Privacy policy

Who is responsible

DIGT Consulting BV, Muidepoort 46, 9000 Gent, Belgium, company and VAT number BE0783.477.116, is responsible for your data (the “controller” under the GDPR). Questions? Email privacy@kurro.run.

1. What data we process

kurro processes the following categories of personal data so we can deliver your training plan, analytics and coaching advice:

• Account data: email address, name, birth year.
• Training data: activities from your watch brand (through Stridee or a direct connection), Strava, Apple HealthKit and/or activity files you import from your watch (distance, pace, heart rate, calories).
• Location data from Strava activities: for each Strava activity we store two location fields, the GPS start point and the route line. The start point is often close to your home. We use it to look up the local weather forecast and the elevation of where you train. The route line draws the small route preview in your activity list. We remove all other location data from Strava before we store an activity. The detailed route map on an activity page is loaded live from Strava each time you open it, and we do not store it. Activities from Apple HealthKit are stored without location. For an activity file you import yourself (FIT, GPX or TCX), we store the same two fields, the start point and the route line, and no other location data from the file.
• Health data (special category under Art. 9 GDPR): sleep (duration, stages, timing), resting heart rate, HRV, respiration, SpO₂, wrist temperature, steps - only if you explicitly consent, in HealthKit or when you connect your watch brand.
• Training goal, plan and the status of planned workouts. If you enter a race location for a goal, we also store its coordinates, which we look up from the place name you typed.
• Messages you exchange with the AI coach.
• Daily check-ins and readiness inputs, and menstrual-cycle logs if you turn on cycle tracking.
• Notification preference: whether you receive the weekly digest email and the first-week tips emails (both on for new accounts, you can turn each off in Settings or with the link in each email), and, only for the duration a link is valid, one hashed unsubscribe token per email type used solely to verify the link in that email; we never store the raw token, and it is replaced whenever a new email of that type is sent.

When you sign up you record these consents: terms, health data, the AI coach, a 30-day copy of your syncs and model learning (both explained below). The coach only sends something to OpenRouter and Microsoft Azure when you chat with it. If your account is older than that, the coach asks for its own consent the first time you use it. Terms stays account-lifetime only: the app is not usable without agreeing to it, so a standalone withdrawal would be a button with no real effect, and deleting your account is the only way to end it. Health data and AI coach are different: you can withdraw either one at any time from Settings → “Manage consent”, without deleting your account. Withdrawing health data permanently deletes the health and training history we derived from it, including your manual check-ins, taper notes, manually logged weight and menstrual-cycle logs (activities, health metrics, recovery scores, thresholds and more), and it turns cycle tracking and the heart-rate medication setting off; withdrawing AI coach permanently deletes your chat history and any pending proposals. Both take effect immediately and cannot be undone, this is a real, immediate stop: the following all check your health-data consent first and refuse to process anything new the moment you withdraw, not just a registrational preference: a wearable (Apple HealthKit) sync, manual activity entries, manual weight entries, check-ins, taper notes, and every Strava path (connecting or reconnecting your account, a manual sync, deep history sync, and incoming Strava webhook events). A reconnect after withdrawal is deliberately blocked, not treated as an implicit re-grant: use “Grant again” in Settings → “Manage consent” first. Menstrual-cycle logging checks this consent too, and so does turning cycle tracking or the heart-rate medication setting on, or saving a cycle length or medication note. Withdrawing health-data consent does delete those logs, and it switches cycle tracking off; switching it back on needs that consent again.

Improving our models

Separately, and with your sign-up consent, you allow your anonymised data to be aggregated with other athletes' to improve kurro's models for everyone. Cross-athlete model learning does not exist yet: nothing reads this consent or uses your data for it today, and it never affects your own plan. It is on for accounts created since 19 October 2026, and you can withdraw it at any time from Settings → “Manage consent”. Withdrawing only updates your consent record; there is no data to delete, since nothing uses it today.

Keeping a copy of your sync data

Separately, and with your sign-up consent, we keep an exact copy of each HealthKit sync you send us for up to 30 days, so that if we ever find a mistake in how we read your data, we can fix it and re-apply it to what you already sent, instead of asking you to sync everything again. It contains the same health data as the sync itself (including menstrual-cycle logs if your app sends them), and turning it on or off never changes your plan. It is on for accounts created since 19 October 2026, and this is the one consent that cannot simply be turned off with a plain toggle: turning it off deletes every stored copy immediately, from its row in Settings → “Manage consent”. The same immediate deletion also happens when a copy turns 30 days old, when you withdraw health-data consent, or when you delete your account.

AI assistants you connect yourself (optional)

You can connect an AI assistant such as Claude or ChatGPT to your kurro account, from Settings → “AI assistants”. Only if you do, that assistant can read your kurro data, including health data. With kurro Pro it can also change your plan, goals and activities. The company behind that assistant then handles your data under its own privacy policy. You can remove a connection at any time in the same place.

Data per source

This section says, for each source you can connect, what kurro reads, who receives it, how long we keep it, how you erase it, and whether it may reach an AI.

• You can connect a watch brand in two ways: through our device connection (Stridee, see “Processors”), or directly with kurro.
• A direct connection is not yet available to athletes for any watch brand.
• Where this section describes a direct connection, it applies once that connection is available.
• kurro uses data from every source only to provide kurro to you: your training plan, your training analysis and, where this section allows it, the AI coach.
• kurro never sells data from any source, never uses it for advertising, and shows no ads.
• Data from a direct connection is received and stored by Netlify (hosting and API functions) and Supabase (database and storage, in the EU, in Ireland).
• Through the device connection, the data first passes Stridee, as described under “Processors”.
• Where a source may reach the AI coach, OpenRouter and Microsoft Azure receive it when you chat with the coach, as described under “Processors”.
• Where a source may not reach an AI, nothing kurro derives from it does either: no training load, recovery, readiness, race predictions or session results.
• You still see all of it in the app.
• kurro keeps data from a source as long as your account is active, unless this section says it is erased sooner.
• Through the device connection, disconnecting a brand erases nothing: kurro keeps its activities and its sleep and recovery data until you withdraw your health-data consent or delete your account. While the brand is connected, you can stop sharing the sleep and recovery data; kurro then deletes that data, and the activities stay.
• When disconnecting a watch brand erases its data, the values kurro calculated from that data stay: training load, fitness, recovery scores and race predictions.
• Those values are deleted when you withdraw your health-data consent or delete your account.
• Disconnect: if you connected Garmin through Stridee, go to Settings → Connections and choose “Disconnect” next to Garmin. kurro then keeps your data, as described under “Processors”. If you connected Garmin directly, remove kurro's access in Garmin Connect. kurro then deletes the Garmin data it stored within 24 hours. Values kurro calculated from that data, such as your fitness and your plan, stay until you withdraw your health-data consent or delete your account.
• To see, correct, export or erase data from any source, see “Your rights”.

2. Legal basis

We process your data based on your consent (Art. 6(1)(a) GDPR) and for the performance of the contract (Art. 6(1)(b) GDPR) between you and kurro. For health data we rely on your explicit consent (Art. 9(2)(a) GDPR).

3. Processors

• Supabase (database + authentication). Our database runs in the EU (Ireland).
• Netlify (web app hosting).
• Strava (optional, only if you connect it to import activities).
• Stridee (optional, only if you connect a watch brand). It is our processor for device data: it passes the activities of the brand you connect to kurro, and, only if you agree to it, your sleep and recovery data (health data: sleep, heart rate variability, resting heart rate, breathing rate, blood oxygen, stress and daily activity such as steps). It receives your kurro account ID and the brand you pick. kurro keeps the activities and the sleep and recovery data, also after you disconnect the brand. They stay until you withdraw your health-data consent or delete your account. While the brand is connected, you can stop sharing the sleep and recovery data. kurro then deletes that data, and the activities stay. The processor keeps its own copy of events for 30 days. Stridee is a Swiss company (Zürich) and hosts the data in the EU (OVH, European Economic Area).Data from your Garmin is never sent to the AI coach or to any AI service, and is never shared through connected AI assistants (MCP).Whether data from a brand may reach an AI is set per brand, see “Data per source”.If you turn on “Sessions to your watch” (kurro Pro), the processor also passes the title, steps and targets of your planned sessions of the coming days, and the route files you upload, to your watch brand. A route file can contain times and heart rate. Turning it off removes the sessions kurro put on your watch.
• OpenRouter and Microsoft (AI coach, only when you chat with it). OpenRouter passes your messages and a summary of your training to an AI model that Microsoft Azure runs in the EU. That summary can include health data: heart rate, resting heart rate, HRV, sleep, weight, your profile (birth year, sex, height and, if you added one, your medication note) and, if you track it, your cycle status. Neither uses this data to train AI models under their terms.
• Apple (HealthKit: your health data stays on your device until you sync it. App Store billing: if you buy kurro Pro on iPhone, Apple handles the payment and tells us only the status of your subscription).
• Stripe (payments on the web). If you buy kurro Pro on the web, Stripe handles the payment. It receives your email address, billing address and payment details. We never see your full card number.
• Sentry (error monitoring). When something goes wrong in the app or on our server, a technical error report goes to Sentry so we can fix it. That report can contain the page address and technical details about your browser or the request. Sentry does not record your sessions.
• Resend (email delivery). It sends the weekly digest email and, in your first two weeks, a few short tips emails, unless you turn them off, so it receives your email address and the content of that email. It also sends internal service alerts to our own team.
• Open-Meteo (weather, elevation and place lookups). We send only coordinates or the race place name you typed, never your name, email address or account.
• OpenStreetMap, unpkg, cdnjs and GitHub (route map). When you open the route map of an activity, your browser loads the map images from OpenStreetMap and the map software and map icons from unpkg, cdnjs and GitHub. These servers see your IP address, and OpenStreetMap also sees which map area is shown.

kurro does not sell your data, and does not share it with third parties for advertising.

International transfers

Some of our processors are US companies: OpenRouter, Microsoft, Stripe, Sentry, Resend, Netlify and Apple. Supabase is a US company too. When your data goes to the US, we rely on the EU-US Data Privacy Framework if the company is certified under it, and otherwise on the EU standard contractual clauses. Switzerland, where Stridee is based, has an EU adequacy decision.

4. Retention periods

• Coach messages: up to 365 days, then automatically deleted.
• Internal logs of plan recalculations and of coach actions that failed: 90 days, then automatically deleted.
• Training and health data: as long as your account is active. On account deletion, all data is permanently removed within 30 days.
• Disconnecting Strava (or revoking access from Strava's side): your Strava activities are permanently removed within 30 days, whether or not you also delete your account. Activities from another source, or entries you added by hand, are kept.
• Model-improvement data (only while your consent stands): your source data follows the same account-lifetime retention above; withdrawing consent stops any future use immediately. Aggregated model parameters are anonymised and hold no personal data.
• Raw sync data copies (only while your consent stands): kept for at most 30 days, and deleted immediately, not just at the 30-day mark, when you turn the setting off, when you withdraw health-data consent, or when you delete your account.
• Weekly digest unsubscribe tokens: replaced (the previous one deleted) every time a new digest email is sent, so at most one is ever live per account.
• Accounting/tax data: 10 years, as Belgian law requires.
• Route files you upload to send to your watch: kept until you delete the route, withdraw your health-data consent or delete your account. Deleting a route also removes it from your Garmin. The records of the sessions kurro sent to your watch are removed at the latest 30 days after the session date.

5. Your rights

Under the GDPR you have the right to:

• Access and data portability: you can request a full, machine-readable JSON export of all your data at any time by emailing privacy@kurro.run. We respond within one month, as the GDPR requires.
• Rectification: you can edit your profile yourself in Settings.
• Erasure: the "Delete account" button in Settings wipes all your data and also revokes our app's access to your connected Strava account.
• Withdraw consent: health data and AI coach consent can each be withdrawn separately from Settings → “Manage consent” (see above), with no need to delete your whole account. You can also object to and restrict processing more broadly by emailing privacy@kurro.run.
• Lodge a complaint with your national data protection authority (e.g. the GBA in Belgium or the AP in the Netherlands).

6. Security

We use encrypted connections (HTTPS/TLS), Row Level Security on the database, and only processors we have checked. Some of them are in the US, see “International transfers”. Access to production data is restricted to authorised administrators. When an administrator opens, exports, recomputes, regenerates an individual user's data, or searches/lists the athlete roster, we record that action in a persistent, access-controlled audit log: which administrator, which user (where a single user applies), which action, and when. Automated maintenance jobs remain captured in our server logs.

7. Contact

Questions about this privacy policy or your data? Email us at privacy@kurro.run.