Privacy Policy

This policy explains what data EasyRUN collects, for what purpose and legal basis, how long it is kept, and how to exercise your rights.

Last updated: July 17, 2026. (English translation of our Spanish policy; the Spanish version governs.)

1. Data controller

EasyRUN (Montevideo, Uruguay) is the controller of the personal data described in this policy. For any question or request about your data: info@easyrun.life.

2. What data EasyRUN collects

EasyRUN collects the data needed to create and operate athlete, coach and team accounts:

First name, last name, email and profile photo.
Team, memberships, classes, training plans, races, results and challenges.
Trainings you log, comments, reactions and notification preferences.
Basic technical data such as account creation date, access date and connection status.

3. Data obtained from Strava

If you connect Strava (express authorization via the official OAuth flow, with read-only activity permission), EasyRUN imports only your foot-running activities. The data may include:

Strava athlete identifier (to keep the connection).
Activity name or title, start date and time, and activity type.
Distance, duration, moving time, pace and elevation.
Public Strava URL of the activity when available.
Privacy or deletion status reported by Strava.

Retention limited to 7 days: in accordance with the Strava API policy, imported activities are kept in EasyRUN for a maximum of 7 days. Within that window you can turn them into your own records (share them with your coach, log them in your training log, or submit a race result); anything you do not confirm is deleted automatically. We do not store GPS polylines, heart rate or other physiological metrics, and we do not keep raw API responses.

EasyRUN does not request permission to create or modify activities on Strava, nor to access other sports. Strava data is not used in any AI/ML system or for advertising, and is never sold or shared with third parties.

4. Purposes and legal bases

Service delivery (performance of contract): show your trainings, plans, races, personal bests and progress; manage teams and classes.
Strava integration (consent, revocable at any time): suggest linking activities to your plan or races. Strava data is seen only by you; your coach sees only the records you confirm as your own.
Notifications (consent, configurable by type): reminders and alerts you enable.
Security and support (legitimate interest): prevent abuse, diagnose errors and provide support.

5. Retention periods

Data	Period
Imported Strava activities (unconfirmed)	Maximum 7 days from import.
Technical sync events (webhooks)	Maximum 7 days from processing.
Strava access tokens	Until you disconnect or revoke; deleted immediately.
Strava connection identifier (after disconnecting)	Kept as a minimal record that the connection existed, to let you reconnect; deleted with your account or on request.
Records you declared (training log, shared runs, results)	While your account exists, or until you request deletion.
Account and team data	While your account exists, or until you request deletion.

6. Data visible to other users

Some data may be shown within the community or team according to your settings: race results, achievements, public trainings, comments or reactions. Imported Strava activities are never shown to other users (not even to your coach), do not appear in the community feed, and are not aggregated in rankings.

7. Disconnecting Strava

You can disconnect Strava from your EasyRUN profile (Strava section) or revoke access from Strava's connected-apps settings. In both cases, EasyRUN automatically deletes the imported activities, their associated data and the access tokens, and confirms this to you (on-screen message when disconnecting from EasyRUN; notification if you revoke from Strava). Only the records you declared as your own are kept. If you delete an activity on Strava, that deletion is reflected in EasyRUN within 48 hours (usually within minutes).

8. Your rights

You may exercise at any time the rights of access, rectification, erasure, objection, restriction and portability of your data by writing to info@easyrun.life from the email associated with your account (or proving ownership). We respond within the applicable legal timeframes and confirm in writing when an erasure is completed. Many of these rights can also be exercised directly in the app (edit your profile, delete trainings, disconnect Strava).

9. Where data is stored and subprocessors

Data is stored on DigitalOcean servers (cloud infrastructure). Push notifications use browser Web Push messaging services. These providers act as processors under their own data-protection commitments; where they involve international transfers, they rely on recognized safeguard mechanisms (such as Standard Contractual Clauses). The list of subprocessors is available on request at info@easyrun.life.

10. Strava API usage data

Strava may monitor and collect technical usage data from the API (call volume, errors) under its own privacy policy, available at strava.com/legal/privacy.

11. Security

Access to data is limited to authenticated users and to the staff strictly necessary to operate or provide support. We use encrypted connections (HTTPS), protected credentials and role-based access controls. In the event of a security incident affecting personal data, we will notify affected users and the relevant providers (including Strava) within the required timeframes.

12. Changes to this policy

EasyRUN may update this policy to reflect product changes, legal requirements or integration adjustments. The current version will be publicly available on this page, with its last-updated date.