Privacy

The short version

• Your training data is encrypted on your own device with your password.
• If you turn on sync, the server stores an encrypted copy it can’t read.
• Only you and the coach you link to can see your data. The league table is the one exception, and only if you join it.
• No cookies, no tracking, no adverts, no analytics. Nothing is sold or shared.

Who we are

Splitstream is a running coaching app run by its coach (username RMC1987). For anything about your data, email rcalver1987@gmail.com.

What’s kept on your device

Everything you put into Splitstream: runs (including GPS routes and heart rate), strength sessions, nutrition and weight, plans, race results, messages and settings. It’s stored in your browser, encrypted with a key that only your password or recovery code can unlock.

What’s kept on our server

Nothing, unless you turn something on:

• Sync (optional): an encrypted copy of your account and runs, so you can sign in on other devices. We can’t decrypt it. To check it’s you, we also keep a hash of a sign-in token made from your password, your public key, and a count of recent failed sign-ins.
• Two-step sign-in (optional): the authenticator secret needed to check your codes, and a hashed token for each device you’ve approved.
• Coach link: updates for your coach and plans or messages from them are encrypted so only the other person can open them, and wait on the server until collected.
• League table (optional): if you join, your display name, best times with their dates and yearly distance are visible to everyone signed in to Splitstream. You can leave at any time.
• Sign-up tally (on by default, you can switch it off): a count of new and active accounts by level (Beginner, Intermediate, coach) per week. No name, username or account ID is sent. To stop one address inflating the count, a one-way tag made from your IP address and that day’s date is kept for about a day.

Your coach

If you link to a coach, they can see everything you upload and your plan settings. Your personal goals on the Home tab are never shared.

Health data

Heart rate, weight and similar training data can count as health data. We only process it because you choose to upload it, it stays encrypted, and only you and your coach can read it.

Hosting

The site runs on Cloudflare. Like any web host, Cloudflare handles your IP address to deliver the site. Fonts and libraries come from our own site, not from third parties.

How long it’s kept

• On your device: until you delete the account (Settings & Sharing).
• On the server: until you turn off sync and choose to delete the server copy. That removes your account, runs, league entry and inbox. Anything you already sent your coach stays with your coach.

Your rights

Under UK data protection law you can ask to see, correct or delete your data, or object to how it’s used. Most of this you can do yourself in the app; otherwise email us. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this policy changes, the date at the top changes too, and the app’s “What’s new” notes will say so.