Privacy Policy

Version 2026-11-03 · Effective November 3, 2026

About this Privacy Notice

This Privacy Notice for Beacon Digital, LLC ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at cyarunning.com or any website of ours that links to this Privacy Notice
• Download and use our mobile application (CYA Running), or any other application of ours that links to this Privacy Notice
• Use CYA Running. A mobile running coach app that you can use to get training plans for the races you enter, written by our software from what you tell us about your running, see the runs you record on your Garmin, COROS or Apple Watch, and send your planned workouts to that watch.
• Engage with us in other related ways, including any marketing or events

Questions or concerns?

Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at AustinLHelton@gmail.com.

Summary of key points

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics in the numbered sections below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. See section 1.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. See section 1.

Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources. When you connect your watch (Garmin, COROS, or Apple Watch through Apple Health on your iPhone), we receive your runs and, if you allow it, your heart rate and sleep, through Stridee. See sections 1 and 12.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. See section 2.

In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. See section 4.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. See section 7.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. See section 9.

How do you exercise your rights? The easiest way to exercise your rights is in the app, under Profile, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

Table of contents

• 1. What information do we collect?
• 2. How do we process your information?
• 3. What legal bases do we rely on to process your information?
• 4. When and with whom do we share your personal information?
• 5. Is your information transferred internationally?
• 6. How long do we keep your information?
• 7. How do we keep your information safe?
• 8. Do we collect information from minors?
• 9. What are your privacy rights?
• 10. Controls for Do-Not-Track features
• 11. Do United States residents have specific privacy rights?
• 12. How CYA Running handles your running and health data
• 13. Do we make updates to this notice?
• 14. How can you contact us about this notice?
• 15. How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us. In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• email addresses
• passwords
• training profile and goals (age, sex, weight, known maximum heart rate, race times, distance units, time zone, your races, their courses and whether each is a main race or a tune-up, your recent running, the days you run, and what you want from each race, and the days you tell us you can't run)
• your consent choices

Sensitive information

When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• health data
• precise geolocation, in the GPS route your watch records with each run

Application data

If you use our application(s), we also may collect the following information if you choose to provide us with access or permission. This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

• Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.
• Health Data. On iPhone, if you connect Apple Watch, we ask for access to Apple Health and for permission to put workouts on your Apple Watch. Section 12 lists what is read and where it goes. If you wish to change our access or permissions, you may do so in your device's settings.

Information automatically collected

In short: some information, such as your Internet Protocol (IP) address and/or browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).

Information collected from other sources

In short: we may collect limited data from public databases, marketing partners, and other outside sources.

In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, and from other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), Internet Protocol (IP) addresses, social media profiles, social media URLs, and custom profiles, for purposes of targeted advertising and event promotion.

When you connect your watch, we receive your runs and, if you allow it, your heart rate and sleep, through Stridee: from your Garmin or COROS account, or from Apple Health on your iPhone. If you test the app through Apple's TestFlight, Apple shares information about your testing with us. Section 12 describes both.

2. How do we process your information?

In short: we process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To build your training plans. We can fill in part of plan setup from your recent runs, for you to change, and write your plan on our servers from your plan setup answers, with your weekly running totals for the last 12 weeks. See section 12.
• To put your plan on your watch, when you choose to. See section 12.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To find and fix problems, such as a run that fails to import or a plan that fails to generate.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. What legal bases do we rely on to process your information?

In short: we only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. See "Withdrawing your consent" in section 9.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to diagnose problems and/or prevent fraudulent activities.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Legal bases in Canada

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. When and with whom do we share your personal information?

In short: we may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct. Google, which draws the map of your route, is the one exception: it receives requests for the map of the area around your route and handles them under its own privacy policy, not on our instructions.

The categories of third parties we may share personal information with are as follows:

• Cloud Computing Services (Railway, which runs our servers and website in Virginia, USA)
• Network and Security Services (Cloudflare, which carries all traffic between the app or website and our servers)
• Data Storage Service Providers (Supabase, which provides sign-in, our database and our file storage in Northern Virginia, USA)
• Other Data Service Providers (Stridee, based in Zürich, Switzerland, which connects your watch, including through its software in our iPhone app)
• Mapping Services (Google Maps, which draws the map of your route in the app)
• AI Platforms (OpenRouter, and the AI providers it sent plan requests to, for plans set up before this version took effect; see section 12.3)
• Communication Tools (Resend, which sends our sign-in emails)

Other situations when we share

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• At your direction, with your watch. When your watch is connected and Send workouts to my watch is on, we send your planned workouts to your own Garmin or COROS account, or to your Apple Watch through the app on your iPhone. See section 12.

5. Is your information transferred internationally?

In short: we may transfer, store, and process your information in countries other than your own.

CYA Running is offered only in the United States. Our servers are located in the United States. Regardless of your location, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see section 4), including facilities in the United States, and other countries. Stridee, which connects your watch, handles your watch data, including what it receives from Apple Health on your iPhone, in Switzerland and elsewhere in Europe. Google, which draws the map of your route, can be outside the United States.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

6. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Section 12 lists how long we keep specific kinds of information, including in backups.

7. How do we keep your information safe?

In short: we aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. Do we collect information from minors?

In short: we do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction. If we learn that personal information from users less than 18 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18 or the equivalent age as specified by law in your jurisdiction, please contact us at AustinLHelton@gmail.com.

9. What are your privacy rights?

In short: depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in section 14.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in section 14 or updating your preferences in the app, under Profile.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Account information

If you would at any time like to review or change the information in your account or terminate your account, you can log in to the app and use Profile, where you can edit your profile, export your data, and delete your account. Section 12 describes what export and deletion do.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at AustinLHelton@gmail.com.

10. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

11. Do United States residents have specific privacy rights?

In short: if you are a resident of California, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of personal information we collect

The list below shows the categories of personal information we have collected in the past twelve (12) months. It includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to sections 1 and 12.

• A. Identifiers. Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name. Collected: YES.
• B. Personal information as defined in the California Customer Records statute. Name, contact information, education, employment, employment history, and financial information. Collected: YES.
• C. Protected classification characteristics under state or federal law. Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data. Collected: YES.
• D. Commercial information. Transaction information, purchase history, financial details, and payment information. Collected: NO.
• E. Biometric information. Fingerprints and voiceprints. Collected: NO.
• F. Internet or other similar network activity. Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements. Collected: NO.
• G. Geolocation data. Device location. Collected: YES.
• H. Audio, electronic, sensory, or similar information. Images and audio, video or call recordings created in connection with our business activities. Collected: NO.
• I. Professional or employment-related information. Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us. Collected: NO.
• J. Education Information. Student records and directory information. Collected: NO.
• K. Inferences drawn from collected personal information. Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual's preferences and characteristics. Collected: YES.
• L. Sensitive personal information. Health data, precise geolocation, and account login information. Collected: YES.

Sensitive and other personal information

We only collect sensitive personal information, as defined by applicable privacy laws or the purposes allowed by law or with your consent. Sensitive personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes. You may have the right to limit the use or disclosure of your sensitive personal information. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

How long we keep these categories

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A: as long as the user has an account with us
• Category B: as long as the user has an account with us
• Category C: as long as the user has an account with us
• Category G: as long as the user has an account with us
• Category K: as long as the user has an account with us
• Category L: as long as the user has an account with us

Sources of personal information

Learn more about the sources of personal information we collect in sections 1 and 12.

How we use and share personal information

Learn more about how we use your personal information in section 2.

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in section 4.

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found in section 4. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers
• Category C. Characteristics of protected classifications under state or federal law
• Category G. Geolocation data
• Category K. Inferences drawn from collected personal information
• Category L. Sensitive personal information

Your rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")
• Depending upon the state where you live, the right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California)
• Depending upon the state where you live, the right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)

How to exercise your rights

To exercise these rights, you can contact us in-app, through the privacy controls in Profile, where export, consent withdrawal, and account deletion run directly, by emailing us at AustinLHelton@gmail.com, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

California "Shine The Light" law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in section 14.

12. How CYA Running handles your running and health data

This section describes CYA Running's own data practices in detail. Where it is more specific than another section of this Privacy Notice, this section applies.

We describe every piece of data by where it comes from. Information you provide is what you enter in the app. Measurements come from your watch. Values the app works out from those, such as grade-adjusted pace, splits, workout targets, and your training plan, are estimates, and they can be wrong. Pace targets come from your race times, and heart-rate targets from your known maximum heart rate or, if you gave none, your age. We never infer injury, illness, or any other health condition, and a gap in your training data is treated as a gap, never as an injury.

CYA Running is offered only in the United States, to adults 18 and over. We store your data in Virginia, USA, with Supabase and Railway.

If you give your weight and sex in your profile, we keep them so a later version of the app can use them to size the load of your training and to read effort from your heart rate. Today the app does not use them for anything else. We use your runs, heart rate, and sleep only as this section describes, and we will ask for your consent before we use them for a new purpose. We do not use your data to train AI models.

12.1 Runs from your watch

You connect one watch at a time: Garmin, COROS, or Apple Watch on iPhone. When you connect Garmin or COROS, that company sends the activities you record to Stridee, and Stridee passes them to our servers. Stridee receives whatever your Garmin or COROS permissions allow. Disconnecting stops anything new arriving. What Stridee keeps after that falls under Stridee's own policies. We identify you to Stridee by a random ID, never by your name or email address. We accept data measured up to 12 months before the day it arrives, and nothing older. Run data is required: without it the app cannot show your history or be used at all.

When you connect Apple Watch, iOS asks you to allow access to Apple Health. Stridee's software inside our iPhone app then reads what you allow and sends it from your phone to Stridee, which holds it and passes your workouts to our servers. The app always asks for your workouts with their heart rate, route, distance, energy, power and cycling cadence. Only if you allow heart rate and sleep in CYA Running does it also ask for everything else that software can read: resting heart rate, heart rate, heart rate variability, sleep, steps, distance, energy, flights climbed, exercise minutes, VO2 max, breathing rate, blood oxygen, weight, body fat, BMI, blood pressure and wrist temperature. Without that permission, no health readings beyond your workouts leave your phone. You can turn any of them off on that screen or later in iOS Settings. We keep only your workouts and, if you allow heart rate and sleep, your resting heart rate, sleep and heart rate variability. Stridee's notices of the other kinds, which include their values, also reach our servers; we discard them as they arrive and keep only a note of each one's type and date. We do not use Apple Health data for advertising or marketing.

Your watch sends us every activity you record, not only runs; with Apple Watch, that includes workouts other apps saved in Apple Health. We read each activity's file in temporary storage and then delete the file. If an activity holds no run, we keep only its date and a note that it was not a run.

When you set up a plan, the app can fill in your last four weeks of running (your average weekly distance and climb, your longest run and its time, and how many days a week you ran) and the days of the week you usually run, worked out from your runs over the last four weeks. You can change any of them before you build your plan. What you keep is your answer, which writes your plan as section 12.3 describes.

When you build a plan, if your watch has been connected for at least a day and you have runs in those weeks, we also work out your total running distance and time for each of the last 12 weeks from your runs, one total a week, and use them with your plan setup answers, as section 12.3 describes. They are not shown in the app.

Your GPS route comes from what your watch recorded, never from the app tracking your location, and is stored on our servers as part of each run's recording. It is kept as your history and included in your data export. The app shows it to you on a map in your run's details, drawn with Google Maps; no one else can see it in the app. To draw the map, your phone asks Google for the map of the area on your screen, which is the area around your route, and Google handles those requests under its own privacy policy. Google's map software in the app also sends Google your device's IP address, details of your device and of the map software, an identifier for the map software, crash reports, and how you move and zoom the map.

From each run we keep a filtered copy, not the original file. We do not keep calories, stress, Body Battery, fitness or VO2 max estimates, temperature, device serial numbers, or anything else in the file that is not listed below. An Apple Watch run is rebuilt by Stridee from Apple Health's samples, so it has fewer of these, for example no cadence. For each run we keep what your watch provides of:

• the type of run (for example treadmill or trail) and its title
• when it started and ended, its local date, and its moving and elapsed time
• distance, speed and pace, elevation, and total climb and descent
• your GPS route
• cadence
• laps and pauses
• the model of watch that recorded it, but not its serial number
• these measurements through the run, at the rate your watch recorded them

12.2 Heart rate and sleep

Heart rate and sleep is optional, and off unless you turn it on. You can turn it on or off at any time in Profile. We show heart rate on your runs. We keep sleep, heart rate variability, resting heart rate, and daily heart rate so a later version of the app can use recovery signals in your coaching; today the app does not use them for anything else.

With Garmin or COROS, what reaches Stridee depends on the permissions you grant on that company's own screens, whatever you choose here. With Apple Watch, your iPhone sends Stridee health readings beyond your workouts only while heart rate and sleep is on and you allow them on the Apple Health screen, as section 12.1 describes; turning it on or off takes effect on your iPhone by the next time the app starts. Every run's file includes heart rate, and Stridee's notices of your daily health summaries include the summary values. Your choice here decides what we keep. If you have not allowed heart rate and sleep, heart rate inside a run's file is discarded while the file is read and never saved, and daily health summaries are discarded as they arrive; we do not fetch the detailed readings, and we keep only a note that a reading was offered and skipped (its type and date).

Turning heart rate and sleep off deletes the heart rate and sleep data we already hold, including from any data export that is being prepared or waiting to be downloaded. Your runs stay.

If you turn it on while setting up the app, before you first connect your watch, we keep any earlier readings it sends, up to 12 months back. If you turn it on later, or turn it back on after turning it off, we keep only readings measured from that moment on.

If you allow it, we also keep:

• your heart rate during runs: the readings through each run, and each run's and lap's average and maximum
• your heart rate through the day, from Garmin
• your resting heart rate
• your sleep: how long you slept, and your sleep stages and naps when your watch records them
• your heart rate variability (HRV): your watch's overnight figure (Garmin and COROS measure it one way, called RMSSD, and Apple another, called SDNN; we keep each labelled), and Garmin's readings through the night

12.3 Your training plan

When you set up a plan, our software writes it on our servers from your plan setup answers: for the races that plan trains for, ends with or holds, each race's distance, date, terrain, climb and descent, whether it is a main race or a tune-up, and what you want from it; your plan's start and end dates; your last four weeks of running as you entered them, or kept them after the app filled them in from your runs (section 12.1); your running days, long-run day and preferences; and your distance unit.

It also uses your weekly running distance and time for each of the last 12 weeks, from your runs: one total a week, with no routes, heart rate or sleep. If your plan starts partway through a week, it also uses the runs you've recorded so far that week. For your next plan, or a new version of the current one, it also uses what your earlier plan asked of you, and for the plan after a race, your longest run from the 12 weeks before that race, with its time.

If you add time off, it also uses the first and last day of each stretch you told us you can't run; we never ask why, and keep no reason. To ease you back after it, it uses your usual week over the 4 weeks before the week your time off starts: for the weeks you've already run, your average weekly distance and your longest run, from your runs (only when it also uses your 12 weekly totals above); for the weeks not run yet, the weeks your plan holds.

No AI model or other outside service receives your plan setup answers to write your plan. Before this version of the policy took effect, plans could also be written by AI models: our server sent the answers above to OpenRouter, a service that passed them to AI models that wrote and reviewed the plan, without your name, email address, age, sex, weight, heart rate, race times or race names, and only to AI providers that, by OpenRouter's own classification, do not collect or train on request data. Some of those providers keep requests for a period to detect abuse, under their own policies, and can be outside the United States.

We also keep a private record of each plan attempt: your plan setup answers and time zone, what our software built, and the checks it ran; for plans set up before this version took effect, what was sent to the AI models and what came back. We use it only to find and fix plans that fail. Only our operator can read it, through direct access to our database. It has no fixed deletion date: we delete it by hand once we no longer need it, and always when you delete your account. It is not in your data export; email us if you want a copy.

12.4 Your plan on your watch

If your watch is connected and Send workouts to my watch is on, we send the next 7 days of your plan, and race days when they fall in them, to your watch through Stridee: to your Garmin or COROS account, or to your Apple Watch through Stridee's software in the app on your iPhone. The switch is on unless you turn it off in Profile. We keep a record of each workout we sent: its date and name, which watch it went to, the IDs Stridee and your watch company gave it, and what was last reported about it.

• Each workout goes with its name, date, steps and lengths, and, on faster running, a pace range worked out from your race times. A race day goes under its race's name, if you gave one.
• No heart rate, age, weight or sex is sent.
• Turning the switch off removes the workouts we put on your watch from today on. Earlier ones stay there as your history.
• If you switch from Garmin or COROS, workouts already sent to it stay on it. Workouts on an Apple Watch come off it whenever the app stops Stridee's software: when you disconnect or switch watches, sign in to a different account on that iPhone, or delete your account. Signing out does not stop it: your iPhone keeps sending your Apple Watch data until you disconnect your watch in Profile.
• Deleting your account deletes every workout we sent at Stridee and asks your watch to remove them. COROS keeps ones dated before today or already done. On an Apple Watch they come off when the app stops Stridee's software.
• Once a workout is on your Garmin or COROS account, that company also handles it under its own privacy policy.

12.5 Testing through TestFlight

While CYA Running is tested through Apple's TestFlight, Apple shares with us the name and email address we invited you with, your device model, how often you use the test app, crash logs, and any screenshots and feedback you send through TestFlight. We use this only to fix and improve the app. Apple also handles it under its own TestFlight privacy terms.

12.6 Exporting and deleting your data

Export: in Profile, Export my data. You confirm with your password, and the app prepares a ZIP file of your account, profile, consent records, races, time off, plans, runs, and heart rate and sleep if you allowed it. It is ready to download for 24 hours. It leaves out your email address, the plan attempt records, short-lived security records, and logs; email us for a copy of any of these. We never store your password, so it cannot be exported.

Delete: in Profile, Delete my account. You confirm with your password. You are signed out everywhere and imports stop at once. We then delete your data from our systems, remove the workouts we sent to your watch as section 12.4 describes, end your connection at Stridee, which ends our access to anything Stridee holds (what Stridee keeps after that falls under its own policies), and delete your sign-in account; on your iPhone, the app stops Stridee's software at once. We do not delete activities stored with your watch company or in Apple Health, or copies of an export you saved. We send no confirmation email.

Other requests: you can also stop new runs arriving by disconnecting your watch in Profile; your saved runs stay. Run data cannot be turned off while you keep an account; to remove it, delete your account. For anything else, email us. We will reply within 45 days; if we need longer, we will tell you why within those 45 days and take at most 45 more. If we turn down a request, you can appeal by replying to our answer or by emailing us with the subject "Appeal", and we will answer in writing within 45 days.

12.7 How long we keep specific information

We keep your information for the periods below. Deleting your account ends each of them early, except: the record of the deletion itself; records of background work, which lose their link to you and expire within 30 days; backups; copies our providers hold until their own deletion finishes; our providers' logs; what Apple keeps from TestFlight; and the map requests your phone sent Google, which Google keeps under its own policy.

• Your account, profile, runs, races, time off, plans, run links and watch records, and the notes of activities that were not runs and of readings we skipped: until you delete your account.
• Records of background work done for your account, such as imports and syncs: 30 days after the work was due, or until we have dealt with work that failed.
• Heart rate within a run: as long as the run, unless you turn heart rate and sleep off.
• Sleep, HRV, resting heart rate and daily heart rate: 12 months from the date measured, then deleted automatically.
• A plan setup and the drafts it showed you: deleted when you accept a plan, or about an hour after you last worked on it.
• Plan attempt records: until we delete them by hand, and always when you delete your account.
• A data export: deleted 24 hours after it is ready.
• Security and retry records, such as counts of sign-in attempts keyed to a scrambled form of your email address and IP address: up to 24 hours.
• Records of each delivery from Stridee: 30 days.
• A key that lets your iPhone send Apple Watch data while the app is closed, kept in a scrambled form: until you disconnect your watch, sign in to a different account on that phone, reset your password or delete your account.
• A sign-up that was never verified: deleted after 7 days.
• After you delete your account, a record of the deletion, holding the IDs needed to finish it at Stridee, your watch company and our sign-in provider (and, for a workout still being removed from your watch, its name and date): those details are erased when the deletion finishes, and the record itself 30 days later.
• Backups: deleted data can remain in our database backups for up to 7 days, until those backups expire.
• Our hosting providers keep technical logs, which can include your IP address, for up to 30 days. Cloudflare keeps its own records of the traffic it carries, and our email provider its own delivery records, under their own policies.
• TestFlight information stays in Apple's systems under Apple's own terms. Apple keeps feedback for one year.

12.8 Washington consumers

Washington residents: our standalone Consumer Health Data Privacy Policy, available at cyarunning.com/washington-health-data, describes our consumer health data practices and your rights under the Washington My Health My Data Act, including access, deletion, consent withdrawal, and appeal.

13. Do we make updates to this notice?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated effective date, shown with this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

14. How can you contact us about this notice?

If you have questions or comments about this notice, you may email us at AustinLHelton@gmail.com.

Beacon Digital, LLC

AustinLHelton@gmail.com

15. How can you review, update, or delete the data we collect from you?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, use Profile in the app, or email us at AustinLHelton@gmail.com.