Privacy Policy

1. Who Controls Your Data

RunningOptimization is currently operated by an individual based in Slovenia and is not currently operated through a registered company.

For purposes of applicable data-protection law, the operator of RunningOptimization acts as the data controller for personal data processed through the service.

Privacy and data-protection requests can be submitted through the contact method provided within RunningOptimization.

2. Information We Collect

2a. Newsletter And Free Guides

Newsletter signup is available on the Free 5K Plan page through a signup form provided by beehiiv, our newsletter service provider.

When you subscribe, the email address you enter is collected and processed by beehiiv on our behalf in order to deliver the free 5K training plan and the RunningOptimization newsletter. The form includes its own consent confirmation, and beehiiv may send a confirmation email before the subscription becomes active.

You can unsubscribe at any time using the unsubscribe link in any newsletter email. Your newsletter email address is not used for your RunningOptimization account or workout analysis.

The free 5K training plan also remains available as a direct download on the Free Guides page, without providing an email address.

2b. Abuse Prevention

To prevent automated abuse of the Workout Analyzer, each AI analysis request is recorded with a timestamp and either your account identifier (if signed in) or a one-way, salted hash of your IP address (if not signed in). The raw IP address is not stored. Records older than 48 hours are removed when a subsequent AI quota check runs; this is not scheduled cleanup, so records may remain longer during inactivity.

3. Why We Process Your Information

We process information where necessary to:

• Create and maintain your RunningOptimization account
• Authenticate users and protect accounts
• Store training information submitted by users
• Generate personalized running and training analysis
• Provide requested features
• Maintain the security and functionality of RunningOptimization
• Respond to support or privacy requests
• Comply with applicable legal obligations

The legal bases we rely on are:

• Performance of a contract or steps taken at your request (GDPR Art. 6(1)(b)) — creating and maintaining your account, storing the workouts you choose to save, and producing the analyses you request
• Explicit consent (GDPR Art. 6(1)(a) and, for health-related data, Art. 9(2)(a)) — processing the workout and heart-rate data you enter to generate an analysis, and newsletter subscription
• Legitimate interest (GDPR Art. 6(1)(f)) — keeping the service secure and preventing automated abuse of the Workout Analyzer
• Legal obligation (GDPR Art. 6(1)(c)) — where processing is required by applicable law

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

3a. Health-Related Data And Explicit Consent

Heart-rate and exertion data can reveal information about your health. Where the information you enter constitutes special-category (health) data under GDPR Article 9, RunningOptimization processes it only with your explicit consent (Article 9(2)(a)).

The Workout Analyzer asks for this consent every time you run an analysis, through a separate checkbox that is never preselected. The checkbox explains what is processed and why, and no analysis runs without it.

If you are signed in, we record your consent state together with the version of this Privacy Policy it refers to, so we can demonstrate when and for which policy version consent was given. If you use the analyzer without an account, consent is requested per analysis and no standing consent record is stored.

The current Privacy Policy version is 2026-11-11.

You can withdraw consent at any time from your dashboard (Privacy consent section). After withdrawal, every new analysis requires a fresh affirmative consent. Withdrawing consent does not delete data you have already saved; use account deletion for that, which removes your saved workouts, splits, analyses and consent records.

4. AI And Training Analysis

RunningOptimization may use automated or artificial-intelligence-assisted systems to analyse information you submit and provide personalized running insights, explanations or recommendations.

When you request an AI insight, the workout information you entered and the metrics calculated from it are sent to an external AI model provider — currently a Google Gemini model — accessed through the Lovable AI gateway, to generate the written interpretation. Your email address and account details are not included in this request.

The resulting information is intended for educational and informational purposes.

AI-generated analysis can contain errors and should not be treated as medical advice, diagnosis, treatment or a substitute for advice from an appropriately qualified professional.

RunningOptimization does not use your training information to make decisions producing legal or similarly significant effects about you.

5. How Your Information Is Stored

RunningOptimization currently uses Supabase to provide database and authentication infrastructure.

Information necessary to operate your account and the RunningOptimization service may therefore be processed by Supabase on behalf of RunningOptimization.

Supabase maintains a Data Processing Addendum addressing processing under GDPR and related data-protection laws.

RunningOptimization does not sell your personal or training information.

6. International Data Processing

Depending on the infrastructure configuration and service providers involved, personal data may be processed in countries outside your country of residence.

Where GDPR requires safeguards for international transfers, appropriate transfer mechanisms will be used.

7. Data Retention

We retain account and training information only for as long as necessary to provide RunningOptimization, fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes and protect the service. In practice:

• Account information and your saved workouts, splits and analyses are kept until you delete your account.
• Consent records are kept while your account exists, so we can demonstrate valid consent; they are removed with account deletion.
• A minimal account-deletion record is retained after deletion begins: your account identifier (UUID) and the deletion-start timestamp. This is potentially pseudonymous personal information, not anonymous data. It contains no email address, workout data or consent details.
• Abuse-prevention records (timestamp plus account identifier or salted IP hash) are removed after 48 hours, as described in section 2b.
• Newsletter subscription data is kept by beehiiv until you unsubscribe.

The account-deletion record prevents delayed or stale requests from recreating consent data, including when deletion must be retried. The current protection requires indefinite retention: there is no scheduled expiry or automatic removal. Records can be removed only after a replacement protection has been verified to reject all writes for deleted accounts, including delayed transactions, and retention is no longer necessary. No existing deletion records have been removed.

The operator must confirm the applicable legal basis and assess the necessity and proportionality of this retention with appropriate legal advice. A legal basis for these deletion records has not yet been confirmed; this policy does not claim that indefinite retention is GDPR compliant. Contact us about access, objection or erasure requests; each request must be assessed without disabling the protection against data recreation.

If you request deletion of your account, we will delete or anonymize associated personal information where required, subject to information that must legitimately be retained for legal, security or other permitted purposes.

8. Your Rights

If GDPR applies to you, you may have rights including the right to:

• Access your personal data
• Correct inaccurate or incomplete information
• Request deletion of your personal data
• Restrict certain processing
• Object to certain processing
• Receive certain information in a portable format
• Withdraw consent where processing relies on consent
• Lodge a complaint with the competent data-protection supervisory authority

Privacy and data-protection requests can be submitted through the contact method provided within RunningOptimization.

We may need to verify your identity before completing certain requests.

9. Analytics And Advertising

RunningOptimization currently does not use Google Analytics, Meta Pixel or similar third-party advertising or behavioral analytics systems.

If analytics, advertising or tracking technologies are introduced in the future, this Privacy Policy and any required consent mechanisms will be updated before those technologies are used where required by law.

10. Cookies And Necessary Technologies

RunningOptimization may use cookies or similar technologies that are technically necessary for authentication, security, session management and operation of the service.

Non-essential analytics or advertising technologies will not be introduced without providing appropriate information and consent controls where required.

11. Security

We take reasonable technical and organisational measures intended to protect personal information against unauthorized access, disclosure, alteration, destruction or loss.

However, no internet-based service can guarantee absolute security.

Users are responsible for keeping their login credentials secure.

12. Children

RunningOptimization is not intended to knowingly collect health or training information from children where parental or guardian consent would be legally required.

If we become aware that personal information has been collected from a child without the required authorization, we will take appropriate steps to address it.

13. Changes To This Privacy Policy

We may update this Privacy Policy as RunningOptimization develops, new functionality is introduced, service providers change, or legal requirements change.

The current version will be made available through RunningOptimization with its latest revision date.

14. Contact

For questions about this Privacy Policy, personal data, or your privacy rights: Reach us on Instagram at @runningoptimization. A dedicated contact email address is being set up and will be published here.

RunningOptimization — Operator: Matej Zatler — Country: Slovenia.