Privacy Policy

1. Who we are

SubRunGear (subrungear.com) is owned and operated by To When Pty Ltd, Sydney, Australia, and handles personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains what we collect, why, where it lives, and how to get it corrected or deleted.

2. What we collect

• Account: email address, username, display name, and avatar.
• Locker content: the gear you add (shoes, nutrition, apparel, accessories), sizes, nicknames, notes, kits, retirement history, comments, and photos you upload.
• Activities: date, distance, duration, and sport — whether logged manually, uploaded as FIT/GPX/TCX files, or synced from Strava. We never store or display GPS routes or start locations.
• Strava connection: your Strava athlete ID and OAuth tokens (encrypted with AES-256-GCM), plus the shoes on your Strava profile for gear sync.
• Onboarding photos: shelf or flat-lay photos you submit are downscaled, sent to our AI provider to identify gear, and are not retained afterwards.
• AI chats: your Gear Advisor and Training Coach messages and saved recommendations, plus per-user usage counters.
• Health data (mobile app, with your permission): running workouts from Apple Health or Health Connect — date, distance and duration only. They become runs in your locker (shown as “Synced”). We never read heart rate, location, or any other health type.
• Notifications (mobile app): a push token for this device if you turn notifications on, plus which categories you muted. Signing out or turning notifications off on the device removes the token.
• Billing: if you subscribe on the web, payment is handled by Stripe; we store only your Stripe customer reference, never card details. If you subscribe in the mobile app, the purchase is handled by Apple or Google through RevenueCat, and we store only your subscription state.
• Clicks & analytics: affiliate link clicks recorded with a salted, non-reversible visitor hash (no raw IP stored), and product analytics (PostHog) and error reports (Sentry) to keep SubRunGear working.

3. What is public and what is private

Public locker pages show only what you choose to publish: visible gear, public mileage totals, kits, and retirement history. Runs synced from Strava are visible to you alone — never on public pages, never in public mileage totals, and never exported. Your email address is never displayed anywhere. You can set your locker to public, unlisted, or private at any time on your profile.

4. AI processing (Anthropic)

AI features are powered by Anthropic's Claude models via Anthropic's API, with processing in the United States. What gets sent depends on the feature:

• Photo onboarding sends the photo you submit.
• Gear Advisor sends your questions, your locker contents, and catalog data — never Strava-sourced activities.
• Training Coachis off until you explicitly opt in. When opted in, your questions, locker, and recent activities (including Strava-sourced ones) are used, and Anthropic's servers may query Strava's MCP server on your behalf using your own Strava access token to answer questions about your training. Opting out stops this immediately and can be done at any time in the coach settings.
• SubRunGear connector for Claude (optional): if you add SubRunGear to your own Claude account, Claude can read your locker, kits, calendar and your logged, uploaded or health-synced runs, log a run, and propose calendar sessions that you confirm yourself — always as you, and never Strava-sourced activities. You approve this on a consent screen and can revoke it at any time.

We use Anthropic as a processor via its API: data sent this way is not used to train Anthropic's models. The never-Strava-in-AI rule outside the opted-in coach is enforced in code and covered by automated tests.

5. Who else receives data

We do not sell personal information. It is shared only with service providers that run SubRunGear, some of which are located overseas (primarily the United States): Anthropic (AI), Strava (when you connect it), Stripe (payments on the web), Apple, Google and RevenueCat (subscriptions bought in the mobile app), Vercel (application hosting), PostHog (analytics), Sentry (error monitoring), and Resend (transactional email). Each receives only what its function requires. Affiliate retailers receive no personal information from us — outbound links carry no identifiers beyond the destination URL.

6. Where your data lives, and security

Our primary database and file storage are hosted in Sydney, Australia (AWS ap-southeast-2, via Supabase). Strava tokens are encrypted at rest with AES-256-GCM, database access is restricted with row-level security, and private data (like Strava activities) has no public access path at the database level.

7. The mobile app

• Apple Health / Health Connect access is optional and asked for in the app. We read running workouts only (distance and duration), use them only to keep your gear mileage verified and to answer your own advisor and coach questions, never for advertising, and we do not share them with anyone except the AI processing described above. Turn sync off in Profile at any time; runs already imported stay in your locker until you delete them or your account.
• Photos you pick or take for a gear item stay on the item; shelf and flat-lay photos are used once to identify gear and are not retained.
• Diagnostics: crash reports (Sentry) and product analytics (PostHog) from the app never include run distances, health values, or the content of your chats.
• Deleting your account from the app(Profile → Delete account) removes the same data as on the web, plus this device's push token and any subscription record on our side. Manage or cancel a store subscription in your Apple or Google account.

8. Retention and deletion

• Disconnecting Strava deletes all Strava-sourced activities and your Strava tokens within 24 hours.
• Deleting your account (button on your profile page or in the mobile app) permanently removes your profile, locker, gear, photos, activities, chats, connections, push tokens, and any Claude connector grant — immediately and irreversibly. Records our payment processor must keep for tax and audit purposes are retained by Stripe as required by law.
• Aggregated, non-identifying analytics may be retained.

9. Cookies

We use cookies for sign-in sessions (required) and analytics. We do not run third-party advertising cookies.

10. Access, correction, and complaints

You can view and edit almost everything in the app itself. For a copy of your data, a correction we don't expose in the UI, or any privacy complaint, email hello@subrungear.com — we respond within 30 days. If you are unsatisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

11. Changes

We will update this policy as SubRunGear evolves and note the new effective date above. Material changes will be flagged on the site or by email.