Fitness Assistant
Privacy Policy

1. Who we are and the scope of this policy

Running SaaS Development, LLC ("Running SaaS," "we," "us," or "our"), based in Ohio, United States, develops Fitness Assistant. This notice covers Fitness Assistant's web application, related mobile companion or test builds, connection workflows, and fitness-related processing. For our separate company marketing website, see the Running SaaS website privacy policy.

Features and connected providers can differ by test account, version, and approval status. Garmin Connect Developer Program access has not yet been represented as an approved, active production integration; our existing Garmin testing uses a separate user-initiated local pairing approach. We will review the authorization method and update this notice and consent controls before enabling any new Garmin Developer Program integration.

2. Information we collect or create

Account and settings: Information used to establish and protect your account, such as your email address, authentication identifiers, session information, connection status, source-use preferences, notification preferences, and support/deletion requests.

Connected fitness information: When a provider is connected or a file is imported, Fitness Assistant may receive workouts and activity details such as activity dates, exercise type, time, distance, pace, workout sets and repetitions, heart rate, sleep, heart-rate variability (HRV), stress, training load or readiness, recovery measures, steps, calories, and nutrition-related records where available. Detailed activities may include routes or location-linked activity data, depending on the provider record. Availability depends on the provider, permissions, and integration.

Other supported sources: Fitness Assistant currently contains workflows for Garmin, Hevy, and Strava. Strava information may be connected through authorization or a user-provided activities export. Hevy connections may use a user-provided API key.

Information you create: Chat questions and answers, saved conversations, training goals and plans, activity matching decisions, uploaded training-plan documents or extracted contents, preferences, and AI-generated or calculated summaries and insights.

Technical records: Website or app request information, device/browser details, IP addresses, authentication/session events, error and security records, and synchronization status needed to operate and protect the service.

We do not need your Garmin password in the Fitness Assistant website. The existing local Garmin pairing helper is designed to handle sign-in on your device and send reusable connection tokens to our backend; those tokens may be stored for later synchronization. Do not assume that a Garmin Developer Program authorization flow is active until it has been separately announced.

3. Why we process this information

• To authenticate users and maintain their account and source settings.
• To connect user-selected fitness services, synchronize records, and show activity history, charts, personal records, or comparisons.
• To generate training plans, historical analytics, coaching responses, and other insights requested in the application.
• To send optional activity emails where you enable that feature and maintain delivery records to avoid duplicates.
• To troubleshoot errors, prevent abuse, secure accounts, fulfill support and deletion requests, and comply with applicable law.

We do not operate an advertising network through Fitness Assistant or sell connected fitness records to advertisers. We do not claim that fitness measurements can establish a diagnosis or replace professional medical advice.

4. Artificial intelligence transparency — important

AI inputs may include metrics obtained from a fitness provider, such as run details, sleep or recovery summaries, training load, strength workouts, and historical comparisons, together with user-entered goals or questions. Other parts of the application use local calculations or database queries without necessarily submitting every stored record to an AI model.

We do not use your records to train a proprietary foundation model. However, the code review alone cannot establish every third-party AI provider's data retention or model-training practices. These depend on the model route, provider agreements, and configuration. We will verify and document those practices, and any necessary restrictions, before processing data received under the Garmin Connect Developer Program through AI.

Source-use controls in Fitness Assistant allow users to limit whether selected connections are included in chat and other features. Disabling a chat source limits subsequent application use of that source for chat; it does not retroactively withdraw information already processed or erase stored records. Before any new Garmin Developer Program user data is sent to an AI service, we will require a separate explicit opt-in and an accessible withdrawal mechanism. Those Garmin-specific controls are planned and should not be assumed available in the current pilot.

AI-generated coaching may be incomplete or inaccurate. Use independent judgment and consult an appropriate professional for medical concerns.

5. Service providers and disclosures

Our application architecture uses Supabase for authentication and database storage, Render for application hosting, and GitHub Actions for automated synchronization and data-processing jobs. We use OpenRouter and its selected underlying AI model providers for AI responses. Optional activity emails may be delivered through an email service. Connected sources such as Garmin, Hevy, and Strava process information under their own privacy notices and terms.

These providers may process the information necessary to provide their functions. Depending on their infrastructure, data may be processed outside your state or country. We may also disclose information when legally required or to protect the service and its users. We do not publicly post individual fitness histories.

For Garmin's own practices, refer to the Garmin Connect privacy policy. Fitness Assistant is an independent product and is not represented as endorsed by Garmin.

6. Connections, permissions, and disconnection

You choose whether to connect supported fitness providers. The Connections screen provides per-source usage preferences (for example, including a source in chat or analytics) and a disconnection option, subject to some limited-testing restrictions. Strava's connected authorization is revoked as part of its supported disconnection workflow; Garmin and Hevy connection records are removed from our application when disconnection succeeds.

Disconnecting a provider is not the same as deleting data. The current application retains previously synchronized fitness records after a provider is disconnected. To request removal of retained history or the account, use the deletion process below.

A future approved Garmin Connect Developer Program integration will use Garmin's approved authorization and required consent process. You may also manage authorization through Garmin where that capability is available. Revoking access stops future authorized collection, but does not itself guarantee deletion of historical copies held by Fitness Assistant.

7. Data retention and account deletion

Fitness Assistant keeps account information, conversations, synchronized activities, derived analytics, and related settings while the account remains active or as operationally needed. We do not currently specify one universal time-based retention period for each category. Technical logs, emails, and backup copies may be retained according to the relevant provider's operational and legal schedules.

An authenticated user may submit an account-deletion request through the application's Connections → Request account deletion link or through the account deletion page provided by the application. You may also write to support@runningsaasdev.com. The current deletion feature records a request for operator review; it does not immediately delete the account or data automatically. We verify the account and process approved requests, including associated application records and credentials, subject to applicable legal obligations. We will notify you about the outcome as appropriate.

If you only want to stop new provider synchronization while retaining past analysis, disconnect that source. If you want stored fitness information removed, specify the desired deletion in your request. We may need to verify your identity before acting.

8. Security

The service uses authenticated access and user-associated database records, with access controls intended to restrict one user's access to another user's information. HTTPS is used for web connections, and connection credentials are processed by application components needed for synchronization. No system offers absolute security. You should use a strong password, avoid sending passwords or token files in support emails, and promptly report suspected unauthorized access.

9. Your privacy choices and rights

You may ask about personal information we hold, request access, correction or export where applicable, disconnect supported providers, change source usage or email settings, object to certain processing where the law provides that right, or request deletion. Please contact us using the privacy email below. We may require account verification and may have lawful reasons to retain limited records. Additional rights may apply depending on your location.

Withdrawing permission for a provider or AI processing affects future collection or processing; it does not undo processing already performed. We will describe any new Garmin-approved authorization or explicit AI-consent interface before enabling it.

10. Children's privacy

Fitness Assistant is intended for adults and is not designed for children or directed to children under 13. We do not knowingly offer child accounts for this fitness product. If you believe a child has submitted information to Fitness Assistant, contact us so we can review the matter.

11. Updates to this policy

We will update this notice as Fitness Assistant moves from testing toward launch, changes connected providers, or changes AI data practices. We will publish a new update date and give additional notice or request consent when required. A privacy policy alone does not establish that a planned integration or control has been implemented.

12. Contact and privacy requests

Use the subject “Fitness Assistant Privacy Request.” Please do not include health records, passwords, API keys, or other sensitive information in your first email.