Privacy Policy

1. Who We Are

Sprinting (“we”, “us”, “our”) is an AI-powered training platform for athletes and coaches. We are based in Hong Kong and operate the website at sprinting.run and the Sprinter app for iOS.

2. What Data We Collect

We collect the following categories of personal data:

• Account information — name, email address, and profile details you provide when you sign up (processed by our authentication provider, Clerk).
• Training data — workout logs, session plans, athlete profiles, and related training information you enter into the platform.
• Usage data — page views, feature usage, and performance metrics collected automatically through Vercel Analytics and Speed Insights. These are anonymised and do not include personal identifiers. On our public pages, sign-up and onboarding only, we also count visits with PostHog, without cookies or other browser storage and without storing your IP address. When you finish onboarding, PostHog also records whether you joined as a coach or an athlete and whether you came through an invite, but not who you are. Apart from onboarding, nothing from the signed-in parts of the platform is sent to PostHog.
• Sign-up source — when you create an account, we record how you reached us with it: the website that linked to us (for example, a search engine), any campaign tag in the link, and the first page you visited. We use this only to understand which channels bring people to Sprinting. Until you finish signing up, it is held in your browser tab’s session storage, so it survives signing in with Google. It is deleted when you reach onboarding or close the tab.
• AI interaction data — prompts and training context you share with our AI features, used solely to generate responses for you.

3. The Sprinter iOS App

The Sprinter app for iOS measures and tracks athletic performance — reaction time, sprint starts, jump reactivity, stride mechanics, and distance. It is not a medical device and does not provide medical, clinical, or diagnostic services.

• Measurements stay on your device. Performance measurements you record in the app — and any video used to produce them — are stored only on your device. They are never uploaded to our servers.
• Camera, microphone, and motion sensors are processed on-device. The app uses them solely to produce your measurements, asks your permission before first use, and never transmits video or raw sensor data off the device. You can change these permissions at any time in iOS Settings.
• Account information. Signing in to the app uses the same Clerk authentication as the platform (email, name, user ID). Authentication tokens are stored securely in the iOS Keychain.
• No ads, no tracking. The app contains no advertising and does not track you across other apps or websites.
• Deleting your data. You can erase all measurements from the app’s settings at any time, and deleting the app from your device deletes all locally stored measurements.

4. How We Use Your Data

• To provide and operate the Sprinting platform
• To personalise your training experience and AI recommendations
• To improve the platform based on aggregated usage patterns
• To communicate with you about your account or service updates

We do not sell your personal data. We do not use your training data to train AI models.

We process usage data and sign-up source on the basis of our legitimate interest in understanding how people find and use Sprinting. You can object to this at any time by contacting us.

5. Third-Party Services

We use the following third-party services that may process your data:

• Clerk — authentication and account management
• Supabase — database hosting (servers located in the cloud; data encrypted at rest and in transit)
• Vercel — website hosting, analytics, and performance monitoring
• PostHog — cookieless visit analytics on our public pages (servers in the EU)
• OpenAI — runs our AI features. When you use one, we send OpenAI your prompt and the training data the feature needs to answer it, which can include athletes’ training logs and wellness check-ins (such as readiness or soreness), so it can generate the response. Under OpenAI’s API terms, data sent through its API is not used to train its models.
• Resend — email delivery. We use it to send notification emails, such as the message our team receives when someone joins the beta waitlist, which includes the details entered on the form.
• Cloudflare Turnstile — bot protection on the sign-up form, loaded by Clerk. It checks that a sign-up comes from a person rather than an automated script.
• Video hosts (YouTube, Vimeo, Instagram, TikTok, Loom, Dailymotion and Mux) — exercise videos are embedded from these services. A video’s player loads only when you press play; from then on that service can set its own cookies and collect data under its own privacy policy. YouTube videos play from youtube-nocookie.com. Before you press play, a preview image may load from YouTube or Mux when the video scrolls into view, which lets that service see your IP address.

Each provider processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

6. Data Storage & Security

Your data is stored on servers operated by our hosting providers and may be transferred to and processed in countries outside of Hong Kong. We implement industry-standard security measures including encryption in transit (TLS) and at rest, and access controls to protect your data.

When you delete your account, you are signed out and can no longer sign in, and your name, email address, username and photo are erased straight away. The rest of your profile (such as height, weight and training goals) is kept for 30 days so you can contact us to reopen the account, and is then erased. Workouts you logged with a coach stay in that coach’s training records without your name, because they are part of the coach’s history of their group.

Our hosting providers retain encrypted backups for a limited period (up to 30 days) for disaster recovery, so copies may persist in these backups until they expire. We do not restore deleted data from backups except in a genuine disaster-recovery scenario.

7. Your Rights

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), and where applicable the UK General Data Protection Regulation (UK GDPR), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Delete your account and associated data — available at any time from your account settings
• Object to or restrict processing of your data
• Request a copy of your personal data

You can delete your account and its data yourself from your account settings at any time. To exercise any of the other rights — including requesting a copy of your data — contact us at the email address below. We will respond within 40 days (PDPO) or 30 days (UK GDPR).

8. Cookies

We use only the cookies needed to run the platform: Clerk’s sign-in cookies, which keep you logged in, and one cookie that remembers whether the app’s sidebar is open or closed. We do not use advertising or tracking cookies.

Some features keep data in your browser’s local storage so they work as you expect: for example your theme preference, drafts you haven’t saved yet, your AI chat history, and your onboarding progress. You can clear it at any time in your browser settings. Your browser tab’s session storage holds a few short-lived items, such as the sign-up source described in section 2, which are deleted when you close the tab.

Vercel Analytics and PostHog count visits without cookies or other browser storage.

9. Children

Sprinting is not directed at children under the age of 16. If you are a coach working with athletes under 16, you are responsible for obtaining appropriate parental or guardian consent before entering their data into the platform.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised “last updated” date.

11. Contact Us

If you have questions about this privacy policy or wish to exercise your data rights, contact us at: privacy@sprinting.run