Privacy notice

Who is responsible

mypb.run on this site is run by Lukasz Dechnik, who is responsible for your data. Write to privacy@mypb.run with any question or request about it.

Why we use your data

We use your data to provide the service you signed up for, and for nothing else. The AI features are the exception, because they rest on your consent, which you can withdraw at any time by switching them off in Settings. We do not sell your data or use it for advertising.

Your account

Your email address, which is how you sign in and how we reach you; the name you give; the language you choose and the one your browser asked for when you last signed in; and your time zone.

Signing in

A sign-in code is valid for 10 minutes, and we keep only a one-way digest of it, never the code itself.

Each browser or device you sign in on is a session. We keep its IP address, the user agent of the browser or app, and when it was last used. For the mobile and desktop apps we also keep the device name and platform the app gives, and the app version it reports when it signs in. A session's token is kept only as a digest.

A browser session ends after 30 days without use, or after 90 days at most. A mobile or desktop app session ends after 90 days without use, or after 365 days at most. A session you sign out of or revoke is deleted 30 days later. You can see and revoke every session in Settings.

Training

The activities you upload as GPX, TCX or FIT files or sync from Strava, with what they record — time, distance, heart rate, pace, altitude, power, cadence, laps and the positions along the way — and the original file. From them we work out your personal bests and training load. Your training profile keeps what you enter there, such as your birth date, weight, heart-rate and pace thresholds and zones. We also keep your gear and the results you record for your races.

Your activities, their maps and their routes are shown only to you.

If you connect Strava, we keep your Strava profile and its access tokens, encrypted, to sync your activities, and we remember the activities you deleted, or that a file you uploaded replaced, so that a sync does not bring them back. When a file you upload is the same session as an activity synced from Strava, the file replaces it and nothing Strava sent for it is kept. You can disconnect Strava in Settings.

You can make a segment from a stretch of one of your activities. We keep a copy of that stretch's line, with its length, climb and elevation profile, and the activity it was cut from. Each time one of your activities runs a segment, we keep that effort as times and figures only — when it started, how long it took, and the heart rate, cadence and power recorded on it — and never another position. Segments and their efforts are shown only to you, are never sent to the AI agents, and are kept until you delete them or your account. If you disconnect Strava and choose to delete the synced activities, a segment cut from one of them is cut again from your most recent effort on it in an activity of your own, or deleted when there is none.

You can import a training plan as a file, or let an app you connect write part of it. For each import we keep the plan's name, the file's name, its dates and its heart-rate zones, and for each workout its name, sport, steps and notes; for an import a connected app wrote, we also keep that app's name and address. The file or document itself is not kept. Your plan is shown only to you and to the apps you connect with access to it, and is never sent to mypb.run's AI agents. A workout is kept until the import it came from is removed or replaced by a later import, or until your account is deleted. When a connected app replaces part of your plan, the workouts it replaced are kept for 30 days so that you can undo the change, and are deleted within the hour after that.

Races and race plans

Your races, the event edition each one is linked to, and everything in its plan, including stops, lines, kit ticks and bags, together with the templates and nutrition products you keep. When a line is marked done, we record who marked it and when. When you invite someone to crew or follow a race, we keep the email address you invited, and once they accept, the invitation is tied to their account. Their access ends 7 days after the race ends.

When one of your activities follows the course of a race you are entered in, we keep where along the course it ran and the time at each point, for as long as the activity is kept, and nothing of where the course is. From this your plan shows the times you have already run each of its legs in. You see all of them. Crew you invited see those from activities you uploaded as files, as times and dates only, never the activity; a time from an activity synced from Strava is shown to you alone, and people you invited only to follow see none.

What you add to or change in the shared event catalog is visible to every signed-in account and is recorded with your account, as are the suggestions and objections you make.

Live tracking

When you or your crew add a tracker link (Garmin LiveTrack or Poltrax) to a race, the link is checked once and then thrown away; we never store it. We keep which service it is, the identifiers the link names (encrypted), and only the latest reading, which is where the tracker last reported the runner, how far along the course that is and when. Nothing earlier is kept, no trail is recorded and the reading is never public. We read the tracker only while the race is on, and everything about it is deleted 7 days after the race ends.

What we never collect

Neither the website nor the mobile or desktop app asks for or collects the location of the phone or computer you use, and the apps' connection to us accepts no position of the device at all. The only positions we hold are the ones recorded in activities you upload or sync, and a tracker's latest reading during a race someone chose to track.

The mobile and desktop apps

The mobile app signs in with the same emailed code and keeps its session token in your phone's secure storage. It keeps the last race plan it received on the phone so that you can read it without a connection, and it drops that plan when your access to the race ends. With every request it sends its platform, version and build number. We read these to tell an outdated app to update, and we do not keep them.

The desktop app signs in the same way and keeps its session token in your computer's credential store. When you plug in your watch, it reads the activity files on it and sends the new ones to us as uploads, which are kept like any file you upload here. On the computer it keeps only a fingerprint (a digest) of each file it has sent and the time of the newest file on each watch, never copies of the files. Before sending, it may send us those fingerprints to ask which files we already have; we answer from what we hold and keep nothing of the question. If you allow it for a watch, it also adds the workouts planned for the coming days to that watch, and removes the ones it added once they are past, changed or no longer planned. It changes or removes nothing else on it; on the computer it keeps only a fingerprint of each workout file it added. Like the mobile app, it sends its platform, version and build number with every request.

Connected apps

You can connect an app, such as an AI assistant, to your account in Settings → Connected apps, and choose whether it may only read your training plan or also change it. The app then receives the planned workouts it asks for, and with them each plan's name and heart-rate zones, when it was imported, whether it was uploaded or written by a connected app (with that app's name and address), and today's date where you are. Nothing else from your account reaches it. What it does with them is governed by that app's own terms, not ours.

For each connection we keep the app's name and address, what you allowed it to do, digests of its tokens, the network address and user agent of the app's request that connected it, and when it was connected and last used. A connection ends when you disconnect it in Settings → Connected apps, after 60 days without use, or after 365 days at most. What the app writes is listed with your plan's imports under its name.

Telegram

If you link Telegram in Settings, we keep your Telegram chat identifier (encrypted), the name Telegram shows and the outcome of the last message sent to you, never its text. Nothing you write to the bot is kept. You can unlink Telegram at any time.

Notices about your races

When the event one of your races is linked to changes its course, aid stations, start, cutoffs, distance or required kit, we tell you by mail and, if you linked it, on Telegram. The message names your race, how many changes wait and what kind they are, and links to the review; it never contains the changed values. We keep your choice of mail and Telegram for these notices, and for each notice when it was sent and whether each channel delivered it, never its text, for 30 days. Only you are told, never your crew. You can switch either channel off in Settings → Notifications.

AI features

The coach and the other AI agents are available only with an API key of your own, and only after you accept the consent screen. We record which version you accepted and when. Your conversations are stored, including any image you attach. When you use the agents, your messages and the training data an agent reads to answer are sent to the AI provider you chose. Positions, routes and course maps are never sent.

Each API key you store is kept encrypted, is never shown again, and is sent only to the provider it belongs to, with your own requests. It is deleted when you remove it in Settings → AI assistant or when your account is deleted. The provider you chose bills you directly for what your agents send it; we never see or handle that payment.

The planner, which drafts a race's plan for its runner, also sends that race's plan to the AI provider: its lines, notes, stop times and hourly targets, including what crew and viewers wrote on it. It never sends who wrote or ticked anything. What it proposes is kept with the conversation until you delete it; what you apply becomes part of your plan.

The coach and the planner keep short memories about you between conversations: what you write in Settings → Assistant memory and what an agent remembered from a conversation, with which agent and conversation it came from. They are sent to the AI provider with every conversation and kept until you delete them, which you can do there at any time. A memory an agent wants to keep about your health is kept only once you confirm it; one you leave unanswered is deleted after 30 days.

Activities synced from Strava are not shown to the AI features. Once a file you upload replaces one, it is your file's activity and is treated like any other upload.

Whether the provider keeps what it is sent depends on the provider, and the consent screen says which applies to you. For each request we keep a usage record of which agent and model, how many tokens, the cost and the timings, with no message, image or answer in it. You can switch the AI features off in Settings.

What your browser keeps

A session cookie that keeps you signed in; it is encrypted and scripts cannot read it. Your theme and the width of the assistant panel, stored in your browser only. The race-day view of a race you open, kept for reading without a connection until your access to that race ends. We use no advertising or analytics cookies and no third-party trackers.

Who else receives data

These services receive only what they need:

• The mail server that delivers sign-in codes, invitations and notices about your races receives the recipient's address and the message.
• Strava, if you connect it, receives requests for your own activities, made with your tokens.
• The AI providers you chose (OpenAI, Anthropic or OpenRouter) receive what is described above, with your own API key, once you have stored a key and consented. Each bills you directly.
• Garmin LiveTrack and Poltrax receive requests for the tracker that was added, only while the race is on.
• Telegram, if you link it, receives the messages sent to you.
• Apps you connect receive the planned workouts they ask for and the details of the plans they came from, within what you allowed them to do.
• The object storage that holds uploaded files and activity recordings.
• A text-classification service (TypeSafe) is asked narrow questions about catalog data and public web pages, and is never sent anything you own or anything that identifies you.
• When an agent researches a race, it reads public web pages and searches through a search service we run. These requests name the race being looked for, not you.

How long we keep it

Sign-in codes are kept for 10 minutes, sessions as described above, and tracker readings until 7 days after the race ends. The record of a notice sent about your race is kept for 30 days. Everything else you add is kept while your account exists, until you delete it or ask us to. The usage records of the AI features stay with your account after the conversations they describe are deleted.

Your rights

You can ask for a copy of your data, to have it corrected or deleted, to receive it in a form you can take elsewhere, and to object to its use. You can also complain to a data protection authority, such as the one where you live.

Some of this you can do yourself. You can revoke sessions, disconnect Strava, unlink Telegram, switch off notices about your races by mail or Telegram, switch off the AI features, remove a stored API key, delete what the AI agents remember about you, and delete your activities and races.

For everything else, including deleting your account, write to privacy@mypb.run.

Changes to this notice

When what we collect changes, this page changes with it.