Have2Run Privacy Policy

1. Introduction

Thank you for using Have2Run! Have2Run tracks the mileage of each of your running shoes and lets you know when it is time for a new pair.

This Privacy Policy explains what information Have2Run collects, how we use it, and how we protect it. Your privacy is very important to us.

2. Data We Collect

2.1 Shoes & Run Records

Data Types:

• Shoe details: brand, model, nickname, lifespan (km), starting mileage, retired status and retirement date
• Shoe photos (only if you take or choose one to upload)
• Run records: distance, start time, the shoe you wore, source (Apple Health / Health Connect / Strava / manual entry), and an external record ID used to prevent duplicates
• Catalog image reports ("This looks like a different shoe")

Source: You enter this data yourself, or it is recorded when you pick a shoe from a detected-run notification.

Purpose: Calculate mileage per shoe, tell you when a shoe is near the end of its life, and show your run calendar.

2.2 Health & Fitness Data (Apple Health / Health Connect)

Permissions: We request READ-only access to HealthKit (Apple Health) on iOS or Health Connect on Android. The app never writes to or modifies Apple Health or Health Connect.

Read permissions requested: workouts and distance only. On Android, we also request background read access so new runs can be detected while the app is closed.

What we use:

• Workout type (whether it is a run — walks, rides, etc. are ignored)
• Distance
• Workout start time

Purpose: Used only to detect a run you finished with your watch, send a "Which shoes did you wear?" notification, and record the run when you choose a shoe.

Storage: Only the run record you save (distance, start time, source) is stored on our servers. We do not read any other health data, and runs whose notification you ignore are not recorded.

Restrictions:

• Health data is never used for advertising or marketing.
• Health data is never sold or shared with third parties.

Control: You can change the detection source in app Settings, or revoke access at any time in your device's health settings (iOS Settings > Health / Health Connect).

2.3 Strava Connection (Optional)

Data Types:

• Strava athlete ID, OAuth access and refresh tokens, token expiry time, granted scope
• Type, distance, and start time of new activities (read to offer recording)

Purpose: Used only to notify you when a new run appears on Strava so you can record it. A run is stored only if you choose a shoe and save it.

Storage: Tokens are kept in server-only storage and cannot be read by the app (client).

Control: You can disconnect Strava at any time in app Settings. Disconnecting revokes our access on Strava and deletes the stored tokens.

2.4 Account & Profile Information

Data Types:

• Email/password (for email sign-up)
• Social login information (Google, Apple, Kakao): name, email, profile picture
• Your selected run detection source (Apple Health / Health Connect / Strava / none)

Managed by: Supabase Auth

Purpose: Account authentication and management, syncing your data across devices.

2.5 Push Notification Token

Data Types: Your device's push notification token (Firebase Cloud Messaging) and your notification preference.

Purpose: Deliver app notifications such as Strava run detection. The token is removed when you log out.

2.6 Usage & Diagnostics Data

Data Types:

• Basic app usage statistics (events Firebase collects automatically, such as app opens and sessions)
• Crash reports (error logs, stack traces)

Processed by: Google Firebase (Analytics, Crashlytics)

Purpose: Monitor app stability and fix bugs.

Anonymization: Analytics data is collected in a non-identifiable form and never includes health data.

2.7 Device Information

Data Types:

• Platform (iOS/Android)
• App version
• Device model
• Network connection status

Purpose: Ensure feature compatibility and debugging.

3. How We Use Your Data

We use the collected information only for the following purposes:

• Mileage tracking: We calculate the total distance on each shoe and show how much is left.
• Run detection & recording: We detect runs finished on your watch or Strava, notify you, and record them on the shoe you choose.
• Replacement reminders: We let you know when a shoe is nearing the end of its lifespan.
• App improvement: We use crash reports and basic usage statistics to improve stability.
• Customer support: We respond to your inquiries and resolve technical issues.

What We Don't Do:

• ❌ We do NOT use your data for marketing or advertising.
• ❌ We do NOT sell or rent your data to third parties.
• ❌ We do NOT use health data for advertising or marketing, or share it with third parties.
• ❌ We do NOT send your personal information or run records to AI models.

4. Third-Party Services

We use the following third-party services to provide app functionality. Each service follows its own privacy policy, and we require them to provide equal or greater protection.

5. Data Storage & Security

Security Measures:

• Encryption in transit: All data is encrypted via HTTPS during transmission.
• Access control: Supabase Row Level Security (RLS) policies ensure you can access only your own shoes and runs.
• Token protection: Strava tokens are stored where only our server can access them.
• App authentication: Firebase App Check protects API calls.

Shoe photos: Shoe photos you upload are stored at a unique, hard-to-guess address so the app can display them; anyone who has that address can view the photo. Please do not upload photos that show your face or other personally identifying content.

Retention Period:

• We retain your data while your account is active.
• Health data remains in your account only as the run records you save (distance, start time, source) and is not shared externally.
• When you delete your account, all data is permanently deleted.

6. Your Rights

Under privacy laws, you have the following rights:

• Access: You can view your shoes and run records in the app at any time.
• Correction: You can edit or delete shoe details and run records.
• Deletion: You can delete your account, which permanently deletes all data. (Settings > Account)
• Withdraw consent: You can revoke health data access in your device settings and disconnect Strava in app Settings at any time. Push notifications can be turned off in app or device settings.
• Data portability: You have the right to move your data to another service.

To exercise these rights, please contact us using the information below.

7. Data Retention & Deletion

• Active accounts: We retain your data while you use the app.
• Account deletion: Upon deletion request, your profile, shoes, run records, uploaded shoe photos, Strava connection, and push token are immediately and permanently deleted.
• Individual deletion: When you delete a run or a shoe, that data is deleted right away.
• Health data disconnection: If you revoke access or change the detection source, we stop detecting new runs. Run records you already saved are deleted when you delete your account.
• Strava disconnection: Disconnecting immediately revokes our Strava access and deletes the stored tokens.

8. Children's Privacy

Have2Run is not intended for children under the age of 14. We do not knowingly collect personal information from children under 14. If we discover such information, we will delete it immediately.

9. Changes to This Policy

This Privacy Policy may be updated due to changes in laws or our services.

• Significant changes: We will notify you via in-app notification and email in advance.
• Minor changes: We will update this page and revise the "Last Updated" date.

Changes will take effect 7 days after notification.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: privacy@have2run.com

11. GitHub Pages Hosting Notice

This privacy policy page is hosted on GitHub Pages. GitHub may collect visitor IP addresses for security purposes. For more information, see the GitHub Privacy Statement.