Back to home

Rutz - Privacy Policy

Last Updated: June 12, 2026 Effective Date: June 12, 2026

Rutz ("the App," "we," "us," or "our") is an AI-powered running coaching application for iOS, developed and operated by Itay Naim, based in Israel. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

By using Rutz, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account Information

When you create a Rutz account, we collect:

  • Your name (or a display name you choose)
  • Email address (provided via Apple Sign In or direct registration)
  • Basic profile details you provide: age, weight, height, maximum heart rate, running experience level, and race goals

1.2 Apple Health (HealthKit) Data

When you grant HealthKit permission, we read the following data types from Apple Health with your explicit permission:

  • Workouts: running-related workouts (including runs recorded as walking, hiking, mixed cardio, track & field, or high-intensity interval training), with their duration, distance, and energy burned
  • Workout routes: GPS route data recorded with your workouts
  • Heart rate data: heart rate, resting heart rate, and heart rate variability (HRV)
  • Running dynamics: stride length, ground contact time, vertical oscillation, and running power
  • Activity metrics: active energy burned, walking/running distance, and step count
  • Fitness metrics: VO2 max estimates
  • Sleep: sleep analysis (sleep stages and duration)

Our HealthKit access is read-only - we do not write data to Apple Health.

1.3 User-Provided Information

You may voluntarily provide additional information through the App, including:

  • Injury records: body area, injury type, severity, status, and notes
  • Daily check-ins: sleep quality, energy level, muscle soreness, and free-form notes
  • AI coach conversations: questions you ask the AI coach and the responses generated

1.4 Automatically Collected Information

When you use the App, we automatically collect minimal technical data:

  • Device language/locale preference
  • App version and iOS version (via standard HTTP headers)
  • Server request logs (timestamps, endpoint accessed, response status)

We do not use any third-party analytics, tracking, or advertising SDKs. We do not collect device identifiers (IDFA), advertising identifiers, or hardware fingerprints.

2. How We Collect Your Data

2.1 Apple Health (HealthKit)

We access your workout and health data through Apple HealthKit on your device. You must explicitly grant HealthKit permission for each data type. We access your data in read-only mode - we never write data back to Apple Health or modify your Health data in any way.

You can revoke HealthKit access at any time in iOS Settings → Privacy & Security → Health, which will stop all future data retrieval.

2.2 Direct Input

Profile information, injury records, daily check-ins, and AI coach conversations are collected directly from your interactions with the App.

2.3 Apple Sign In

If you use Apple Sign In, Apple provides us with your name and email address (or Apple's private relay email, if you choose to hide your email). We do not receive your Apple password or any other Apple account data.

3. How We Use Your Data

We use your data for the following purposes:

  • AI-powered coaching: Your activity data, health metrics, and training history are analyzed by AI models to generate personalized coaching recommendations, run analyses, weekly summaries, and answers to your training questions.
  • Training plan management: We track your progress against your training plan and provide adaptive recommendations based on your performance and recovery.
  • Fitness scoring: We compute composite fitness scores (including aerobic fitness, training load, recovery, and running economy metrics) to give you a holistic view of your training status.
  • Trend analysis: We analyze your data over time to identify performance trends, detect anomalies, and generate insights about your training.
  • App functionality: To operate the App, sync your data, and provide the core features you expect.

We do not use your data for advertising, marketing profiling, or any purpose unrelated to providing you with running coaching.

4. Third-Party Services

Rutz integrates with the following third-party services:

4.1 Google (AI Processing - Gemini API)

We use Google's Gemini API to power the coaching features of the App. When you interact with the AI coach or receive run analyses, the following data is sent to Google:

  • Sent: Activity metrics (distance, pace, heart rate, cadence, training load), health summaries (HRV, sleep, readiness), recent training history, and your question or conversation context.
  • Not sent: Your name, email address, Apple ID, precise GPS coordinates or routes, device information, or any other personally identifiable information. (Approximate activity coordinates are shared only with the weather service in Section 4.3 - never with the AI provider.)

Google processes the data in real time to generate coaching responses. We use Gemini on a paid API plan (Tier 1); under Google's paid-service data terms, this data is not used to train Google's AI models, and is not permanently stored beyond the duration needed to process the request. For details, refer to the Gemini API Additional Terms of Service and Google's Privacy Policy.

4.2 Supabase and Railway (Cloud Hosting)

Our backend application runs on Railway (EU West region), and your data is stored in a PostgreSQL database managed by Supabase, hosted on AWS in Frankfurt, Germany (eu-central-1, EU). Data is encrypted in transit via HTTPS. Their privacy practices are governed by Supabase's Privacy Policy and Railway's Privacy Policy.

4.3 OpenWeatherMap (Weather Enrichment)

To add weather context to a run (temperature and conditions), we send the approximate coordinates of an activity to the OpenWeatherMap API. No account details, name, email, or other identifying information is sent. OpenWeatherMap's practices are governed by OpenWeatherMap's Privacy Policy.

4.4 Apple (App Distribution)

The App is distributed through the Apple App Store. Apple may collect data related to your download and use of the App in accordance with Apple's Privacy Policy.

5. Data Storage and Security

5.1 Where Your Data Is Stored

Your data is stored in a PostgreSQL database managed by Supabase, hosted on AWS in Frankfurt, Germany (eu-central-1, EU). Sensitive credentials and access tokens are encrypted at rest before storage.

5.2 Security Measures

We implement the following security measures to protect your data:

  • Encryption in transit: All communication between the iOS app and our server uses HTTPS/TLS encryption.
  • Secure credential management: All API keys, passwords, and tokens are stored as encrypted environment variables - never hardcoded in source code.
  • Parameterized database queries: All database operations use parameterized SQL to prevent injection attacks.
  • Minimal data exposure: We send only the minimum necessary data to AI APIs, excluding all personally identifiable information.
  • No third-party tracking: We use zero analytics SDKs, advertising frameworks, or tracking tools.

5.3 Limitations

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.

6. Data Retention and Deletion

6.1 Retention

Your data is retained for as long as your account is active and you continue to use the App. AI conversation history (your questions and the AI coach's responses) is stored to maintain coaching continuity.

6.2 Deletion

You may request deletion of all your data at any time. Upon deletion, we will permanently remove:

  • All activity data and per-kilometer splits
  • Daily health metrics
  • Training plan data and progress
  • AI coaching history and analyses
  • Runner profile and fitness scores
  • User profile information (name, age, weight, etc.)
  • Injury records and daily check-ins

To request deletion, use the "Delete Account" option in the App's Settings, or contact us at itaynaim@runcoach.net. We will process deletion requests within 30 days.

6.3 Post-Deletion

After deletion, some data may temporarily persist in server backup systems for up to 30 additional days before being fully purged. Data that has already been sent to Google for AI processing cannot be retroactively deleted from Google; see Section 4.1 for Google's data-usage terms.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

7.1 For All Users

  • Access: Request a copy of the data we hold about you.
  • Correction: Request correction of inaccurate data.
  • Deletion: Request deletion of all your data (see Section 6).
  • Withdraw consent: Revoke HealthKit access in iOS Settings, or delete your Rutz account at any time.
  • Data portability: Request your data in a machine-readable format.

7.2 For EU/EEA Users (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority. Our legal basis for processing your data is your explicit consent (granting HealthKit access, using AI coaching features) and the legitimate interest of providing the App's services.

Your data is stored in Frankfurt, Germany (eu-central-1, EU), and our application servers run in Railway's EU West region, meaning your data is stored within the EU.

Automated processing and AI. To provide coaching, Rutz uses automated processing - including a third-party AI model (Google Gemini) - to analyze your activity and health data and generate training recommendations, readiness and recovery scores, and answers to your questions. Because this involves health data, a special category of personal data under Article 9 GDPR, we process it only on the basis of your explicit consent, which you give when you enable HealthKit access and use the AI coaching features. You may withdraw consent at any time by revoking HealthKit access or deleting your account. These automated outputs are informational and advisory only: they do not produce legal or similarly significant effects, are not used to make decisions about you that you cannot override, and you remain free to disregard them.

7.3 For Israeli Users

If you are located in Israel, your data is protected under the Israeli Privacy Protection Law, 5741-1981 (חוק הגנת הפרטיות). You have the right to access, correct, and delete your personal data. You may contact the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות) with any concerns.

7.4 Exercising Your Rights

To exercise any of these rights, contact us at itaynaim@runcoach.net. We will respond to your request within 30 days.

8. Data Sharing

We do not sell, rent, or trade your personal data to any third party.

We share data only with the third-party services described in Section 4 (Google, Supabase, Railway, OpenWeatherMap, Apple), and only to the extent necessary to provide the App's core functionality. We will never share your data with advertisers or data brokers.

We may disclose your data if required by law, court order, or governmental request, or if necessary to protect our rights, property, or safety.

9. Children's Privacy

Rutz is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at itaynaim@runcoach.net and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by other appropriate means before the changes take effect. The "Last Updated" date at the top of this policy will always reflect the most recent revision.

Your continued use of the App after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Itay Naim Rutz Email: itaynaim@runcoach.net Location: Israel

This Privacy Policy is written in English. In the event of any conflict between translated versions and the English version, the English version shall prevail.