Personal data protection policy

1. Who are we?

The RunMorph platform (available at runmorph.com) is published and operated by Homeseek SARL, a company registered in France, whose registered office is at 117 Rue Jean-Baptiste Lebas, 59493 Villeneuve-d'Ascq, France.

As data controller, Homeseek SARL determines the purposes and means of processing your personal information when you use RunMorph.

For any question about the protection of your data, you can write to us at admin@runmorph.com.

2. What information do we collect?

2.1 Information you give us directly

• Account creation: email address, password (encrypted), first and last name.
• Third-party sign-in: if you choose to sign up or log in with Google, we receive your name, email address and profile photo as provided by the identity provider. We never receive your Google password.
• Athlete profile: gender, date of birth, years of running, number of weekly sessions, weekly mileage, injury history, recurring pain, training preferences, personal records.
• Race goals: target distance, goal time, race date, available training days.

2.2 Information from connected services

If you link your Strava or Suunto account to RunMorph, we import certain data about your running activities (run, trail run, virtual run), including your past activities:

• Activity name (when the service provides one), date, distance, duration, elevation gain.
• Average and maximum speed.
• Average and maximum heart rate (when available).
• Cadence and power (when available).
• The GPS track of the route and detailed measurements recorded during the activity (heart rate, speed, altitude), when available.

If you connect Garmin Connect, the data we receive from Garmin and how we use it are described in section 3.

RunMorph only stores running activities. Your cycling, swimming or any other activities are neither imported nor kept.

2.3 Information collected automatically

• Browsing data: on the public pages of the site (for example the home page, articles, reviews, tools and programs), we use Google Analytics to measure traffic (pages visited, session length, approximate geographic origin, device type), as well as the Meta pixel and the Google Ads tag to measure the effectiveness of our ads. Google Analytics statistics are aggregated and do not identify you personally. If you are logged in to your account, the Meta pixel also receives your email address in hashed form (an irreversible fingerprint). These tools are never loaded in your logged-in area (dashboard, activities, plans, profile, account, connections): they receive no data about your activities, and in particular no Garmin data.
• Internal audience measurement: across the whole site, including your logged-in area, we measure traffic with Umami, an audience measurement tool hosted on our servers in France, which sets no cookies. It records the pages viewed (address and title), the page you came from, some clicks (for example on a sign-up button), your browser, operating system, device type, screen size, language and an approximate location (country, region, city). Your IP address is not kept: it is used for this location and, together with your browser's characteristics, to compute a fingerprint that groups your visits and changes every month. The addresses of the pages in your logged-in area reach it without their parameters and without the identifiers of your activities.
• Internal page view tracking: for the same purpose, each page you open on the site, including your logged-in area, is also recorded in our database, with its path (without parameters), the page you came from, your browser's identification details (browser, system, device), a fingerprint of your IP address computed with a secret key (the address itself is not recorded), the date and time and, if you are logged in, your account identifier. For an activity detail page, the activity identifier is removed from both the path and the page you came from. Page views linked to your account are deleted along with it.
• Authentication tokens: a session token is stored in your browser (localStorage) to keep you logged in between visits.

3. Data from Garmin Connect

RunMorph lets you link your Garmin Connect account directly to your RunMorph account. This connection is optional: only you can start it, from the Connections page, after agreeing to this data being processed by artificial intelligence (see section 4). This section describes the data we receive from Garmin, how we use it and the third parties that process it.

3.1 How this data reaches us

The connection goes through Garmin's authorization page: it is with Garmin that you sign in and authorize the sharing of your data. RunMorph never sees your Garmin password. Garmin then sends us your new data automatically, including the activities recorded, imported or entered manually in Garmin Connect after the connection: your earlier history is not sent to us, unless you re-import it into Garmin Connect.

3.2 Data received from Garmin

With your authorization, we receive from Garmin:

• Connection data: your Garmin user ID (a pseudonymous identifier assigned by Garmin that contains neither your name nor your email address), the permissions you granted and the access tokens that allow RunMorph to receive your data.
• Summary of each run: activity type, name, date and time, duration, distance, speed and pace, average and maximum heart rate, cadence, elevation, calories, watch model and starting position.
• Activity file (FIT format): GPS track, detailed measurements recorded during the run, up to one per second (heart rate, speed, altitude, cadence, power), and laps.
• Daily metrics: resting heart rate, as well as the VO2max and fitness age estimated by Garmin.

No other health data (sleep, stress, etc.) is collected at this time, and activities other than running are neither imported nor kept. Any new category of data would require this policy to be updated first.

3.3 How we use this data

Your Garmin data is used only to:

• display your activities to you alone (and, for support purposes, to the RunMorph team);
• display your latest daily Garmin metrics (resting heart rate, VO2max and fitness age estimated by Garmin) on the Connections page;
• calculate your records, heart rate and pace zones, estimated VO2max, training load and volume;
• adapt your training plan;
• email you your session debriefs and your weekly summary;
• be analyzed by artificial intelligence, with your explicit consent (see section 4).

It is never sold or rented, never used for advertising, and is only shared with the technical processors listed below.

3.4 Third parties that receive or process your Garmin data

OVH, Supabase and Google act as processors: they process your data on our behalf and according to our instructions. The OpenStreetMap Foundation only receives the map tiles requested, and therefore the geographic area covered by your tracks, along with your browser's IP address when your browser requests them; it receives neither your name, nor your email address, nor any of your other data. No other third party receives your Garmin data: no commercial partner, no advertising network, no other provider. Nor can it be accessed through the RunMorph MCP connector, which lets you link your own artificial intelligence assistant to your account.

Garmin is the source of this data. For the data in your Garmin Connect account, Garmin acts as an independent controller, under its own privacy policy: www.garmin.com/privacy/connect.

3.5 Retention and deletion

Your Garmin data is kept as long as the Garmin connection is active. If you disconnect Garmin, from the RunMorph Connections page or from Garmin Connect, withdraw your consent or delete your account, we delete your activities and metrics from Garmin as well as your access tokens. When you disconnect from RunMorph, we notify Garmin, which then stops sending us your data. Technical backup copies of our database then disappear as they are automatically rotated.

If we cannot reach Garmin when we notify it of the disconnection (from RunMorph, by withdrawing your consent or by deleting your account), we keep only your Garmin user ID and the access tokens needed to renew this deregistration request, until Garmin has confirmed it and for 30 days at most. After each deregistration requested by RunMorph, a marker that holds only your Garmin user ID is also kept for 48 hours at most, so that this deregistration does not erase a new connection of your Garmin account. The notifications that Garmin still sends us after the disconnection, including its confirmation of the deregistration, are deleted as soon as they are processed, without anything being imported from them; if this processing fails (a temporary outage of our database, for example), they are kept for further attempts, for 31 days at most after they were received.

If you have also linked Garmin Connect to Strava, the activities that reach us through Strava fall under the Strava connection: they are deleted when you disconnect Strava.

3.6 Sending your sessions to Garmin Connect

If you wish, RunMorph can place the sessions of your training plan in your Garmin Connect calendar, so that you find them on your watch. This is optional: nothing is sent until you give your express consent, once on RunMorph, and then session by session, when you click “Send to Garmin Connect”.

For each session sent, we transmit to Garmin:

• its title, description and date;
• its steps (warm-up, intervals, recoveries, cool-down), with their duration or distance;
• the target of each step: a pace range calculated from your plan's MAS, or a heart-rate range calculated from your markers (maximum and resting heart rate).

We do not send Garmin your name, your email address, your activities or any other data from your account. On our side, for each session sent we keep the identifiers Garmin assigns to it, its date and the status of the transfer, so that we can update or remove it.

You can remove a sent session at any time from your plan. If you withdraw your consent to sending, you can also ask for the upcoming sessions already placed in your Garmin calendar to be removed. When you disconnect Garmin from RunMorph or delete your account, we remove from your Garmin calendar the upcoming sessions we placed there, as long as Garmin still allows it, and then delete our records of these transfers. A session already synced to your watch may remain there: you can then delete it from the watch or from Garmin Connect. Once received by Garmin, your sessions fall under your Garmin Connect account and Garmin's privacy policy.

3.7 Your rights over this data

You can exercise all the rights described in section 9 over your Garmin data: access, rectification, erasure, objection, restriction and portability, including an export of your data in JSON or CSV format, as well as the withdrawal of your consent.

RunMorph is an independent service: it is not endorsed, certified or recommended by Garmin. Garmin® and Garmin Connect™ are trademarks of Garmin Ltd. or its subsidiaries.

4. Artificial intelligence transparency statement

In short: RunMorph uses an artificial intelligence model (Google Gemini, through Google Cloud Vertex AI) to design and adapt your training plans and to write the analysis in your weekly summary. Your Garmin data is only processed by AI with your explicit consent, requested before Garmin is connected, and you can withdraw it at any time from the Connections page. Neither your Garmin data nor anything derived from it is used to train an AI model.

4.1 Nature and purpose of the processing

RunMorph uses a generative artificial intelligence model, Google Gemini, which it accesses through Google Cloud's Vertex AI service. This model is used to design and adapt your training plans and to write the personalized analysis in the weekly summary we email you.

To do this, it receives your athlete profile information (age, gender, level, volume, records, injuries, goals), the names of your activities and numerical summaries of your sessions (date, session type, distance, duration, pace, heart rate, elevation, time spent in each intensity zone), including your Garmin activities if you have connected Garmin with your consent. No directly identifying data (name, email) is included in the requests sent to the model.

Our other features (displaying your activities, calculating your records, zones, estimates and load, debriefs sent after each session) rely on calculations made by RunMorph, without generative artificial intelligence.

The plans and analyses produced by AI are automatically generated suggestions: they in no way replace the advice of a healthcare professional or a qualified coach.

4.2 Your consent for Garmin data

Your Garmin data is never processed by AI without your agreement. Before any Garmin connection, a dedicated checkbox, unticked by default, asks you to accept this processing: as long as it is not ticked, the connection cannot be started. Your consent is time-stamped. Since no Garmin data reaches us without it, it always comes before any AI processing of this data.

You can withdraw it at any time from the Connections page, using the “Withdraw my consent” button and a simple confirmation. Withdrawing disconnects Garmin, notifies Garmin, which stops sending us your data, and deletes the data imported from Garmin. It does not affect the lawfulness of processing carried out before: plans already generated remain in your account, where you can delete them.

For your other data (profile, goals, activities imported from Strava or Suunto), AI processing is necessary for the plan generation service you request (performance of the contract).

4.3 Our commitments

• Your Garmin data, and anything derived from it (requests sent to the model, responses, summaries, logs), is never used to train, test, evaluate or improve an AI model, or to build a knowledge base for an AI.
• Google acts as a processor and is contractually committed not to use this data to train its models.
• The model is called in Google Cloud's “global” region: your data may therefore be processed outside the European Union. These transfers are governed by the European Commission's standard contractual clauses.
• Your Garmin data cannot be accessed through the RunMorph MCP connector, which lets you link your own AI assistant to your account.
• We update this statement whenever our use of AI changes or regulations require it.

5. Why do we process this information?

6. Who do we share your data with?

We never sell, rent or transfer your personal data to third parties for commercial purposes. Some information is, however, shared with the technical providers needed to run the service:

Google Analytics, Google Ads and the Meta pixel are never loaded in your logged-in area (dashboard, activities, plans, profile, account, connections): they receive no data about your activities, and in particular no Garmin data.

The services you choose to link to RunMorph (Strava, Suunto and Garmin Connect) are not our providers: they are the sources of the data you authorize us to import. Each processes the data in your account with them as an independent controller, under its own privacy policy. You can disconnect them at any time from the Connections page, which deletes the data that came from them.

If you link your own artificial intelligence assistant to your account through the RunMorph MCP connector, that assistant gets read-only access to your profile, activities and plans, except your Garmin data, and processes them under the terms of its provider.

When data is transferred to countries outside the European Economic Area, we make sure appropriate safeguards are in place (standard contractual clauses of the European Commission, certifications or adequacy decisions).

7. How long do we keep your data?

• Account and athlete profile data: kept as long as your account is active. If you delete your account, your data is erased within 30 days.
• Strava and Suunto activities: kept as long as the connection to the service concerned is active. Disconnecting Strava or Suunto deletes the activities imported from that service.
• Garmin data: kept as long as the Garmin connection is active. Disconnecting (from RunMorph or from Garmin Connect), withdrawing your consent or deleting your account deletes your Garmin activities and metrics as well as your access tokens. If we cannot reach Garmin to request the deregistration, your Garmin user ID and the tokens needed to renew this request are kept until Garmin has confirmed it, and for 30 days at most; a marker that holds only your Garmin user ID is kept for 48 hours at most after each deregistration requested by RunMorph, and the notifications that Garmin still sends us after the disconnection are deleted as soon as they are processed or, if this processing fails, 31 days at most after they were received (see section 3).
• Technical backups: deleted data also disappears from our database backup copies as they are automatically rotated.
• Payment data: managed and kept by Lemon Squeezy in line with its legal obligations. RunMorph does not store any card numbers.
• Analytics data: kept according to the Google Analytics configuration (26 months maximum).

8. How do we protect your information?

We put technical and organizational measures in place to keep your data secure:

• Encrypted exchanges via HTTPS/TLS across the entire site, as well as with connected services and our providers.
• Passwords stored as an irreversible cryptographic hash (bcrypt).
• Access tokens for connected services (Strava, Suunto, Garmin) renewed automatically when they expire; Garmin tokens are kept on the server side only and are never exposed to the browser.
• Database access restricted by limited-scope service keys.
• Hosting within the European Union (OVH France, Supabase Ireland).

Since no system is infallible, we encourage you to use a strong, unique password for your RunMorph account.

9. Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights:

• Access: obtain confirmation that data about you is being processed and receive a copy of it. You can also view your profile, activities and plans in your account at any time.
• Rectification: correct inaccurate or incomplete information from your profile page or by contacting us.
• Erasure: request the deletion of your account and the associated data. You can also delete your account yourself from the My account page, or delete the data from a connected service by disconnecting it from the Connections page.
• Restriction: temporarily restrict the processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format. On simple request to admin@runmorph.com, we send you an export of your data, including your Garmin data, in JSON or CSV format within one month.
• Objection: object to processing based on our legitimate interest.
• Withdrawal of consent: withdraw your consent at any time for processing that relies on it (for example the Strava, Suunto or Garmin connection, or the AI processing of your Garmin data, which you can withdraw at any time from the Connections page), without affecting the lawfulness of prior processing.

To exercise any of these rights, write to us at admin@runmorph.com. We undertake to reply within one month. You also have the right to lodge a complaint with a competent supervisory authority (in France: the CNIL, www.cnil.fr).

10. Cookies and similar technologies

RunMorph uses the following technologies:

The strava_oauth, suunto_oauth and garmin_oauth cookies are strictly necessary: they are only set when you start connecting one of these services and are used for nothing else.

Google Analytics, Google Ads and the Meta pixel are only loaded on the public pages of the site, never in your logged-in area (dashboard, activities, plans, profile, account, connections).

You can set your browser to refuse cookies or delete those already stored. Refusing audience measurement and advertising cookies does not affect how the service works; refusing strictly necessary cookies, however, prevents you from linking Strava, Suunto or Garmin.

11. Minors

RunMorph is open to users of all ages. If you are under 16, we ask you to obtain the consent of your parent or legal guardian before creating an account and sharing personal data with us. We reserve the right to delete any account created by a minor without the required parental consent as soon as we become aware of it.

12. Changes to this policy

We may update this policy to reflect changes in our practices or in the applicable regulations. In the event of a substantial change, we will let you know by email or through a notification in the app. The last-updated date at the top of this page lets you check which version applies.

13. Contact us

For any question, request to exercise your rights or complaint about the processing of your personal data:

Homeseek SARL
117 Rue Jean-Baptiste Lebas
59493 Villeneuve-d'Ascq, France
admin@runmorph.com