Privacy Policy

Last updated: July 1, 2026

Controller and contact

Paul Ducat operates Running Evolution. Privacy and data-protection requests can be sent to support@pd-running.com.

Data we process

Account information: display name, email address, password hash and session identifiers.
Provider connections: encrypted OAuth access and refresh tokens, connection metadata and granted scopes.
Training information you import or enter, including activities, check-ins and training settings.
When you connect WHOOP: sleep, recovery, HRV, resting heart rate, respiration and related measurements.
When you connect Google Health: read-only activity and fitness, sleep, heart rate, HRV, resting heart rate, oxygen saturation, respiration, VO₂ max and related health measurements available from Fitbit, Pixel Watch or other compatible sources.

WHOOP data

WHOOP physiological data is requested only after your explicit consent. It is processed transiently to show your dashboard and calculate personalized readiness and training guidance. Running Evolution does not permanently store WHOOP physiological data in its database or browser storage. OAuth credentials are stored separately and encrypted with AES-256-GCM.

Google Health and Fitbit data

Google Health data is requested only after a prominent in-app disclosure, your explicit consent and Google OAuth authorization. Running Evolution requests only read-only activity, fitness, sleep and health-measurement scopes needed for training analysis, recovery insights and personalized readiness recommendations. It does not request location, ECG, irregular-rhythm, nutrition or write access. OAuth credentials are encrypted with AES-256-GCM. Google Health data is not sold, used for advertising or shared with unrelated third parties.

Purposes and legal basis

Account and provider data is processed to perform the service you request. A connected TrainingPeaks calendar URL is stored encrypted and used only to retrieve the read-only calendar items shown in the dashboard; the latest items are cached in your browser for temporary offline display. Health-provider data is processed only with your explicit consent. You may withdraw consent by disconnecting the provider.

How we use the data

To provide the training dashboard, score engine and account security.
To interpret imported training and health signals into readiness, tolerance and planning guidance.
To send transactional messages such as verification, password reset or service notices.
To investigate abuse, fraud, provider-sync failures and security incidents.

Recipients and transfers

Running Evolution is free of charge, and no payment data is collected or processed. We do not sell wearable or health data. Hosting and database infrastructure is provided by 1blu. Transactional account email is delivered through Brevo. Provider requests are sent directly to the provider you connect. WHOOP and Google Health data is not disclosed to advertisers or unrelated third parties.

Running Evolution is used internationally, and data may be processed in countries other than your own, including the United States (for example by Google). Where such transfers are subject to the EU/UK GDPR or similar regimes, they are made on the basis of Standard Contractual Clauses, an adequacy decision, or another legally recognized safeguard offered by the respective processor. Details of each processor's safeguards are available in their own privacy documentation.

Retention and deletion

Account data, encrypted provider credentials and an encrypted snapshot of your own settings, plans, check-ins, session debriefs, discomfort signals and FIT imports are kept until you delete your account. You can download an account export or permanently delete your account from “Manage account”. Deletion removes synchronized user data, provider connections and consent entries.

Authentication audit entries (hashed IP and user-agent values) are retained for a limited period for security investigation purposes and then removed.

Security

Production traffic is required to use HTTPS. Credentials are restricted to the server and encrypted at rest. Suspected incidents should be reported immediately through the support page.

Cookies and local storage

The application uses a strictly necessary session cookie for authentication and security. Browser storage keeps dashboard preferences and, when signed in, synchronizes supported settings with your encrypted account snapshot. No advertising or cross-site tracking cookies are used.

Your choices and rights

You can access displayed provider information, export account metadata, disconnect providers and delete your account. Depending on applicable law, you may also request access, correction, restriction, objection or erasure.

Complaints

If you believe your privacy rights were violated, contact us first at support@pd-running.com or via https://www.pd-running.com/support.php. Where applicable, you may also complain to a competent data-protection authority in your country of residence or where the alleged infringement occurred.