Privacy Policy

1. Who we are

GraviRun ("we", "us") is an early-stage running-coaching platform operated by Victor Basin. Privacy requests: privacy@gravirun.com. Support: support@gravirun.com.

2. What we collect

• Email address - when you register, plus your confirmation action (double opt-in).
• Technical data - IP address and browser metadata, processed transiently by our hosting and security providers for service security and bot protection.
• Garmin activity data: with your consent, we process activity data authorised through Garmin's official OAuth flow. We do not request or store your Garmin password.

3. Why we collect it (legal bases)

• Consent - to email you about GraviRun and service updates. You can withdraw at any time.
• Legitimate interest - security, abuse prevention, and service operation.

4. What we never do

• We never sell your data.
• We never share your email with third parties for their marketing.
• We never use your fitness data for AI model training.

5. Where data is processed

We use trusted hosting, database, email, and security service providers to operate the site and service. These providers may process data on our behalf in the jurisdictions where their services operate. We disclose only the information needed to operate the service, protect it, respond to requests, and meet applicable obligations.

6. GPT and Garmin processing

GraviRun is designed to be accessed through a GPT in the user's own ChatGPT account. A GPT Action may send relevant requests to GraviRun and return the user's authorised data to that ChatGPT session. GraviRun does not call the OpenAI API directly and does not train its own models on Garmin data. ChatGPT/OpenAI generates the coaching analysis; it is general information, not medical advice. Users should independently assess recommendations and consult a qualified professional where appropriate.

7. Retention

Pending registrations are deleted after 30 days. For the Garmin service, raw activity details are retained for up to 4 months for current training analysis, then deleted or compacted into monthly aggregates retained for up to 12 months. Valid access, export, correction, disconnection, and deletion requests are completed within 30 days.

8. Your rights

You may request access, correction, export, disconnection, or deletion by emailing privacy@gravirun.com. We may request reasonable verification. EU/EEA residents have additional GDPR rights, including the right to lodge a complaint with a supervisory authority.

9. Changes

We will update this page as the product evolves. Material changes will be announced by email to confirmed subscribers.

← Back to GraviRun home