privacy policy
Privacy Policy
Effective June 16, 2026 · Last updated June 26, 2026
Cadeo is a personal running coach. This policy explains what data Cadeo collects, why, and the control you have over it. It is written by Cadeo Running LLC ("Cadeo," "we," "us") — the company responsible for your data (your "data controller").
The short version
- Your training data stays yours. We never sell it, and there are no ads or third-party advertising trackers in Cadeo.
- We collect what we need to coach you: your Apple Health data, your runs, your goals, and your check-ins.
- We use a small number of trusted service providers to run the app, listed below.
- You can disconnect Strava, turn off diagnostics, revoke Health access, and delete your account at any time.
- You have full rights over your data under California (CCPA/CPRA) and EU/UK (GDPR) law, no matter where you live.
What we collect
Your account. When you sign in with Apple, we receive an Apple identifier that lets us recognize you. Apple lets you choose whether to share your name and email — both are optional, and Cadeo works without them.
Health and fitness data (from Apple Health). With your permission, Cadeo reads health data from Apple Health to understand your training and recovery: heart rate and heart-rate variability, resting heart rate, sleep, your workouts (distance, duration, elevation, and route), and running-form metrics like cadence, power, and stride. Cadeo only reads this data — it never writes anything back to Apple Health, and you can turn off any category in iOS Settings at any time.
Your runs from Strava (optional). If you connect Strava, Cadeo imports your activities — including distance, pace, heart rate, elevation, and GPS routes — so your history is in one place. Access is read-only: Cadeo can read your activities but can never post to or change your Strava account. You can disconnect at any time, which revokes Cadeo's access.
What you tell us. Your goals (like a target race and finish time), your training preferences (which days you run, rest, or do group runs), any injuries you log, and your check-ins after runs (how hard it felt, soreness, how you slept).
What Cadeo calculates. From the above, Cadeo computes your fitness and recovery estimates, training load, and daily recommendations, and keeps a record of why it suggested each run so its coaching stays consistent and explainable.
Location. Cadeo uses the GPS route attached to your workouts (from Apple Health or Strava) — for example, to map a run or adjust pace for hills. Cadeo does not use your phone's location services and does not track your location in the background. To show the weather you ran in, Cadeo sends the run's coordinates and time to a weather service (no account information is included).
Technical and diagnostic data. To keep Cadeo running and to fix problems, we collect your app and iOS version, a push-notification token (so we can send the alerts you've enabled), and crash and error reports. When the app encounters an error it may record a short diagnostic replay of the screen — with all text and images hidden, so your personal data isn't visible in it. Crash reports are always collected so we can keep the app stable and fix failures quickly — they capture the technical details of the failure (such as the error and your app, device, and iOS version), not a replay of your screen or your health and training data. All other diagnostics — error logs, performance data, and the masked diagnostic screen replay — are on by default and can be turned off anytime in Settings.
Our website. runcadeo.com uses Vercel's privacy-friendly analytics to count visits and measure speed. It is cookieless and does not track you across other websites.
How we use your data
We use your data only to:
- provide and personalize your coaching (plans, recovery guidance, race predictions);
- sync and display your training history;
- send the notifications you've turned on;
- diagnose crashes and improve the app; and
- meet our legal obligations.
We do not use your data for advertising, and we do not sell or share it for cross-context behavioral advertising.
Legal bases (EU/UK users)
Where GDPR applies, we rely on these legal bases:
- Your explicit consent — for health and fitness data (a "special category" of personal data) and for connecting Strava. You can withdraw consent at any time.
- Performance of a contract — to provide the coaching features you signed up for.
- Our legitimate interests — to keep the app secure and fix bugs, balanced against your rights.
- Legal obligation — where the law requires us to retain or disclose data.
Who we share your data with
We don't sell your data. There are no ads in Cadeo, and no third-party advertising or analytics trackers.
To run the app, we share data with a small set of service providers ("sub-processors") who process it only on our instructions:
| Provider | What it handles | Purpose |
|---|---|---|
| Supabase, Inc. | Your account and training data; sign-in | Cadeo's database and backend |
| Apple, Inc. | Sign in with Apple; Apple Health (stays on your device until you grant access); push delivery | Login, health source, notifications |
| Strava, Inc. | Your activities and athlete ID — only if you connect it | Importing your runs (read-only) |
| Sentry (Functional Software, Inc.) | Crash reports, error logs, masked session replays, app version, IP address | Fixing bugs |
| Expo (Exponent, Inc.) | App updates; push-notification relay (your push token) | Delivery and notifications |
| Open-Meteo | A run's coordinates and time (no account data) | Weather conditions |
We may also disclose information if required by law, or to protect the safety, rights, or security of our users or the service. If Cadeo is ever involved in a merger or acquisition, we'll notify you before your data becomes subject to a different privacy policy.
International data transfers
Cadeo is based in the United States, and our providers (including Supabase) store data on servers in the United States. If you use Cadeo from the EU, UK, or elsewhere, your data will be transferred to the U.S. Where required, these transfers are protected by Standard Contractual Clauses or an equivalent safeguard.
How long we keep your data
- Account, training, and health data: kept while your account is active. When you delete your account, we delete this data within 30 days, and from backups within 90 days.
- Diagnostic data (Sentry): retained for up to 90 days, then automatically deleted.
- Strava data: kept until you disconnect Strava or delete your account.
Your choices and controls
- Apple Health: grant or revoke any data category in iOS Settings → Privacy → Health.
- Strava: disconnect anytime in Cadeo; this revokes our access at Strava.
- Diagnostics: turn off error logs, performance data, and diagnostic screen replays anytime in Cadeo's Settings. Crash reports stay on so we can keep the app stable; they contain the technical details of the failure, not a replay of your screen or your health and training data.
- Notifications: turn off in Cadeo or in iOS Settings.
- Delete your account: see below.
Your privacy rights
Everyone. Regardless of where you live, you can ask us to access, correct, or delete your data, and you can delete your account in the app. Contact us at privacy@runcadeo.com.
California residents (CCPA/CPRA). You have the right to: know what personal information we collect and how it's used; access and delete it; correct it; and not be discriminated against for exercising these rights. Cadeo does not sell your personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of — but we honor opt-out signals regardless. Some data we collect (health information and precise location) is considered sensitive personal information; we use it only to provide the service you asked for, never to infer characteristics about you. You may use an authorized agent to make a request.
EU / UK residents (GDPR). You have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority. We will respond to verified requests within the timeframes the law requires (generally one month under GDPR, 45 days under CCPA).
Health data
Cadeo treats your health data with the highest care. In line with Apple's requirements: we never use Apple Health data for advertising or marketing, we never share it with third parties for advertising or data-mining, and we never sell it. We use it solely to provide your coaching, and only with your explicit permission.
Security
We protect your data with encryption in transit and at rest, access controls, and database-level security rules that keep each user's data separate. Sensitive credentials (like your Strava tokens) are stored in the iOS Keychain on your device. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach as the law requires.
Children's privacy
Cadeo is not directed to children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we'll delete it.
Deleting your account
You can delete your account and all associated data from within Cadeo (Settings → Delete Account), or by emailing privacy@runcadeo.com. Deletion removes your training, health, and account data on the schedule described above.
Changes to this policy
If we make material changes, we'll update the date above and notify you in the app before the changes take effect.
Contact us
Cadeo Running LLC
Email: privacy@runcadeo.com