Privacy Policy

Last updated: 8 October 2026

Rurilab (“Rurilab”, “we”, “us”) is a training application for runners. This Privacy Policy explains what personal data we process, why, how we protect it, and the choices and rights you have. For any privacy question, contact us at jan@rurilab.com.

For users in the European Economic Area, Rurilab is the data controller for the personal data described here.

1. Data we process

Beta waitlist

If you join the waitlist, we store your email address, signup time and any optional device or training details you choose to provide in Firebase. We use these details to manage beta invitations and contact you about your request, not to create a paid subscription. Do not submit health records through the waitlist. To withdraw your request and ask for deletion, email jan@rurilab.com.

Account data

Your email address and authentication identifier (via Firebase Authentication), used to create and secure your account.
Profile details you enter — for example age, resting heart rate, training preferences and goals.

Health & activity data — only with your explicit consent

When you choose to connect a data source, we import the activities and wellness data you authorize:

Workouts / activities: type, date, duration, distance, GPS route, elevation, pace, cadence and power.
Heart rate: average/max and heart-rate samples during activities, and resting heart rate.
Wellness: sleep, heart-rate variability (HRV), VO₂max and similar metrics your device provides.

We obtain this data only from the sources you connect:

Supported health platforms — only fields actually made available by your source app, device, permissions and beta build.
Direct integrations — through the provider authorization you grant, where available. See current beta status; planned integrations are not active connections.
Files you import yourself (GPX / TCX / FIT).

We access only the specific data types you approve, and only while you keep the connection active.

2. How we use your data

We use your data solely to provide the app’s features to you:

build and continuously adapt your personal training plan,
calculate training load, recovery and fitness metrics,
show your activity history, maps and analysis,
optionally enrich activities with weather and terrain information.

We do not use your health or activity data for advertising, and we do not sell it.

3. Legal basis (GDPR)

Consent — for connecting a data source and importing your health and activity data. You can withdraw consent at any time (see Section 6).
Performance of a contract — to operate your account and provide the service you request.

4. Sharing and sub-processors

We do not sell, rent, or share your personal data with third parties for their own purposes. We use trusted service providers that process data on our behalf and under contract:

Google Firebase / Google Cloud — authentication, database, hosting and functions; our data storage and processing infrastructure.
Weather data providers (e.g. Open-Meteo, OpenWeather, Meteostat) — we send only the coordinates and time of an activity to retrieve weather; we do not send your identity.

Data received from Garmin, Suunto and Google Health Connect is used only to provide the features described above, is never sold, and is handled in accordance with each platform’s terms and policies.

5. Storage, location and security

Your data is stored in your private account on Google Cloud / Firebase infrastructure. Data may be processed on servers in the EU and/or other countries where Google operates; such transfers are covered by appropriate safeguards (e.g. EU Standard Contractual Clauses). We apply technical and organizational measures to protect your data, including encryption in transit and access controls.

6. Your choices and rights

At any time you can:

Disconnect a data source — stopping any further import.
Delete your data or your account — from within the app or by contacting us; this permanently removes your personal data from our systems.
Export your activity data.

Under the GDPR you also have the right to access, rectify, restrict or object to processing, and the right to data portability and to withdraw consent. To exercise these rights, use the in-app controls or email jan@rurilab.com. You may also lodge a complaint with your local data protection authority (in the Czech Republic, the Úřad pro ochranu osobních údajů).

7. Data retention

We keep your data for as long as your account is active. When you delete your account, we delete your personal data, except where we must retain limited records to comply with legal obligations.

8. Children

Rurilab is not intended for children under 16, and we do not knowingly process the data of children under 16.

9. Changes to this policy

We may update this Privacy Policy as the app evolves. We will post the updated version on this page and change the “Last updated” date above.

10. Contact

Questions about this policy or your data: jan@rurilab.com