Privacy policy

Effective 27 October 2026 (updated with the Android app)

In short: we use your running data only to give you your analysis. We don't sell it, we don't show ads, and we don't send it to AI services. Nobody else can see your data. You can delete everything at any time.

performance.app ("the app", "we", "us") is operated by Enigma Data Nexus LLC, a limited liability company registered in Wyoming, United States. This policy explains what we collect, why, who it's shared with, and your choices. Contact: enigmadatanexus@gmail.com.

What we collect

Your account: your name, email address and profile picture from Google when you sign in with Google.
Activities from apps you connect: when you connect Strava or Garmin, we copy your activities: date and time, sport, distance, duration, pace and speed, heart rate, cadence, elevation, and the recording device. We also store second-by-second data (such as heart rate and pace over the run) to calculate splits and zones. When you connect Garmin, we may also receive health data you allow, such as resting heart rate and sleep.
Things you tell us: units, weight, maximum heart rate, goals, races and targets.
Technical data: a session cookie that keeps you signed in, your browser's time-zone offset (so "today" and "this week" match your clock), and standard server logs used to keep the service running and secure.

Heart rate and other health-related data are sensitive. We collect them only because you connect an app to have them analysed, and you can remove them at any time.

How we use it

To show you your training load, fitness and fatigue, zones, progress, goals, race predictions and run summaries.
To keep the service secure, fix problems and improve it.
To contact you about your account or important changes to the service.

All analysis is done by our own code on our own servers. We do not use your data to train machine-learning or AI models, and we do not send it to AI platforms.

Garmin data

If you connect your Garmin account, Garmin sends us the activities and health data you allow in your Garmin Connect data-sharing settings, such as runs (time, distance, pace, heart rate, cadence, elevation, device) and daily health summaries (such as resting heart rate and sleep).

How we use it: only to show you your own training analysis in performance.app: training load, fitness and fatigue, zones, progress, goals, race predictions and run summaries. It is linked to your account and shown only to you.
Who processes it: Supabase (database hosting) and Render (application hosting), acting on our behalf. No other party receives Garmin data.
Not sold or shared: we never sell Garmin data or share it with third parties, and never use it for advertising.
No AI: Garmin data is not processed by AI systems, and neither it nor anything derived from it is used to train, evaluate or improve AI models. All analysis is done by our own rule-based code.
Your control: you can see your Garmin data in the app at any time; correct your profile settings under Me; ask us for an export by email; and withdraw consent by disconnecting Garmin in performance.app or removing performance.app in Garmin Connect (Settings → Connected Apps). When you disconnect, we delete the Garmin data we hold. Deleting your account removes everything.

Health Connect (Android app)

If you use the performance.app Android app and allow it, the app reads these from Health Connect on your phone: exercise sessions (runs), distance, heart rate, speed, steps and elevation gained. With your permission it can also read runs from before you connected. These may have been recorded by other apps you use, such as Strava, Samsung Health, Nike Run Club, adidas Running or Fitbit.

How we use it: only to show you your own training analysis in performance.app. It is linked to your account and shown only to you.
Who processes it: Supabase (database hosting) and Render (application hosting), on our behalf. No one else receives it.
Not sold, not for ads, no AI: we never sell this data, never use it for advertising, and it is not processed by AI systems or used to train AI models.
Read-only: the app never writes to or deletes anything in Health Connect.
Your control: turn access off any time in Health Connect → App permissions → performance.app. "Disconnect phone health apps" under Me deletes the runs we received this way. Deleting your account removes everything.

performance.app's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

What other people can see

Nobody. Your data is private to you: there are no public profiles or feeds. If you share a snapshot image from the app, you choose where it goes. Where Garmin data is shown, it is attributed to the Garmin device that recorded it.

Who we share it with

We do not sell, rent or trade your personal data, and we don't use advertising networks. We share data only with service providers that run the app for us, under their own security and privacy commitments:

Supabase: database hosting.
Render: application hosting.
Google: sign-in.
Strava and Garmin: only when you connect them, to receive your activities. We don't send your data back to them except what's needed to keep the connection working.

We may also disclose data if the law requires it, or to protect the rights and safety of our users or the service. These providers may store data in countries other than your own, including the United States.

How long we keep it

Your data stays while your account is open.
Disconnecting Strava or Garmin removes the activities we received from that app. When Garmin tells us you've disconnected or withdrawn permission, we delete your Garmin data.
Deleting your account (Me → Delete my account and data) permanently removes your account and all your data. Backups held by our providers expire within their normal cycle.

Your choices and rights

See and correct your data in the app; change or remove goals, races and settings at any time.
Get an export of your data: email us and we will send it in a common format (such as CSV or JSON) within 30 days.
Disconnect any connected app, or delete your account and all your data, from the Me tab.
Ask us for a copy of your data, or ask any question about it, by emailing enigmadatanexus@gmail.com. We reply within 30 days.

Depending on where you live (for example under the GDPR in the UK and EU, or US state privacy laws), you may have further rights to access, correct, delete, restrict or port your data, or to object to its use. Contact us to use them. We process your data to provide the service you asked for and, for health-related data, with your consent, which you can withdraw at any time.

Security

All traffic is encrypted (HTTPS). Access tokens for connected apps are stored on our servers and never shown in the app. Access to the database is restricted. No system is perfectly secure, but we take reasonable steps to protect your data and will tell you promptly if a breach affects you.

Children

performance.app is not intended for children under 13, and we don't knowingly collect their data. If you believe a child has signed up, contact us and we will delete the account.

Changes

If we change this policy we'll update the date above. If a change is significant, we'll tell you in the app before it takes effect.

Contact

Enigma Data Nexus LLC, Wyoming, United States
enigmadatanexus@gmail.com