← RunPulse

Privacy Policy

Last updated: 4 August 2026 · Applies to RunPulse for iPhone

1. Who we are and how to reach us

RunPulse ("the app", "we", "us") is an iPhone running tracker and AI coaching app developed by Alperen Çiftlikci as an independent developer. We are the data controller for the limited processing described below.

For any privacy question, data request or complaint, write to runpulse.app@gmail.com. You can also reach us from inside the app via Profile → Settings → Contact developer. We aim to reply within 30 days, and in practice much sooner.

2. Data that stays on your device

RunPulse is local-first. The following is written to your iPhone's private app storage and is never transmitted to us or to anyone else:

• Recorded runs — distance, moving time, average and per-kilometre pace, splits, calories, elevation gain, average and maximum heart rate, perceived effort and notes.
• GPS routes — the full coordinate trace of each run, stored as an encoded polyline so the route can be drawn and replayed.
• Your training plan — generated weeks, individual workouts and their completion status.
• Your profile — goal, runner level, days per week, session length, unit preference, biological sex, birth year, weight, height, first name if you entered one, streak and lifetime totals.
• Coach chat history — every message you sent and every reply you received. The transcript lives only on your phone.
• Achievements and personal records.
• App preferences — voice feedback, auto-pause, reminders, units and similar settings.

Deleting the app removes all of it. Settings → Delete my account wipes this local data immediately and permanently; it cannot be recovered afterwards.

3. Data that leaves your device

This is the complete list. Nothing else is transmitted.

We do not send your name, email address, phone number, contacts, device advertising identifier, GPS coordinates, route geometry or run history off the device.

4. Location and background tracking

RunPulse requests location access so it can measure a run. Specifics:

• Location is read only while a run is being recorded. When no run is active, the app does not access your location.
• The app requests background location so recording continues with the screen locked or the app in the background. iOS shows the blue indicator while this is happening.
• Coordinates are used to compute distance, pace, splits, elevation and your route, and are stored on your device only.
• We do not transmit, share, sell or monetise location data in any form.
• You can deny or revoke location access in iOS Settings at any time. The app continues to work; runs recorded without GPS simply have no distance or route.

5. Apple Health

Connecting Apple Health is entirely optional and the app is fully functional without it. If you do connect it:

• We read recent running workouts, resting heart rate, heart rate during your runs, active energy, distance, body mass, height, date of birth and biological sex — used to pre-fill your profile and to add heart-rate data to a completed run.
• We write each completed run to Health as a workout with its route.

All Health data is processed on your device. It is never sent to our servers, never sent to the AI provider, and never used for advertising or marketing — as required by Apple's rules. You can change or revoke each permission in the Health app at any time. If you decline, you lose only heart-rate figures and profile pre-fill; everything else keeps working.

6. AI features and Google Gemini

RunPulse uses Google's Gemini models through Firebase AI Logic to power the coach chat, the one-line comment on a finished run, plan adaptation, fuelling advice and daily motivation.

When you use one of these features, the relevant text and figures listed in section 3 are sent to Google for processing and a reply is returned. Google acts as our processor for this purpose and, under the Firebase AI Logic terms, does not use your prompts to train its models. Requests are proxied through Firebase so no API key is embedded in the app.

The AI coach provides general training guidance. It is not medical advice and is not a substitute for a doctor, physiotherapist or qualified coach. If something hurts, stop and seek professional advice.

7. Your AI consent

Before the first message is sent to the AI coach, the app shows a consent screen naming Google Gemini as the provider and listing exactly what is sent. Nothing is transmitted until you accept. If you decline, your message is not sent and the AI feature simply does not run.

Your decision is stored on your device and, so you are not asked again on a reinstall, as a single boolean flag (aiConsent) against your anonymous identifier.

8. Anonymous identifier and AI credits

Free AI usage is limited by a daily credit balance. To count credits fairly and to stop abuse, the app creates an anonymous identifier using Firebase Anonymous Authentication.

• It is a random string. It contains no email address, no name, no phone number and no device advertising identifier.
• It is not linked to your Apple ID or to your identity, and it is not shared with advertisers or data brokers.
• Against it we store only: your credit balance, the timestamp of the last daily grant, your premium flag, your AI-consent flag, and a server-written ledger of credit spends (amount and reason such as coach_chat).
• The balance can be changed only by our server, never by the app — this is enforced by database security rules.
• If you delete and reinstall the app you receive a new identifier and the old one is orphaned.

9. Purchases and subscriptions

RunPulse offers a weekly subscription, a yearly subscription and a one-time lifetime purchase. All payments are processed by Apple through your App Store account. We never see or store your card number, billing address or any payment credential.

Purchase receipts are validated by RevenueCat, which tells the app whether your subscription is active. RevenueCat receives the anonymous identifier and the purchase status. Subscriptions renew automatically unless cancelled at least 24 hours before the period ends; you manage and cancel them in your Apple ID subscription settings, not in the app.

10. Notifications

Reminders are scheduled locally on your device. We operate no push server and send no remote notifications, so no push token is collected. Notification permission is optional and can be revoked in iOS Settings.

11. Device integrity (App Check)

To stop other software from calling our AI and credit endpoints, each request carries a short-lived attestation token produced by Apple's App Attest and verified by Firebase App Check. The token proves the request came from a genuine, unmodified copy of RunPulse. It contains no personal information and cannot be used to identify you.

12. Third parties and where data is processed

We use no advertising SDK, no analytics SDK and no crash-reporting SDK. There is no Google Analytics, no Facebook SDK, no attribution or measurement partner, and no cross-app tracking. Transfers outside the EEA and the UK rely on the European Commission's Standard Contractual Clauses entered into with these providers.

13. How long we keep data

• On your device — until you delete the run, use Delete my account, or delete the app. We impose no server-side retention because we hold no copy.
• AI prompts — processed to produce your reply. Google may retain requests briefly for abuse detection and service operation under its own terms; we keep no copy of the exchange on any server.
• Anonymous identifier record — kept while the app is in use, and deleted on request. Orphaned records with no activity are removed periodically.
• Purchase records — retained by Apple and RevenueCat as long as required for tax, accounting and refund handling.

14. Legal bases (GDPR)

• Consent (Art. 6(1)(a)) — sending your data to the AI provider. You give it on the consent screen and may withdraw it by contacting us or deleting the app.
• Performance of a contract (Art. 6(1)(b)) — providing the app's features, counting AI credits and unlocking a purchase you made.
• Legitimate interests (Art. 6(1)(f)) — protecting the service from abuse via device attestation.
• Explicit consent for health data (Art. 9(2)(a)) — reading and writing Apple Health data, which you grant per data type in the Health app.

15. Your rights and how to exercise them

Depending on where you live you have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. If you are in California you additionally have the right to know what is collected and to opt out of any "sale" or "sharing" of personal information — we do neither.

• Access and portability — your training data is already on your device: open any run and use the share sheet to export it.
• Correction — edit your profile in Settings.
• Deletion — Settings → Delete my account erases local data at once. To delete the record held against your anonymous identifier, email runpulse.app@gmail.com; because that identifier is random, include it from Settings → Contact developer, which fills it in for you.
• Withdrawing AI consent — email us and we will clear the flag, or delete and reinstall the app to be asked again.
• Complaints — you may lodge a complaint with your local data protection authority. In Turkey this is the KVKK Authority; in the EU it is your national supervisory authority.

16. What we never do

• We never sell, rent or trade your data.
• We never use your health, fitness or location data for advertising or marketing.
• We never require an account, email address or social login.
• We never track you across other apps or websites, and we request no tracking permission.
• We never upload your GPS routes or run history.
• We never store your payment details.

17. Security

All network traffic uses HTTPS/TLS. Local data is held in the app's private container, protected by iOS file-system encryption and your device passcode. Server-side, database security rules restrict every record to its own anonymous identifier, and the credit balance can be written only by our server. No system is perfect; if you believe you have found a vulnerability, please email runpulse.app@gmail.com and we will respond promptly.

18. Children

RunPulse is rated for general audiences but is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect data from them. If you believe a child has used the app and data is associated with them, contact us and we will delete it.

19. Changes to this policy

If this policy changes we will update this page and the date at the top. Material changes — for example a new processor or a new category of data — will be surfaced in the app before they take effect, and where the law requires it we will ask for your consent again.