Privacy Policy

The short version

Outrun is a paid app with no advertising and no free tier. We make money from subscriptions, not from your data.

• We never sell your data, and we never share it with data brokers.
• We never use your health or fitness data for advertising. Not ours, not anyone's.
• We don't track you across other apps or websites. Outrun shows no ATT prompt because it has nothing to ask for.
• You can export everything we hold about you, or delete your account entirely, from inside the app at any time.

The rest of this page explains exactly what we collect, why, who processes it on our behalf, and how long we keep it.

Who we are

Outrun (the "app") is provided by Zonder Solutions, S.L., a Spanish limited liability company with tax identification number (NIF) B75573626, registered office at Carrer de Magarola 36, 08196 Sant Cugat del Vallès, Barcelona, Spain. Email: [email protected]. These identification details are published under Article 10 of Spanish Law 34/2002 on information society services and electronic commerce (LSSI-CE).

For the purposes of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), that company is the data controller for the personal data described on this page. For users in the United Kingdom, the same company is the controller under the UK GDPR.

No Article 27 representative is appointed, and none is required. That obligation falls on controllers established outside the European Union. We are established in Spain, so you deal with the controller directly.

No Data Protection Officer is appointed. Article 37(1) requires one where processing is carried out by a public authority, where core activities consist of large-scale regular and systematic monitoring, or where core activities consist of large-scale processing of special-category data. None applies here: Outrun processes health data only for the individual user who supplied it, for that user's own benefit, and monitors nobody. We keep this under review, because the assessment depends on scale and scale can change. Privacy matters are handled at [email protected].

Supervisory authority. Our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es. You may complain to it, or to the supervisory authority of the country where you live or work.

What Outrun collects

Everything below is collected because a feature you use needs it. Nothing here is collected for advertising.

Dictation. When you dictate into the input field, Apple's speech recognition turns your voice into text, on your iPhone where it supports that and otherwise on Apple's servers. Outrun receives only the text, never the audio.

We do not collect your contacts, your browsing history, your location, or any advertising identifier.

What we deliberately do not do

Outrun does not display advertising, does not contain third-party advertising SDKs, and does not participate in cross-app tracking. NSPrivacyTracking is set to false in the app's privacy manifest, and no App Tracking Transparency prompt is shown because there is nothing to track.

Apple Health data

Health data gets its own section because it deserves stricter handling, and because Apple requires us to be explicit.

Outrun reads, only the categories you approve, and only after you grant permission in the Health permission sheet: workouts, with the calories and average heart rate measured for each; resting heart rate; heart rate variability; step count; sleep; body weight; and date of birth.

Outrun writes, workouts and body weight that you log inside Outrun, and the energy and protein of the meals you log, are saved back to Apple Health so they stay consistent with your other apps. Entries Outrun creates are marked so it can find and remove them again if you delete the original.

Our commitments on health data, which mirror Apple's HealthKit requirements:

• Health data is never used for advertising, marketing, or any similar service.
• Health data is never sold to anyone, including data brokers and insurers.
• Health data is never shared with third parties except the infrastructure processors listed below that store or process it strictly on our instructions.
• Health data is not used for any purpose other than your own health and fitness tracking inside Outrun.

You can withdraw Health access at any time in iPhone Settings → Apps → Health → Data Access & Devices → Outrun. Outrun remains fully usable with Health access denied; it simply relies on what you log by hand.

AI and your data

Outrun uses large language models for two things: turning what you log into entries (sorting what you write into meals, workouts and notes, and estimating food from text and photos), and choosing your starting program once, after you create your account. The models are run by third-party providers. This is how that works.

• Who receives it. Requests go to OpenRouter, which passes each one to a model from OpenAI, Anthropic, Google or DeepSeek.
• What is sent. The photos you log from (meals, nutrition labels, receipts), and the text you type or dictate into the input field, including notes. Once, when your starting program is chosen: your goal, your training experience, the days you can train, your other sports and how often you do them, and how long you like a session to be.
• What is not sent. Your name, email address, account identifier, authentication tokens and Apple Health data.
• We ask first. Before Outrun sends anything to a model for the first time, the app asks your permission and names who receives it. If you say no, nothing is sent: photos and typed logs open the editor so you can log them by hand, and your starting program is worked out on your phone.
• You can change your mind. Turn AI on or off at any time in Settings › AI & your data. While it is off, nothing is sent to a model. Logging by hand always works: numbers, barcodes and the gym logger never reach a model.
• We route to no-retention providers. Every model request Outrun makes sets a zero-data-retention flag, which restricts routing to providers that do not retain request data and do not train on it.
• Model output is generated, not verified. Food estimates and your starting program are AI-generated and can be wrong. Every AI estimate is shown to you, and you can edit or delete it.
• Your logs are not training data. We do not use your content to train our own models, and we do not license it to anyone for that purpose.

Before you have an account, nothing is sent to a model: the plan preview at the end of the sign-up questions is worked out on your phone.

Why we are allowed to process your data

Every purpose below has a lawful basis under Article 6 GDPR. Where the data is health data or otherwise special-category, it also has a condition under Article 9.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded it does not override them. In short: the data is minimal and first-party, it is hosted in the EU, it is never used for advertising, never sold, never combined with data from other companies, and never used to profile you or make decisions about you. Analytics does not run at all until you have an account and have accepted the terms. You have an absolute right to object to processing based on legitimate interests, email [email protected] and we will stop, unless we can show compelling grounds that override your objection, which for analytics we would not attempt.

Where we rely on consent, you can withdraw it at any time, and withdrawing is as easy as giving it: revoke Apple Health access in iPhone Settings, turn AI off in Settings › AI & your data, or delete your account in the app. Withdrawal does not affect the lawfulness of processing before you withdrew.

Automated decisions and profiling

Outrun does not make decisions about you that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Your starting program is chosen automatically, but it is a suggestion: it has no legal or financial consequence, and you can edit or ignore any of it. We do not use your data to score, rank, or categorise you, and we do not use it to decide whether you can buy or keep the subscription.

Who processes your data for us

We use a small number of vendors ("sub-processors"). Each one is contractually limited to processing your data on our instructions.

Analytics does not run until you have an account. Product analytics stays switched off from the moment the app launches and is only enabled once you have created an account and accepted the terms, so nothing is measured before you have been told what we collect. Signing out switches it off again.

We do not sell personal data, and we do not disclose it for cross-context behavioural advertising, under any definition used by US state privacy laws.

Where your data is stored, and when it leaves the EEA

Everything we store is stored in the European Economic Area. Specifically:

• Supabase (your account, your logs and your uploaded photos) is hosted in eu-west-1 (Ireland).
• Fly.io (the API that serves the app) runs in Paris (cdg).
• PostHog (product analytics) is the EU instance at eu.i.posthog.com.

Some processing nonetheless involves a transfer outside the EEA, and we tell you which:

For every one of these we rely on Article 46(2)(c) GDPR. We have carried out a transfer risk assessment covering the destination country's laws on government access, the categories of data involved, and the supplementary measures in place, encryption in transit, minimisation of what is sent, and, for model requests specifically, a no-retention routing flag that prevents the content being stored or used for training. For UK users the same transfers are made under the UK International Data Transfer Addendum to the Standard Contractual Clauses.

What is never transferred. We do not send your name, your email address, your account identifier or your authentication tokens to any model provider. Your Apple Health data stays on your device and in our EU database; it is not sent to a model provider.

You can ask us for a copy of the safeguards we rely on by emailing [email protected].

How long we keep your data

• Your account content (plans, logs, notes, photos) is kept for as long as your account exists.

• Raw AI-usage and analytics events are pruned automatically on a rolling 400-day window (about 13 months). Aggregated, non-identifying statistics may be kept longer.

• Deleting your account removes your content, including uploaded photos in every storage bucket. This is immediate and cannot be undone.

• Deleting your account is a hard delete. Your plans, workouts, food log, journal notes, body metrics, Apple Health imports and every uploaded photo are destroyed, not merely detached from your name.

• Three things survive. Records of AI usage and cost, records of subscription and payment events, and an audit trail of administrative actions are kept, because we are required to account for what we charged and what we spent. The usage and payment records stay filed under your user ID, the internal account identifier, and the profile behind that ID loses your name, profile photo and date of birth.

• The entry in that audit trail that says your account was deleted keeps a one-way hash of your email address, not the address itself. It records which account was deleted and when, so that we can show, if you or a regulator ever ask, that your request was carried out. The address cannot be read back from the hash: we can only confirm, if you give us an address, whether it belonged to the deleted account. Because the entry carries the same user ID, that check is the one way left to connect an email address with the usage and payment records. It holds nothing else about you.

• A message you send as you leave is kept, without your name on it. If you send us a message from the account-deletion screen ("Tell us what broke"), we keep the text of that message after your account is deleted, with the app version, screen and language it was sent from, but nothing that links it to your account; anything you typed in it stays as written.

• Proof that you accepted these terms, and of your answers about AI (the date and time you accepted them, and each date and time you agreed to AI processing or turned it off) is retained for the same reason, because we need to be able to show that consent was given. It contains no other personal data.

• Accounting, invoicing and tax records are kept for as long as Spanish law requires us to keep them, six years for commercial books and supporting documents under Article 30 of the Commercial Code, and four years for tax purposes under Article 66 of the General Tax Law, running from the end of the relevant period. These records show what was charged and when. They are kept whether or not you delete your account, because we are not permitted to destroy them on request.

• Records kept to defend a legal claim are kept until the relevant limitation period expires, and then deleted.

The 400-day window above is a settled policy decision, not a default we have yet to think about: it is a little over thirteen months, which lets us compare a period against the same period a year earlier and no longer.

Your rights

Depending on where you live, you have some or all of the following rights: access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent.

You can exercise the two most important ones yourself, immediately, without asking us:

• Export everything. In the app: avatar → Settings → Account → Export everything. You get a machine-readable JSON file, and a CSV file per table, containing your profile, goals, plans, workouts, food log, journal notes, body metrics, subscription records and more.
• Delete everything. In the app: avatar → Settings → Delete account.

In full, you have the right to:

• be told what we hold about you and why (Articles 13–15);
• have it corrected if it is wrong (Article 16);
• have it erased (Article 17), the in-app delete does this immediately;
• restrict how we use it while a dispute about it is resolved (Article 18);
• take it elsewhere in a machine-readable format (Article 20), the in-app export does this;
• object to processing based on legitimate interests (Article 21);
• withdraw consent at any time, without affecting what was lawful beforehand (Article 7(3));
• not be subject to solely automated decisions with legal or similarly significant effects (Article 22), we make none, as explained above.

For anything the in-app controls do not cover, email [email protected]. We answer within one month, extendable by two further months for complex requests, in which case we will tell you inside the first month and say why. Exercising these rights is free; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will explain our reasoning if we ever do.

We may need to verify that the request is really coming from you before we act on it, usually by asking you to send it from the email address on the account.

Complaints. If you think we have handled your data badly, please tell us first so we can fix it. You do not have to: you can complain directly to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es, or to the supervisory authority where you live or work. UK users may complain to the Information Commissioner's Office at ico.org.uk. You also have the right to an effective judicial remedy under Article 79 GDPR.

If you are in the United States

These rights apply in addition to the above, under California's CCPA as amended by the CPRA and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas and other states:

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA. We have never done so. There is therefore no "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of.
• We do not use or disclose sensitive personal information (which includes your health data) for any purpose other than performing the service you asked for, and none of the purposes that would trigger a right to limit its use under §1798.121.
• You have the right to know, delete, correct and obtain a portable copy of your personal information, and the right not to be discriminated against for exercising any of them. The in-app export and delete controls serve these directly; for anything else, email [email protected].
• You may use an authorised agent; we will ask for proof of authority.
• We honour Global Privacy Control signals where we receive them. This website sets no cookies and runs no analytics, so there is nothing for a GPC signal to switch off here.

Notice of financial incentive: none. There is no loyalty programme, discount or reward tied to giving us data.

Age

Outrun is not intended for children. You must be at least 16 years old to create an account, and the app asks you to confirm this at signup. If we learn that we hold data from someone under that age, we delete it.

16 is deliberately the highest floor the GDPR contemplates. Article 8(1) sets the digital-consent age at 16 and lets member states lower it, but never raise it, some go down to 13, and Spain's own floor is 14 under Article 7 LOPDGDD. By requiring 16 everywhere we are at or above the threshold in every EU and EEA market, in the UK, and in the United States, where the relevant floor under COPPA is 13. No market requires a higher age than the one we apply, so this single rule is compliant across all of them without per-country logic.

We do not knowingly collect data from anyone below that age. If you believe a child has created an account, email [email protected] and we will delete it and the associated data.

Security

Data is encrypted in transit. Access to your rows in the database is enforced at the database level, so one account cannot read another's data. Access to production systems is limited to the people who need it.

Specifically: traffic is encrypted in transit with TLS; data at rest is encrypted by our hosting providers; row-level security is enforced in the database so one account physically cannot read another's rows; uploaded files are held in per-user storage paths with the same enforcement; and administrative access to production is limited to the controller.

No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs we will notify the Agencia Española de Protección de Datos (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of it, as Article 33 GDPR requires. Where the breach is likely to result in a high risk to your rights and freedoms, we will tell you directly and without undue delay under Article 34, and we will tell you what happened, what it means for you, and what we are doing about it.

This website

useoutrun.app is a static site. It sets no cookies, runs no analytics, embeds no third-party scripts, and loads its fonts from its own server rather than from a font CDN. Nothing you do here is tracked, which is why there is no cookie banner to dismiss.

Changes

If we change this policy in a way that materially affects you, we will tell you in the app before the change takes effect. The version and effective date are at the top of this page, and the app records when you accepted it.

Contact

Privacy questions: [email protected] Everything else: [email protected]