Privacy Policy
Peak Days ("we", "us", "our") is a trail-running training app operated by Peak Days, the Netherlands. This policy explains how we collect, use and protect your information when you use our websites and apps (the "Services"). Questions: info@peak-days.com.
1. Information we collect
- Account — your email address (for passwordless sign-in), or the identifier from Sign in with Apple or Google Sign-In, and profile details you provide.
- Training data you create — races, goals, training plans, scheduled sessions and preferences.
- Health & fitness (only with your permission) — your runs and workouts (distance, duration, pace, heart-rate, elevation and route) plus resting heart rate, heart-rate variability and sleep, read from Apple Health or Android Health Connect. This is the primary data your coach and training plan are built from.
- Location (only when you use route suggestions) — your device location at that moment, to generate trail routes near you. Route generation uses the GraphHopper routing service: the start and end coordinates of the routes you request are processed by GraphHopper to build them. We store the routes you keep, not a continuous location history.
- Services you choose to connect — Strava: with your permission we import your Strava activities to display your activities and route maps in the app, and — only with your explicit consent — Peak Days can upload runs you record with Peak Days to your Strava account. Your Strava data is never sent to the AI coach (see section 3). Google: email for sign-in; Google Calendar busy-times for scheduling. Disconnect any of these anytime.
- Usage data — device, app interactions and diagnostics.
2. How we use your information
To provide and personalise your training plans and coaching; to suggest trail routes; to schedule sessions to your calendar; to communicate with you; and to secure and improve the Services. Your health and fitness data is used solely for training, coaching and readiness — never for advertising or marketing, and we never sell it.
Notifications — the app schedules local, on-device notifications (such as your morning briefing) directly on your device. We do not send marketing push notifications.
3. AI coaching (third-party AI)
Your coaching is powered by Anthropic's Claude. To answer your questions and tailor your plan, the relevant training and health data above is sent to Anthropic's API on your behalf and only to generate coaching for you — never for advertising, and never sold. Anthropic acts as our data processor under a data-processing agreement, and your data is not used to train any AI model. We never send your Strava data to the AI coach — a health-data firewall keeps Strava data out of coaching. You can withdraw this at any time by disconnecting your health source or deleting your account.
4. Legal bases (where applicable)
We process personal data under one or more of: performance of a contract, your consent (including explicit consent for health data and for sharing it with our AI processor), our legitimate interests, and legal obligations. You can withdraw consent at any time.
5. Sharing & processors
- Anthropic — AI coaching, as a processor (section 3). Per Anthropic's commercial terms, API inputs/outputs are not used to train their models and are retained only briefly.
- Supabase — hosting (European Union).
- GraphHopper — route generation: the start/end coordinates of routes you request are sent to GraphHopper's routing service to build the route.
- Services you connect (Strava, Google) — under their own terms.
- We do not sell your personal data, and we never use health data for advertising.
6. Where your data is stored
On Supabase infrastructure in the European Union, encrypted in transit (HTTPS). Access is restricted to your own account through database row-level security. We do not store your health data in iCloud.
7. Data retention
We keep personal data while your account is active. If you disconnect a health source, we delete the health data we obtained from it. Deleting your account removes everything, except where longer retention is required by law.
8. Your rights
Depending on your location (e.g. EEA/UK under GDPR), you may have rights to access, correct, delete, port, or restrict processing of your data, and to object or lodge a complaint with a regulator. Delete your account anytime in the app (Profile → Privacy & data → Delete my account). To exercise other rights, contact info@peak-days.com.
9. Security
We use technical and organisational measures to protect your data. No method of transmission or storage is completely secure.
10. Children
The Services are not directed to children under 16, and we do not knowingly collect their data.
11. International transfers
Your data may be processed in countries other than your own (e.g. Anthropic processes in the United States), using appropriate safeguards such as Standard Contractual Clauses where required.
12. Changes
We may update this policy and will post the new version here with a revised date.
13. Contact
Peak Days, the Netherlands. Email: info@peak-days.com.