Workout.RUN – Privacy Policy

Last updated: 2025-12-09
We value your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, how we process it, how long we keep it, and what rights you have as a user of Workout.RUN.
Workout.RUN is operated by:
Computo ApS
Oxford Have 15
2300 København S
Denmark
Email: info@workout.run
Computo ApS is the data controller for all processing described in this policy.

1. What Personal Data We Collect

1.1 Account Data

  • Name
  • Email address
  • Password (hashed)

1.2 Activity & Workout Data (Sensitive Data)

When you connect Garmin, we process:
  • Routes and GPS coordinate data
  • Distance, pace, heart rate, elevation
  • Workout structures, intervals, and schedules
  • Metadata you add (notes, tags, etc.)
We do not collect GPS data directly from your device. We process data received from Garmin to show maps, analyses, and insights.

1.3 Third-Party Authentication Data

If you connect your Garmin account:
  • OAuth tokens
  • Profile information provided by Garmin

1.4 Technical & Log Data

  • IP address
  • Device and browser metadata
  • Application Insights telemetry
  • Crash logs
  • Server logs (security/diagnostics)

2. How and Why We Use Your Data

2.1 To create and manage your account

Authenticating you and giving access to your workouts.

2.2 To retrieve and process your activities from Garmin

  • Sync activities
  • Process route and performance data
  • Generate analyses and insights
  • Create or update workouts on your behalf

2.3 To personalize your experience

2.4 To operate, maintain, and secure the service

Using logs and telemetry for:
  • Error detection
  • Performance improvements
  • Security monitoring

2.5 To comply with legal obligations

2.6 To develop new features

Using anonymized, aggregated usage data.

3. Legal Bases for Processing (GDPR)

We process your data under:
  • Contract – to provide Workout.RUN
  • Consent – when connecting Garmin
  • Legitimate interest – security, diagnostics, improvement
  • Legal obligation
Fitness and route data are sensitive data processed only when you connect Garmin and request workout-related features.

4. Third-Party Services

4.1 Microsoft Azure (EU Region)

  • Hosting and storage
  • Logs and diagnostics

4.2 Garmin

Used only when you link your Garmin account:
  • We retrieve activities and schedules
  • We may create/update workouts
  • We store OAuth tokens
  • We do not send activity data back to Garmin

4.3 SendGrid

Used for sending transactional emails. Only your name and email may be shared.
All providers follow GDPR or equivalent safeguards.

5. Cookies

Workout.RUN uses strictly necessary cookies for:
  • Login
  • Session security
  • Authentication flows
Garmin may set temporary OAuth cookies. We do not use advertising or tracking cookies.

6. Data Retention

  • Account & activity data: Until deletion
  • Logs: 30 days
  • Backups: 6 months
  • OAuth tokens: Removed when Garmin is disconnected
Anonymized data may be kept indefinitely.

7. Data Security

We apply appropriate technical and organizational measures:
  • HTTPS/TLS encryption
  • Encryption at rest
  • Access controls
  • Monitoring via Application Insights

8. International Transfers

Some processors (e.g., SendGrid) may process data outside the EU. We ensure appropriate safeguards such as:
  • Standard Contractual Clauses (SCCs)
  • GDPR-compliant processor agreements

9. Your Rights

As an EU user, you have the right to:
  • Access
  • Rectification
  • Deletion
  • Restrict processing
  • Object
  • Data portability
  • Withdraw consent
  • File a complaint with the Danish Data Protection Agency (Datatilsynet)
Contact us at info@workout.run to exercise your rights.

10. Account Deletion

You can delete your account using Delete my account in Settings.
Upon deletion:
  • All personal data and activities are removed
  • OAuth tokens are revoked
  • Backup copies may persist for up to 6 months
  • Anonymized data may be retained

11. Changes to This Policy

We may update this policy. Significant changes will be communicated via email or in-app notice.

12. Contact

Computo ApS
Oxford Have 15
2300 København S
Denmark
Email: info@workout.run