Security and authentication events

How we use your data

We use relevant personal data:

• To create and manage your account
• To connect and sync your authorised Strava activities
• To calculate available training metrics
• To generate coaching responses
• To keep your conversation and progress available across sessions
• To remember relevant coaching context where that feature is enabled
• To operate, secure and troubleshoot the service
• To respond to support and privacy requests
• To comply with applicable legal obligations

We do not use your personal data for advertising.

We do not sell your personal data.

We do not use personal data submitted to the app to train our own general-purpose artificial-intelligence model.

Legal bases under UK GDPR

We rely on the following legal bases:

• Contract — to create and manage your account and provide the coaching service you request.
• Consent — to connect your Strava account and import authorised activity information. You can withdraw this consent by disconnecting Strava.
• Explicit consent for health data — where heart-rate or related information constitutes special-category health data, we process it with your explicit consent under Article 9(2)(a) UK GDPR. You may withdraw that consent at any time. Withdrawing it may prevent the app from providing heart-rate-based metrics or coaching.
• Legitimate interests — to secure, maintain and troubleshoot the service, where those interests are not overridden by your rights.
• Legal obligation — where we must process information to comply with applicable law.

Withdrawing consent does not affect processing that took place before consent was withdrawn.

Who processes your data

We use a small number of providers to operate the app. They process relevant information on our behalf or provide a service that you have chosen to connect.

Strava

Strava is the source of activity information imported after you authorise the connection. See the Strava Privacy Policy.

Supabase

Supabase provides authentication, database and infrastructure services used to store and manage account and app information. See the Supabase Privacy Policy.

OpenAI

OpenAI processes messages you send to the coach, together with relevant training context, to generate coaching responses. Data submitted through the OpenAI API is not used to train OpenAI's general-purpose models by default. OpenAI may process and retain limited service data in accordance with its applicable API data controls and policies.

We aim to send only the information reasonably required to generate the requested coaching response. See the OpenAI Privacy Policy.

International data transfers

Some service providers may process personal data outside the United Kingdom or European Economic Area.

Where required, we use an appropriate legal transfer mechanism, such as:

• The UK International Data Transfer Agreement
• The UK International Data Transfer Addendum
• Standard Contractual Clauses
• Another legally recognised transfer safeguard

Disconnecting Strava

Disconnecting Strava stops the app from importing new activities and removes its ongoing ability to access your Strava account.

Disconnecting Strava does not necessarily delete activity information that has already been imported into Zone 2 Running Coach.

You can remove previously imported information by initiating account deletion or contacting us.

You can also revoke access through Strava under Settings → My Apps.

Automated coaching

The app uses automated systems, including artificial intelligence, to analyse relevant training information and generate coaching responses.

These responses are general fitness guidance. They are not medical decisions and are not used by us to determine eligibility for insurance, employment, credit or essential services.

Automated responses may occasionally be inaccurate, incomplete or unsuitable for your circumstances.

Accuracy of connected data

Training information imported from Strava depends on information supplied by Strava, your recording device and any connected sensors.

We cannot guarantee that heart-rate, distance, pace, elevation, pauses or other recorded information is complete or accurate.

How long we keep your data

We keep your account information for as long as your account remains active or as needed to provide the service.

When you delete your account, we delete or anonymise the personal data associated with it, including, where applicable:

• Your profile
• Imported runs
• Activity splits
• Coaching conversations
• Coach notes
• Stored Strava credentials

This is subject to any limited information that we are legally required to retain.

Deleted information may remain temporarily in encrypted backups, security records or provider logs before being removed through the relevant provider's normal deletion cycle. We do not use backup copies for ordinary business purposes.

Your rights

Depending on the circumstances, UK data-protection law may give you the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Request deletion of personal data
• Restrict certain processing
• Object to certain processing
• Receive certain personal data in a portable format
• Withdraw consent
• Complain to the Information Commissioner's Office

You can disconnect Strava through the app or revoke access in your Strava settings.

You can initiate deletion of your account and associated data from within the app.

If you cannot access the app, you can request assistance by emailing stefan@m10n.co.uk from the email address connected to your account.

We may need to verify your identity before acting on a privacy request.

Children

The app is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to the app, contact us so that we can investigate and take appropriate action.

Security

We use reasonable technical and organisational safeguards designed to protect personal data. These may include:

• Encrypted network connections
• Account authentication
• Account-level data separation
• Access controls
• Restricted administrative access
• Security logging provided by our infrastructure suppliers

Where supported and enabled by our providers, stored data is encrypted at rest. No internet service can be guaranteed to be completely secure. You are responsible for protecting access to your device and account credentials.

This website

This marketing and support website does not use advertising cookies, analytics tools or behavioural tracking technologies. Our hosting provider may process routine technical information, including IP addresses, browser details and request logs, to deliver and protect the website.

Changes to this policy

We may update this policy as the app and its services evolve. Material changes will be reflected in the "last updated" date above and, where appropriate, highlighted in the app.

Contact