Privacy Policy

Effective November 14, 2026

Runlore (runlore.app) is a dashboard that helps runners review their own training history. This policy explains what data Runlore collects when you sign in with Strava or Garmin, how it is used, and the choices you have. Runlore is operated by Runlore (“we”, “us”) in Ohio, United States. You can reach us at jacob.lynch784@gmail.com.

Summary

We only read your activity data. Runlore never posts, edits, or deletes anything in your Strava or Garmin account.
Your data is shown only to you. It is not sold, not used for advertising, and not shared with other users.
You can disconnect a provider or delete your Runlore account at any time, and the related data is deleted.

Data we collect

When you sign in

Strava: your Strava athlete ID, first and last name, and profile photo address, as provided by Strava when you authorize Runlore.
Garmin: your Garmin user ID. Garmin does not share your name with Runlore.
Access tokens issued by Strava or Garmin so Runlore can read your activities. They are encrypted before they are stored.

Activity data

Strava activities are requested from Strava each time you sync and are sent to your browser. They are not stored on our servers.
Garmin activities are sent to Runlore by Garmin, as Garmin requires, and stored on our servers so they are available when you open the dashboard. For each activity we keep a summary: activity type and name, start time and time-zone offset, distance, duration, elevation gain, speed, heart rate, cadence, calories, device name, and the start location (latitude and longitude). We do not store GPS routes or second-by-second samples.

Your goals, plans and settings

When you are signed in, the goals, weekly check-ins, saved plans, heart-rate profile, and display preferences you enter are saved to your Runlore account so they are available on any device you sign in on. When you are not signed in, they are saved only in your browser’s local storage. Signing out removes your goals, plans, and heart-rate profile from that browser.

Files you import are read in your browser only and are never uploaded.

How we use your data

To sign you in and keep you signed in.
To show your training history, charts, and plan in the dashboard.
Weather for a run: when you open a run that has a start location, its date, hour, and start location rounded to about 1 km (two decimal places) are sent to Open-Meteo to look up the weather at that time.
Coach’s read: only when you ask for an analysis, a compact summary of metrics (such as distance, pace, duration, elevation, heart rate, and comparisons with similar runs) is sent to Runlore’s own AI analysis server (ollama.runlore.app), which we operate. It is not sent to a third-party AI provider. Activity names, descriptions, routes, and coordinates are not included.

Cookies

Cookie	Purpose	Duration
`sv_session`	Keeps you signed in. Only a one-way hash of it is stored on our servers.	30 days, or until you sign out
`sv_oauth_state`, `sv_oauth_verifier`	Protect the sign-in process with Strava or Garmin from being hijacked.	10 minutes

Runlore does not use advertising or analytics cookies.

Who processes your data

Cloudflare hosts Runlore and its database.
Strava and Garmin provide your activity data under their own privacy policies.
Open-Meteo provides weather data for the rounded locations described above.
Coach analysis runs on Runlore’s own server; no third-party AI provider receives your data.

We do not sell your data or share it with anyone else, except where required by law.

How long we keep data

Account and connection data, and the goals, plans and settings saved to your account, are kept until you disconnect the provider or delete your account.
Garmin activity summaries are kept while Garmin is connected. They are deleted when you disconnect Garmin in Runlore, when you remove Runlore from your Garmin Connect account, or when you withdraw permission to share activities.
Sign-in sessions expire after 30 days and are deleted when you sign out.

Your choices and rights

Disconnect a provider from Account in Runlore. Its tokens and any stored activities are deleted, and for Garmin, Runlore asks Garmin to stop sending data.
Delete your account from Account → Delete account. Your profile, connections, sessions, stored activities, and saved goals, plans and settings are deleted immediately.
Revoke access at any time from Strava’s Settings → My Apps or Garmin Connect’s connected-apps settings.
Access, correction or deletion requests: email jacob.lynch784@gmail.com. We will respond within 30 days. Depending on where you live, you may have additional rights, such as to request a copy of your data or to complain to a data-protection authority.

Security

Connections to Runlore use HTTPS. Provider tokens are encrypted with AES-256-GCM, sessions are stored only as hashes, and data is accessible only to the account it belongs to.

Children

Runlore is not directed at children under 16, and we do not knowingly collect their data.

Where your data is handled

Runlore is operated from Ohio, United States, and this policy is governed by the laws of Ohio and the United States. Cloudflare may store and process data in data centers around the world. If you use Runlore from outside the United States, your data will be transferred to and processed in the United States.

Changes to this policy

If this policy changes, we will update the effective date above. Significant changes will be noted in the app.