Privacy Policy
Peak Days ("we", "us", "our") is a trail-running training app operated by Peak Days, the Netherlands. This policy explains how we collect, use and protect your information when you use our websites and apps (the "Services"). Questions: info@peak-days.com.
1. Information we collect
- Account — your email address (for passwordless sign-in), or the identifier from Sign in with Apple or Google Sign-In, and profile details you provide.
- Training data you create — races, goals, training plans, scheduled sessions and preferences.
- Health & fitness (only with your permission) — your runs and workouts (distance, duration, pace, heart-rate, elevation and route) plus resting heart rate, heart-rate variability and sleep, read from Apple Health or Android Health Connect. This is the primary data your coach and training plan are built from.
- Location (only when you use route suggestions) — your device location at that moment, to generate trail routes near you. Route generation uses the GraphHopper routing service: the start and end coordinates of the routes you request are processed by GraphHopper to build them. We store the routes you keep, not a continuous location history.
- Services you choose to connect — every one of these is optional, is connected by you, and can be disconnected at any time in the app at Profile → Devices & connections.
- Strava — with your permission we import your Strava activities to display your activities and route maps in the app, and — only with your explicit consent — Peak Days can upload runs you record with Peak Days to your Strava account. Your Strava data is never sent to the AI coach (see section 3). Strava’s API terms allow us to hold their data only as a short transient cache, so we keep a rolling seven-day window: Strava data older than seven days is deleted automatically, whether or not you disconnect. Disconnecting revokes our access and deletes the Strava data we still hold.
- Suunto — if you connect your Suunto account, Suunto’s cloud notifies us when you finish a workout and we then read that workout from Suunto: its distance, duration, pace, heart rate, elevation and route line, together with the sleep and heart-rate-variability readings your watch records. In the other direction, and only for a session you ask us to send, we upload the planned session to your Suunto account as a SuuntoPlus Guide and the planned route to your Suunto route library. To disconnect, go to Profile → Devices & connections → Suunto: that revokes our access, stops the notifications, and deletes the training and health data we obtained from Suunto. Guides and routes already delivered to your Suunto account are stored by Suunto under your account — remove those in Suunto’s own app.
- Garmin — Peak Days publishes two of its own apps in the Garmin Connect IQ store. If you install them and pair them using the code the watch displays, the data field sends us its own copy of each run as you record it (position, distance, pace, heart rate, elevation and cadence), and the watch app fetches the session and route you have planned in Peak Days. This link runs between your watch and Peak Days: it does not read your Garmin Connect account, and we hold no Garmin account credentials. To disconnect, unpair at Profile → Devices & connections → Garmin or remove the apps from the watch; unpairing stops the flow and deletes the runs we obtained through it. If instead you simply let Garmin write into Apple Health or Health Connect, those runs are covered by the health bullet above.
- Google — email for sign-in; Google Calendar busy-times for scheduling. Disconnecting revokes our access.
- Usage data — device, app interactions and diagnostics.
2. How we use your information
To provide and personalise your training plans and coaching; to suggest trail routes; to schedule sessions to your calendar; to communicate with you; and to secure and improve the Services. Your health and fitness data is used solely for training, coaching and readiness — never for advertising or marketing, and we never sell it.
Notifications — the app schedules local, on-device notifications (such as your morning briefing) directly on your device. We do not send marketing push notifications.
3. AI coaching (third-party AI)
Your coaching is powered by Anthropic's Claude. To answer your questions and tailor your plan, the relevant training and health data above is sent to Anthropic's API on your behalf and only to generate coaching for you — never for advertising, and never sold. Anthropic acts as our data processor under a data-processing agreement, and your data is not used to train any AI model. We never send your Strava data to the AI coach — a health-data firewall keeps Strava data out of coaching. You can withdraw this at any time by disconnecting your health source or deleting your account.
4. Legal bases (where applicable)
We process personal data under one or more of: performance of a contract, your consent (including explicit consent for health data and for sharing it with our AI processor), our legitimate interests, and legal obligations. You can withdraw consent at any time.
5. Sharing & processors
- Anthropic — AI coaching, as a processor (section 3). Per Anthropic's commercial terms, API inputs/outputs are not used to train their models and are retained only briefly.
- Supabase — hosting (European Union).
- GraphHopper — route generation: the start/end coordinates of routes you request are sent to GraphHopper's routing service to build the route.
- Suunto — where you ask us to send a session or a route to your Suunto watch, that session or route is transmitted to Suunto and stored under your Suunto account.
- Services you connect (Strava, Suunto, Garmin, Google) — under their own terms.
- We do not sell your personal data, and we never use health data for advertising.
6. Where your data is stored
On Supabase infrastructure in the European Union, encrypted in transit (HTTPS). Access is restricted to your own account through database row-level security. We do not store your health data in iCloud.
7. Data retention
We keep personal data while your account is active. If you disconnect a source, we delete the data we obtained from it — that applies to Apple Health, Health Connect, Strava, Suunto and the Garmin watch pairing alike. Strava data is additionally deleted on a rolling seven-day cycle even while you stay connected, as described in section 1. Runs you imported yourself from a file, and runs recorded by Peak Days itself, are your own records and stay until you delete them or delete your account. Deleting your account removes everything, except where longer retention is required by law.
8. Your rights
Depending on your location (e.g. EEA/UK under GDPR), you may have rights to access, correct, delete, port, or restrict processing of your data, and to object or lodge a complaint with a regulator. Delete your account anytime in the app (Settings, Delete account, then confirm twice). To exercise other rights, contact info@peak-days.com.
9. Security
We use technical and organisational measures to protect your data. No method of transmission or storage is completely secure.
10. Children
The Services are not directed to children under 16, and we do not knowingly collect their data.
11. International transfers
Your data may be processed in countries other than your own (e.g. Anthropic processes in the United States), using appropriate safeguards such as Standard Contractual Clauses where required.
12. Changes
We may update this policy and will post the new version here with a revised date.
13. Contact
Peak Days, the Netherlands. Email: info@peak-days.com.