Privacy Policy
1. Who we are
Runtala is a free running performance platform: training plans, analytics, an AI coach, virtual races and community. The Service is operated as “Runtala” without a registered company; there is no legal entity, street address or company registration number to list here. When this policy says “we”, it means the Runtala service and its administrators.
2. Data we collect
Account data. When you register we collect your name, email address, country, city, gender, age group, goal distance and (optionally) date of birth. Your password is stored as a salted hash, never in plain text. When you sign in with Google we receive only your Google-verified email address, name and Google account identifier.
Activity data. Activities reach Runtala in three ways only: synchronisation from Strava, synchronisation from COROS, or a GPX file you upload from your device or app. Manual entry is not available. For each activity we store the date, distance, duration, pace, sport (run, walk, cycle, swim or strength), and heart rate, cadence, power, training load and elevation where the source provides them. Activities that fail validation (for example an impossible pace, a distance over 250 km, or a future date) are flagged, excluded from totals and leaderboards, and reviewed by an administrator.
Device and fitness profile data (COROS). When you connect COROS we store the fitness profile it reports: VO2max (an estimate), Running Level, threshold pace, race predictions, recovery status and resting heart rate. Threshold heart rate is not provided by COROS and is not stored.
AI Coach data. Your messages to the AI Coach and the last 10 conversation turns are stored so the coach can keep context. Each request also uses your last 60 verified activities and your 28-day totals. The coach never receives your password or your device tokens.
Email verification. When email verification is active, new accounts receive a 6-digit code by email. We store only the SHA-256 hash of the code, never the code itself. Codes expire after 15 minutes, allow at most 5 wrong attempts, and at most 3 resends per hour.
Technical data. Your session token is stored in your browser’s local storage and expires after 12 hours; your language and currency preferences are also stored locally. The Service sets no tracking cookies. Registration is protected by a Cloudflare Turnstile captcha, and registration is rate-limited (5 attempts per hour per IP address); login is temporarily blocked after 10 failed attempts for one email address.
3. How we use your data
We use your data only to run the Service: your profile and dashboard, training plans and analytics, the AI Coach, virtual-race registration and results, badges, medals and certificates, and leaderboards. We do not sell personal data, and we show no advertising.
4. What other people can see
Leaderboards show your name, country, city, gender, total distance, number of activities and best pace. Your email address is never shown publicly. Accounts that have not verified their email (while verification is enforced), and accounts that are pending or suspended, do not appear on leaderboards. Your individual activities are visible in the contexts the product provides (for example race contribution feeds and admin review); they are never sold or shared with advertisers.
5. Third-party services
Runtala works with these processors to provide the Service:
- Strava — OAuth sign-in and activity sync, scope
activity:read_all. Access tokens last about 6 hours and are refreshed automatically. - COROS — OAuth sign-in and activity sync through the official COROS MCP, scope
offline_accessonly. Access tokens last 30 days and refresh tokens rotate on use. - Google — “Sign in with Google”, scopes
openid email profile. - Google Gemini — the AI Coach’s language model, used only when you message the coach (at most 20 Gemini messages per user per day; after that the coach falls back to its rule-based answers).
- Cloudflare — hosting (Pages), database (D1) and bot protection (Turnstile).
- Resend — sends the email verification codes from [email protected].
Access and refresh tokens for Strava and COROS are encrypted with AES-256-GCM before they are stored, and the encryption key is never written to the database. We never see, ask for, or store your Strava, COROS or Google password. Disconnecting a service in Connected Devices deletes the stored connection and its tokens.
6. Data retention
Your account and activity data are kept while your account is active. Session tokens expire after 12 hours. Verification codes expire after 15 minutes. The AI Coach keeps only the last 10 conversation turns. Sync logs are kept for troubleshooting. There is no fixed deletion schedule beyond account deletion below.
7. Deleting your account and data
Ask a Runtala administrator to delete your account. Deletion is permanent and removes your sessions, activities, race registrations, medals, certificates, training plans, follows, club memberships, coach messages, device connections, sync logs and the account itself, and is recorded in the audit log. Disconnecting Strava or COROS alone removes only that connection and its tokens — your Runtala account and activities stay until the account itself is deleted.
8. Your choices
You can edit your profile (name, city, date of birth), disconnect Strava, COROS or Google at any time in Connected Devices, and choose whether to use the AI Coach. To request a copy of your data or the deletion of your account, contact a Runtala administrator (see §10).
9. Children
Runtala is intended for users aged 10 and older (registration validates the age range 10–100). We do not knowingly collect data from children under 10.
10. Contact
To ask about your data, contact Runtala support at [email protected]. There is no separate company contact address.
11. Changes to this policy
We may update this policy as the Service changes. The “Last updated” date at the top will change with it, and continued use of the Service after an update means you accept the updated policy.
Kebijakan Privasi (Bahasa Indonesia)
1. Siapa kami
Runtala adalah platform performa lari gratis: rencana latihan, analitik, AI coach, virtual race, dan komunitas. Layanan ini dioperasikan sebagai “Runtala” tanpa perusahaan terdaftar; tidak ada badan hukum, alamat jalan, atau nomor registrasi perusahaan yang dapat dicantumkan di sini. Kata “kami” dalam kebijakan ini berarti layanan Runtala dan para administratornya.
2. Data yang kami kumpulkan
Data akun. Saat mendaftar kami mengumpulkan nama, alamat email, negara, kota, jenis kelamin, kelompok usia, target jarak, dan (opsional) tanggal lahir Anda. Kata sandi disimpan sebagai hash dengan salt, tidak pernah dalam bentuk teks biasa. Saat masuk dengan Google, kami hanya menerima alamat email terverifikasi Google, nama, dan pengenal akun Google Anda.
Data aktivitas. Aktivitas masuk ke Runtala hanya melalui tiga cara: sinkronisasi dari Strava, sinkronisasi dari COROS, atau berkas GPX yang Anda unggah dari perangkat atau aplikasi Anda. Input manual tidak tersedia. Untuk setiap aktivitas kami menyimpan tanggal, jarak, durasi, pace, jenis olahraga (lari, jalan, sepeda, renang, atau strength), serta detak jantung, kadens, power, training load, dan elevasi bila sumbernya menyediakan. Aktivitas yang gagal validasi (misalnya pace yang mustahil, jarak di atas 250 km, atau tanggal di masa depan) diberi status flagged, tidak dihitung dalam total dan leaderboard, dan ditinjau oleh administrator.
Data perangkat dan profil kebugaran (COROS). Saat Anda menghubungkan COROS, kami menyimpan profil kebugaran yang dilaporkannya: VO2max (estimasi), Running Level, threshold pace, prediksi lomba, status recovery, dan resting heart rate. Threshold heart rate tidak dikirim oleh COROS dan tidak disimpan.
Data AI Coach. Pesan Anda kepada AI Coach dan 10 pergantian percakapan terakhir disimpan agar coach dapat menjaga konteks. Setiap permintaan juga memakai 60 aktivitas terverifikasi terakhir Anda dan total 28 hari. Coach tidak pernah menerima kata sandi atau token perangkat Anda.
Verifikasi email. Saat verifikasi email aktif, akun baru menerima kode 6 digit melalui email. Kami hanya menyimpan hash SHA-256 dari kode tersebut, bukan kodenya. Kode kedaluwarsa setelah 15 menit, maksimal 5 kali percobaan salah, dan maksimal 3 kali kirim ulang per jam.
Data teknis. Token sesi Anda disimpan di local storage browser dan kedaluwarsa setelah 12 jam; preferensi bahasa dan mata uang juga disimpan secara lokal. Layanan ini tidak memakai cookie pelacak. Pendaftaran dilindungi captcha Cloudflare Turnstile dan dibatasi (5 percobaan per jam per alamat IP); login diblokir sementara setelah 10 kali gagal untuk satu alamat email.
3. Cara kami memakai data Anda
Kami memakai data Anda hanya untuk menjalankan Layanan: profil dan dashboard, rencana latihan dan analitik, AI Coach, pendaftaran dan hasil virtual race, badge, medali dan sertifikat, serta leaderboard. Kami tidak menjual data pribadi dan tidak menampilkan iklan.
4. Apa yang bisa dilihat orang lain
Leaderboard menampilkan nama, negara, kota, jenis kelamin, total jarak, jumlah aktivitas, dan pace terbaik Anda. Alamat email tidak pernah ditampilkan secara publik. Akun yang belum memverifikasi email (saat verifikasi diberlakukan), serta akun pending atau suspended, tidak muncul di leaderboard. Aktivitas individual Anda terlihat dalam konteks yang disediakan produk (misalnya feed kontribusi lomba dan tinjauan admin); aktivitas tidak pernah dijual atau dibagikan kepada pengiklan.
5. Layanan pihak ketiga
Runtala bekerja dengan pemroses berikut untuk menyediakan Layanan:
- Strava — OAuth dan sinkronisasi aktivitas, scope
activity:read_all. Access token berlaku sekitar 6 jam dan diperbarui otomatis. - COROS — OAuth dan sinkronisasi aktivitas melalui COROS MCP resmi, scope hanya
offline_access. Access token berlaku 30 hari dan refresh token berputar setiap dipakai. - Google — “Sign in with Google”, scope
openid email profile. - Google Gemini — model bahasa AI Coach, hanya dipakai saat Anda mengirim pesan ke coach (maksimal 20 pesan Gemini per pengguna per hari; setelah itu coach kembali ke jawaban berbasis aturan).
- Cloudflare — hosting (Pages), database (D1), dan perlindungan bot (Turnstile).
- Resend — mengirim kode verifikasi email dari [email protected].
Access token dan refresh token Strava dan COROS dienkripsi dengan AES-256-GCM sebelum disimpan, dan kunci enkripsinya tidak pernah ditulis ke database. Kami tidak pernah melihat, meminta, atau menyimpan kata sandi Strava, COROS, atau Google Anda. Memutuskan koneksi di Connected Devices akan menghapus koneksi yang tersimpan beserta tokennya.
6. Penyimpanan data
Data akun dan aktivitas Anda disimpan selama akun Anda aktif. Token sesi kedaluwarsa setelah 12 jam. Kode verifikasi kedaluwarsa setelah 15 menit. AI Coach hanya menyimpan 10 pergantian percakapan terakhir. Log sinkronisasi disimpan untuk keperluan troubleshooting. Tidak ada jadwal penghapusan tetap selain penghapusan akun di bawah ini.
7. Menghapus akun dan data Anda
Mintalah administrator Runtala untuk menghapus akun Anda. Penghapusan bersifat permanen dan menghapus sesi, aktivitas, pendaftaran lomba, medali, sertifikat, rencana latihan, follows, keanggotaan klub, pesan coach, koneksi perangkat, log sinkronisasi, dan akun itu sendiri, serta dicatat dalam audit log. Memutuskan koneksi Strava atau COROS saja hanya menghapus koneksi dan token tersebut — akun Runtala dan aktivitas Anda tetap ada sampai akun itu sendiri dihapus.
8. Pilihan Anda
Anda dapat mengubah profil (nama, kota, tanggal lahir), memutuskan koneksi Strava, COROS, atau Google kapan saja di Connected Devices, dan memilih apakah memakai AI Coach. Untuk meminta salinan data atau penghapusan akun, hubungi administrator Runtala (lihat §10).
9. Anak-anak
Runtala ditujukan untuk pengguna berusia 10 tahun ke atas (pendaftaran memvalidasi rentang usia 10–100). Kami tidak dengan sengaja mengumpulkan data dari anak di bawah 10 tahun.
10. Kontak
Untuk bertanya tentang data Anda, hubungi dukungan Runtala di [email protected]. Tidak ada alamat kontak perusahaan yang terpisah.
11. Perubahan kebijakan ini
Kami dapat memperbarui kebijakan ini seiring perubahan Layanan. Tanggal “Terakhir diperbarui” di atas akan berubah, dan terus memakai Layanan setelah pembaruan berarti Anda menerima kebijakan yang diperbarui.