Privacy Policy

Runner Twelve AB (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect personal data when you use our websites and products, including Beatpace.

Scope

This Privacy Policy applies to:

• The Beatpace web application (beatpace.io)
• The Beatpace Android app (Google Play), which runs the same web application with native audio playback
• The Beatpace companion app for Garmin watches (Connect IQ)
• The Runner Twelve website (runnertwelve.com)
• Related communications, including product updates and transactional emails

Data Controller

Runner Twelve AB Org.nr: 559464-5888 Söderköping, Sweden Contact: info@runnertwelve.com

What Data We Collect

Account Data

When you create an account, we collect:

• Your email address, and if you sign in with Google, the name and profile picture Google shares with us
• Display name, avatar, bio, and tagline (if provided)
• Social media links (Creator tier, if provided)

Workout and Content Data

When you use Beatpace, we store:

• Workout programs you create (structure, blocks, settings, preferences)
• Comments you post on other users’ programs
• Reports you file about other users’ content, and the list of users you have blocked. Both are stored with your account and deleted with it.
• Your saved/bookmarked programs and followed creators
• Your workout history: which mixes you played and on what date, on the web player and (as anonymous play counters) on a connected watch. We use this history, together with preferences and instructions you give us, to plan and build your future workouts. It is account data and is deleted when your account is deleted.
• Free-text training instructions you choose to give us: a standing instructions field you can read, edit, or clear anytime in Settings, and one-off notes attached to a single upcoming workout. A one-off note is stored on the workout it produced and is deleted with that workout (and with your account). This text is sent to our AI provider (Google Gemini) solely to generate your next workout; it is never used to train models and never shared beyond the sub-processors listed below.

Usage Data

We collect data about how you use the service:

• Programs you play, heart (like), or save
• Follow/unfollow actions
• Subscription tier and feature usage

Payment Data

• Payments are processed by Stripe
• We do not store your credit card details, these are handled entirely by Stripe
• We store your subscription tier, billing status, and payment history references

AI Generation Data

When you use AI features (workout generation, coaching narration, music generation, cover-image generation), we store:

• Generation requests and metadata, including the prompts and parameters you provide
• Generated outputs associated with your account

To produce these outputs, we forward your prompts and the necessary parameters to third-party AI service providers acting as data processors on our behalf. We do not send your name, email address, or other directly identifying account data to these providers.

Watch and Connected Device Data

When you pair a Garmin watch with Beatpace through the Connect IQ companion app, we store:

• A watch session record containing the device part number (used to display a friendly model name such as “Forerunner 965”) and the timestamp of the most recent sync
• HMAC-signed access and refresh tokens that are scoped to the Beatpace watch endpoints only and that you can revoke at any time from Settings, under Connected Devices
• Basic playback analytics to understand how the app is used: which of your mixes were played on the watch and the local date (not the time of day) they were played, plus how many of a mix’s tracks started. This is collected on the watch and sent to us on the next sync. We use it only to measure engagement and improve the service; we do not record the time of day, your location, or any sensor or health data alongside it.

The Connect IQ app declares the Communications permission only. It is used exclusively for HTTPS calls to the Beatpace backend (pairing your watch, listing your mixes, downloading per-block audio, refreshing tokens, fetching cover thumbnails). No other Connect IQ permissions are requested.

We do not request, receive, or store:

• Your Garmin Connect identity, profile, or contacts
• Any health, fitness, biometric, or activity data from Garmin Connect or the watch
• GPS, location, or position data
• Heart rate or any other sensor readings (accelerometer, barometer, compass, etc.)
• The time of day you listen, or any second-by-second listening history (the playback analytics above are limited to which mix played on which date)

To pair the watch, the app shows a short code (or QR code) that you approve while signed in to Beatpace in your browser. Sign-in happens entirely between the watch and the Beatpace backend over HTTPS; no Garmin Connect account, profile, or activity data is involved at any point.

Audio files synced to the watch are stored in the watch’s local storage and in the Beatpace backend cache used to serve the same files to that user’s other devices. They are never shared with third parties.

Connected training platforms (intervals.icu, AI Endurance, Tredict and TrainerDay)

You can optionally connect a training platform so Beatpace reads your planned workouts and builds a daily mix matched to the session you have scheduled. You need your own account with that platform; it stays governed by their terms and privacy policy, and they are independent of Runner Twelve AB.

What we read. Planned workouts only: name and description, workout structure, durations, intensity targets (power, heart rate, pace or speed), and cadence. Where a platform also exposes your training reference values, we read your maximum heart rate and functional threshold power so we can turn its targets into music intensity; we use them for that calculation and do not store them. We do not read your completed activities, GPS tracks, or wellness data such as heart-rate variability, resting heart rate or sleep, and we never write anything back to the platform. A workout’s name and description may be sent to our AI provider to produce the short session summary shown in the app.

Why, and on what legal basis. Only to generate your daily mix. The legal basis is performance of our contract with you (GDPR Art. 6(1)(b)); your approval on the platform’s own connect screen is your instruction to access that account, and you can withdraw it at any time by disconnecting.

What we store, and for how long. The access token (plus a refresh token where the platform issues one) and the athlete identifier that platform returns, held in our EU infrastructure, encrypted in transit and at rest. We delete all of it when you disconnect, and stop fetching. You can also revoke Beatpace’s access from inside the platform itself. Mixes already built from your sessions remain in your Beatpace account under the retention rules above.

International transfers. Connecting a platform outside the EEA transfers data to it. Where required, such transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Connected personal calendars (instructors)

Instructors can optionally connect a calendar by pasting its iCal/ICS link, so the classes they teach appear in their Beatpace week. This access is read-only: we never write to your calendar. We cache only a rolling window of events (about one week back and four weeks forward) and only the minimum needed to show them — title, times and timezone. Event descriptions, attendees, organizers and locations are not stored. The calendar link itself is a credential and is stored encrypted. Events from a disconnected calendar are deleted immediately, and the rolling window means we never hold a long-term copy of your calendar.

Email Signups (Landing Page)

When you sign up for updates on our landing page:

• Your email address
• Timestamp of signup
• A hashed version of your IP address (for rate limiting and abuse prevention)

Technical Data

• Hashed IP addresses for rate limiting and abuse prevention
• Browser and device information necessary for audio playback and service operation

Why We Collect Your Data

Marketing and Product Emails

If you have a Beatpace account, we may occasionally send you product news, tips, and offers about Beatpace. We rely on our legitimate interest in keeping our own customers informed about the service they signed up for.

You are in control of these emails:

• Every marketing email contains a one-click unsubscribe link.
• You can also turn them off anytime in Beatpace under Settings, in the Social section.

Opting out only affects marketing and product emails. Transactional emails that are necessary to operate your account (such as sign-in codes and billing notifications) are always sent.

How We Protect Your Data

• Data is stored in cloud infrastructure within the EU
• All traffic between your devices, our backend, and processors is encrypted in transit (HTTPS / TLS)
• IP addresses are hashed before storage
• Access to data is restricted to authorized personnel only
• Industry-standard security measures are used to protect stored data
• Payment card data is handled entirely by our payment processor and never touches our servers

Data We Do Not Sell or Use for Advertising

• We do not sell, rent, or trade your personal data to any third party
• We do not share your personal data with advertising networks
• We do not build advertising profiles about you and we do not run third-party advertising or tracking analytics on Beatpace
• Personal data is shared with third-party service providers (listed below) only as needed to operate Beatpace on our behalf

Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Payment records: Retained for 7 years as required by Swedish accounting law (bokforingslagen).
• Landing page signups: Retained for a maximum of 2 years after collection if no further interaction occurs.
• Technical logs: Retained for up to 90 days for abuse prevention and debugging.
• Watch session records: Retained until you revoke the watch from your account settings. Refresh tokens automatically expire after 30 days of inactivity, after which the session record is no longer usable for sign-in.
• Watch playback analytics: Stored against your account (which mix played, on which date) and deleted with your account, within 30 days of account deletion.
• Connected training platform credentials: Access and refresh tokens and the stored athlete identifier are kept only while the connection is active and are deleted when you disconnect the platform.

Your Rights Under GDPR

You have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”)
• Withdraw consent at any time for consent-based processing
• Data portability: receive your data in a portable format (your workout programs can be exported)
• Object to processing based on legitimate interest
• Lodge a complaint with a supervisory authority

The relevant supervisory authority in Sweden is the Swedish Authority for Privacy Protection (IMY).

To exercise your rights, contact: info@runnertwelve.com

Third-Party Services

We use third-party service providers to operate Beatpace. These providers process data on our behalf or as independent controllers:

• Google Cloud / Firebase (EU): cloud infrastructure, hosting, authentication, database, and file storage
• Stripe: payment processing. Stripe acts as an independent data controller for payment data. See Stripe’s Privacy Policy for details.
• AI service providers: we use third-party AI services for workout generation, voice synthesis, music generation, and cover-image generation. Generation prompts and parameters are sent to these providers for processing.
• Email delivery provider: we use a third-party service to send transactional emails (PIN codes, notifications) and marketing communications
• Avatar service: we use an email-hash-based avatar lookup service to display profile pictures
• Geo-location service: on our landing page, we use an IP-based location service to detect your country for currency display purposes. No personal data is stored from this lookup.
• intervals.icu, AI Endurance, Tredict and TrainerDay: optional third-party training platforms you can connect so Beatpace can read your planned workouts. See “Connected training platforms” above. These are independent services governed by their own privacy policies.

We do not use advertising networks or user-tracking analytics services.

Cookies and Local Storage

• We do not use tracking cookies or third-party analytics cookies
• Firebase Authentication uses browser local storage to maintain your session
• The Android app stores your session and any downloaded audio in the app’s private storage on your phone, cleared when you sign out or uninstall the app
• No personal data is stored in cookies
• On a paired Garmin watch, the Connect IQ app stores access and refresh tokens, the paired session ID, and any audio files you have downloaded for offline playback. This data is cleared when you sign out of the watch app, unsync a downloaded program, or revoke the watch from Settings.

Children

Beatpace is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.

International Data Transfers

Our primary infrastructure is hosted in the EU. However, some third-party service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• The service provider’s compliance with equivalent data protection standards

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Beatpace website or by email to registered users when appropriate. The “Last updated” date at the top of this page reflects the most recent revision.

Contact

For privacy-related questions, GDPR requests, or to exercise any of the rights listed above:

info@runnertwelve.com

For product support, including questions about the Beatpace Connect IQ app for Garmin watches:

support@beatpace.io

Runner Twelve AB Söderköping, Sweden