Privacy Policy

Peak Days ("we", "us", "our") is a trail-running training app made by HeaFitLab B.V., Avenue Ceramique 221, 6221 KX Maastricht, the Netherlands (KvK 42154178). HeaFitLab B.V. is responsible for your information (the “controller”); Peak Days is the name of the product. This policy explains how we collect, use and protect your information when you use our websites and apps (the "Services"). Questions: info@peak-days.com.

1. Information we collect

• Account - your email address (for passwordless sign-in), or the identifier from Sign in with Apple or Google Sign-In, and profile details you provide.
• Training data you create - races, goals, training plans, scheduled sessions and preferences.
• Health & fitness (only with your permission) - your runs and workouts (distance, duration, pace, heart rate, elevation, cadence, calories and route) plus resting heart rate, heart-rate variability, VO2 max and sleep, read from Apple Health or Android Health Connect. This is the primary data your coach and training plan are built from.
• Location - we use your location in the ways below, and only after you allow location on your phone or enter a home address.
  • Your home - if you enter a home address, we store the address and its map coordinates. We use them as the usual start of your routes, for the weather on your Today screen, and to work out your driving time to a trailhead.
  • Runs you record with Peak Days - while you record a run on your phone or Apple Watch, the app follows your position, also when the screen is off, and we store the route of that run with the run.
  • Routes and hills - when you ask for route suggestions or look for hills, the start is your home, your phone’s current position or a point you pick on the map.
  • Weather without a home - if you have not entered a home address, the weather on your Today screen uses your phone’s last known position.
  We store your home, the routes you keep and the routes of your runs. To improve route suggestions we also note how well they worked, with the place rounded to an area about 10 km across. We do not keep a continuous location history outside your runs. The services that help with routes, maps and weather are listed in section 5.
• Weather and elevation - to show the weather on your Today screen, the app sends the area around your home, or around your phone’s last known position, rounded to about 1 km, to Open-Meteo each time the Today screen loads. It never sends the exact spot of your home. To measure the climb of a run correctly, it sends up to 100 points spread along the run’s route, including its start and finish, to Open-Meteo once per run. To aim new routes and find hills, it sends the start point and a ring of points around it. When the AI coach writes about a run you recorded, our server may also ask Open-Meteo once for that day’s weather at the start of the run, with the start point rounded to about 1 km. These requests carry map coordinates and, for the weather of a run, its date. They carry no name, email, account id or heart rate.
• Maps and place search - map images come from Stadia Maps, and the hill shading from the public terrain map of Mapterhorn, on your phone, on your Apple Watch and in the web route builder, where the contour lines and the 3D view come from it too; the Apple Watch draws its contour lines from it as well. When Mapterhorn cannot be reached, the hill shading comes from a public terrain map hosted by Amazon Web Services instead (on the Apple Watch, for that route). To draw a map, your phone, watch or browser asks these services for the map squares of the area on screen, so they can tell roughly which area you are looking at. To name the terrain sources a map shows, your phone and browser also ask Mapterhorn which sources cover that area. During a run with the map open, that area follows you. When a route is on your Apple Watch, the watch downloads the map squares and the terrain squares around it so the map also works without signal. When you type an address or a place, the text is sent to Stadia Maps while you type, to suggest matching places. If Stadia Maps cannot be reached, or in a version of the app that does not use it, the text goes to GraphHopper instead. The place search in the web route builder uses Open-Meteo. When you tap for directions to a trailhead, we open your phone’s map app (such as Apple Maps or Google Maps) at that point.
• Services you choose to connect - every one of these is optional, is connected by you, and can be disconnected at any time in the app at Settings → Watches & devices (your calendar lives one screen over, at Settings → Notifications & calendar). Settings is the gear icon at the top right of the Today screen.
  • Strava - you connect Strava on Strava’s own permission screen, and Strava then sends your activities to Peak Days. For each run we read the date, distance, moving time, elevation gain, average heart rate and map line, and when you open one of those runs we also read its splits with the altitude and heart-rate readings that belong to it. We never see your Strava password. Your Strava data is never sent to the AI coach (see section 3). Strava’s API terms allow us to hold their data only as a short transient cache, so we keep a rolling seven-day window: Strava data older than seven days is deleted automatically, whether or not you disconnect.
    Uploads to Strava: Strava’s permission screen also asks whether Peak Days may upload activities to your Strava account. If you allow that, Peak Days automatically sends each run you record with Peak Days, on your phone or Apple Watch, to your Strava account. When you connect, and each time you open Peak Days, runs you recorded with Peak Days in the last 14 days that are not on Strava yet are sent too. Each upload carries the run’s name and its route, with the time and, where recorded, the elevation and heart rate at each point. To pause this, go to Settings → Watches & devices, tap Strava and choose Stop auto-sending my runs. This choice is kept on this phone only. After you sign out, reinstall the app or use another phone, sending is on again, and at the next app open any runs from the last 14 days that are not on Strava yet are sent, including runs you recorded while sending was off. Turning sending back on with Auto-send my runs to Strava sends them too. To stop uploads for good, disconnect Strava. Runs already uploaded stay on Strava until you delete them there.
    Disconnecting: tap Strava on the same screen and disconnect, or remove Peak Days on Strava under Settings, My Apps. Either one is enough on its own: it revokes our access and deletes the Strava runs we hold, the map lines that came with them and the pace figures worked out from them. If you remove us on Strava’s side, we confirm the deletion to you by email.
  • Suunto - if you connect your Suunto account, Suunto’s cloud notifies us when you finish a workout and we then read that workout from Suunto: its distance, duration, pace, heart rate, elevation and route line, together with the sleep and heart-rate-variability readings your watch records. We also check Suunto for new data from time to time when you open the app, and when you tap Sync now. In the other direction, while Suunto is connected, Peak Days automatically sends your planned runs for today and tomorrow to your Suunto account as SuuntoPlus Guides, and each planned route to your Suunto route library. This happens when you open Peak Days and when your plan changes while the app is open; there is no separate switch for it. A guide carries the session name and description, pace targets, the route and heart-rate targets that we work out from your maximum and resting heart rate. To stop this, disconnect at Settings → Watches & devices → Suunto: we delete the access keys we hold, so we can no longer read from or send to your Suunto account, and we delete the training and health data we obtained from Suunto. Guides and routes already delivered to your Suunto account are stored by Suunto under your account; remove those in Suunto’s own app. To also remove Peak Days at Suunto’s end, do that in your Suunto account.
  • Garmin - Peak Days publishes two of its own apps in the Garmin Connect IQ store. If you install them and pair them using the code the watch displays, the data field sends us its own copy of each run as you record it (position, distance, pace, heart rate, elevation and cadence), and the watch app fetches the session and route you have planned in Peak Days. This link runs between your watch and Peak Days: it does not read your Garmin Connect account, and we hold no Garmin account credentials. To disconnect, unpair at Settings → Watches & devices → Garmin or remove the apps from the watch; unpairing stops the flow and deletes the runs we obtained through it. If instead you simply let Garmin write into Apple Health or Health Connect, those runs are covered by the health bullet above.
  • Google - your email address for sign-in. If you connect Google Calendar, we read the events in the calendars you choose, for the days being planned, and keep only the busy times, so we can schedule your sessions around them. We do not store the events themselves. We also add your planned sessions to your main Google Calendar, each with the session name, its start and end time and, when the session has a route, the start point of that route as map coordinates, and we update those events when your plan changes. When you disconnect, the app deletes the access key we hold, so we can no longer reach your calendar. If your phone is offline at that moment, the key can stay with us, so then also remove Peak Days from your Google account as described below. Events already added stay until you delete them. To remove Peak Days from your Google account, use the list of third-party apps in your Google Account’s security settings.
• What you tell the coach - your chat messages, your morning check-in (how you feel), how hard a run felt, and any aches or injuries you log: where it hurts, how bad it is and since when. We use these to adjust your training and to answer you.
• Notification token - if you turn on the morning notification, the app gets a push token for your phone through Expo (an address that lets notifications reach this phone), and we store it with your account and, from the app’s next update, with the app’s language on that phone, which of our apps it is and its version. The morning notification itself is created on your phone. When a run you recorded arrives, our server sends one notification to your phone through Expo: “Your run is in”, with the run’s distance. To keep those out of your night, we also store your phone’s time zone with your account, from the app’s next update.
• Crash reports and technical data - when the app crashes or hits an error, it sends us a report with the error message, the technical details of where it happened, the app version, whether it runs on iPhone or Android, the last screens you opened and, when you are signed in, your account id. Every service your phone, watch or browser connects to, including those in section 5, sees your IP address (the internet address of your connection).
• App use counts - to see where setup loses people and how the app is used, we count, in our own database and linked to your account: the days you open the app, which setup steps you reach, and whether you said yes or no when the app asked to use Apple Health or Health Connect, to send notifications, or to use your location. Each count also holds a time: when you opened the app (the first and the last time each day), when you reached each setup step (the first and the last time) and when you answered. It carries the app (trail or road), iPhone or Android, and the app version, and no device identifier, no IP address, no location and nothing you typed. It is not shared with anyone else and it is deleted when you delete your account.

2. How we use your information

To provide and personalise your training plans and coaching; to suggest trail routes; to schedule sessions to your calendar; to communicate with you; and to secure and improve the Services. Your health and fitness data is used solely for training, coaching and readiness, never for advertising or marketing, and we never sell it.

Notifications - the morning notification is created on your device. “Your run is in” is sent by our server, at most twice a day and never between 21:00 and 07:00 your time (until the app’s next update, Central European time). In your phone’s settings you can turn off all notifications from Peak Days; the notifications switch in the app’s Settings turns off the morning notification and, from the app’s next update, “Your run is in” too. We keep a record of every notification we decide about: when, its words, the run it was about (when it started, its distance and where it came from) and a short code in place of your phone’s push token. It is deleted with your account and, from the app’s next update, it is in your data export. We do not send marketing push notifications.

3. AI coaching (third-party AI)

Your coaching is powered by Anthropic’s Claude, and only after you agree to AI coaching in the app. To answer your questions and tailor your plan, the relevant training and health data above is sent to Anthropic’s API on your behalf and only to generate coaching for you, never for advertising, and never sold. This includes your name, your chat messages, your morning check-in and any aches or injuries you log, but never the map coordinates of your runs or of your home. Anthropic acts as our data processor under a data-processing agreement, and your data is not used to train any AI model. We never send your Strava data to the AI coach: a health-data firewall keeps Strava data out of coaching. You can stop AI coaching at any time at Settings → AI coaching; after that nothing about you is sent to Anthropic.

4. Legal bases (where applicable)

We process personal data under one or more of: performance of a contract, your consent (including explicit consent for health data and for sharing it with our AI processor), our legitimate interests, and legal obligations. You can withdraw consent at any time.

5. Sharing & processors

• Anthropic - AI coaching, as a processor (section 3). Per Anthropic’s commercial terms, API inputs and outputs are not used to train their models and are retained only briefly.
• Supabase - hosting of our database and sign-in (European Union).
• GraphHopper - routes and place names. Receives the start point of each route you ask for (often your home) and the points the route must pass; single points on a route, to look up the name of the place; the address you typed, when Stadia Maps cannot be reached or is not used; and the coordinates of your home and a trailhead, to work out your driving time. These requests come from our servers and carry no name, email or account id.
• Open-Meteo - weather and elevation. Receives map coordinates and search text only, with no name, email or account id: the area around your home, or around your phone’s last known position, rounded to about 1 km, for the weather on your Today screen; up to 100 points along each run’s route, to correct its climb; the start of a route you ask for and a ring of points around it; the start of a run you recorded, rounded to about 1 km, with its date, when the AI coach writes about that run; and the text you type into the place search of the web route builder.
• Stadia Maps - map images in the app, on the Apple Watch and in the web route builder, and the address search when you type your home or a start point. Receives the map squares of the area you are looking at, which during a run is the area around you, and the text you type into an address search.
• Amazon Web Services - hosts the public terrain map we use for hill shading when Mapterhorn cannot be reached. Receives the map squares of the area you are looking at, each about half a kilometre across or larger, and, when the Apple Watch draws a route’s hill shading from it, the terrain squares around that route.
• Mapterhorn - hosts the public terrain map behind the hill shading on your phone, on your Apple Watch and in the web route builder, the contour lines on the watch and in the builder, and the builder’s 3D view, and the list of which terrain sources cover which area, which the maps read to name the sources they show. Receives the map squares of the area you are looking at, which during a run is the area around you, and the terrain squares around a route on your Apple Watch. Its own privacy policy says it keeps each request’s IP address, the page it came from and the browser’s details for up to 30 days.
• Expo - if you turn on notifications, Expo issues the push token for your phone and delivers the notifications our server sends to it. Receives your phone’s push address from Apple or Google, an install id and the name of our app, and, for each notification our server sends, its title and its line (the run’s distance included).
• Resend - sends our emails. Receives your email address and the email itself: your sign-in codes, the confirmation when you remove Peak Days from Strava, and our answers to your support questions. When you report a coach reply, Resend delivers that reply, with your account id, to our own inbox.
• Netlify - hosts our website and the web route builder. Receives your IP address when you visit, and the email address you enter to hear when the Android beta opens.
• Google Fonts - our website loads its fonts from Google, so Google receives your IP address and the address of the page you opened.
• Strava - while uploads are on, each run you record with Peak Days is sent to your Strava account with its route and the time, elevation and heart rate at each point, and runs from the last 14 days that are not on Strava yet are sent when you open the app (section 1 says when that includes runs you held back). Strava then holds them under its own terms.
• Suunto - while your Suunto account is connected, we automatically send your planned runs for today and tomorrow, with their heart-rate and pace targets and their planned routes, to Suunto, which stores them under your Suunto account.
• Google Calendar - if you connect it, we send your planned sessions to your calendar as events with their name, times and the route’s start point.
• Services you connect (Strava, Suunto, Garmin, Google) - under their own terms.
• Your IP address - your phone, watch or browser contacts Open-Meteo, Stadia Maps, Amazon Web Services, Mapterhorn, Expo, Netlify and Google Fonts directly, so they also see your IP address, as with any internet connection. GraphHopper and Resend are contacted by our servers and do not see it.
• We do not sell your personal data, and we never use health data for advertising.

6. Where your data is stored

On Supabase infrastructure in the European Union, encrypted in transit (HTTPS). Inside the app, database row-level security limits your data to your own account. Our small team can read crash reports and the messages you send to support, to fix problems and answer you. We do not store your health data in iCloud.

7. Data retention

We keep personal data while your account is active. If you disconnect a source, we delete the data we obtained from it: that applies to Apple Health, Health Connect, Strava, Suunto and the Garmin watch pairing alike. Strava data is additionally deleted on a rolling seven-day cycle even while you stay connected, as described in section 1. Runs you imported yourself from a file, and runs recorded by Peak Days itself, are your own records and stay until you delete them or delete your account. Deleting your account removes everything, except the two kinds of record below and where longer retention is required by law. Crash reports stay after you delete your account, without your account id: they are our record of what went wrong in the app. Messages you send to our support, and coach replies you report to us, stay in our support inbox with your email address and the text of the message.

8. Your rights

Depending on your location (e.g. EEA/UK under GDPR), you may have rights to access, correct, delete, port, or restrict processing of your data, and to object or lodge a complaint with a regulator. Delete your account anytime in the app: open Settings (the gear icon on the Today screen), scroll down, tap Delete account and confirm twice. To exercise other rights, contact info@peak-days.com.

9. Security

We use technical and organisational measures to protect your data. No method of transmission or storage is completely secure.

10. Children

The Services are not directed to children under 16, and we do not knowingly collect their data.

11. International transfers

Some of the services in sections 3 and 5 are companies based outside the European Economic Area, so what they receive can be processed outside it. Anthropic, Stadia Maps, Amazon Web Services (the terrain map is stored in the United States), Expo, Netlify, Resend, Google and Strava are based in the United States. Supabase is a United States company too, although our database is stored in the European Union (section 6). Open-Meteo is based in Switzerland. Mapterhorn delivers its terrain map through Cloudflare, a United States company.

12. Language

The Peak Days app is available in English, French, German, Dutch and Spanish, and follows your phone’s language. Some parts stay in English for everyone at launch, whatever language your app is set to: the email carrying your sign-in code, the Apple Watch app, the web route builder at app.peak-days.com, and the workout text we send to a Suunto or Garmin watch (the session name, its steps and its description). Whatever the language, the wording never changes what we collect or what we do with it. Questions in any of those five languages are welcome at info@peak-days.com.

13. Changes

We may update this policy and will post the new version here with a revised date.

14. Contact

HeaFitLab B.V. (Peak Days), Avenue Ceramique 221, 6221 KX Maastricht, the Netherlands (KvK 42154178). Email: info@peak-days.com.