Privacy
Last updated 14 October 2026
Teipa is a journal for the months before a race. To work, it keeps your account, the runs you bring in from Strava, and what you write about them. To get better, it notes which parts of the app you use — never what you write. No ads, no tracking across other apps, and nothing is sold.
Who is responsible
Teipa is operated by [Legal entity name], [postal address] (“Teipa”, “we”). For anything about your data, write to privacy@teipa.run.
What we store
| Data | Where it comes from | Why |
|---|---|---|
| Email address and password (stored only as a secure hash), your name, and an optional profile photo | You, when you create an account | To sign you in and keep your journal yours |
| Strava connection: access and refresh tokens and your Strava athlete ID | Strava, when you connect your account | To import your activities. Tokens are kept on our servers, never shown to anyone |
| Activities: title, description, sport type, date and time, duration, distance, pace, heart rate, elevation, calories, laps and splits, and the route map | Strava, for the activities on your Strava account (including ones marked private there) | To show your runs, place them in a prep, and calculate weekly totals, milestones and posters |
| Preps: race name, distance, date, goal time, cover photo | You | To build the countdown and your prep |
| What you write: how each run went (mood, effort, energy, body, conditions, notes), weekly reflections, the three lines when you close a prep, and photos you attach to a workout | You | To keep the story of your prep |
| Usage data: which screens you open and which actions you take (for example “created a prep”, “saved how a run went”, “exported a poster”), with counts and simple facts about them (how many of the five questions you answered, whether you added a note — never the answers or the note itself); how long screens take to load and whether a Strava sync or a save failed; the app version, iOS version, iPhone model, language, time zone, and a random identifier for this installation of the app | The app, as you use it, and our servers, when they sync with Strava | To understand which parts of Teipa help runners and which don't, and to find and fix what's slow or broken |
Usage data is linked to your account so we can see how a prep unfolds over months, but it never contains your notes, reflections, race names, goals, routes, locations, heart rate or the answers you give about how a run went. It is collected and stored by us alone, on the same Supabase database as the rest of your journal — no analytics company receives it. You can turn it off at any time in the app under Me → Settings → Share usage analytics; from then on nothing more is collected, and anything not yet sent is discarded from your phone.
Route maps show where you ran, which can reveal places such as your home. They are visible only to you inside Teipa, and on a poster only if you choose to export and share it.
Posters are rendered on your iPhone. Nothing is published anywhere unless you share the image yourself.
What we don't do
- We don't sell or rent your data, and we don't share it with advertisers or data brokers.
- We don't use third-party analytics or advertising SDKs, we don't use Apple's advertising identifier, and we don't track you across other apps or websites. Our own usage analytics stays with us.
- We never post to Strava or change anything on your Strava account. Teipa only reads.
- We don't use your data to train machine-learning models.
Who processes it for us
- Supabase hosts our database, sign-in, file storage and our usage analytics. Your data is stored on their infrastructure in [region, e.g. EU (Frankfurt)].
- Strava is where your activities come from. Your use of Strava is covered by Strava's privacy policy.
- Apple distributes the app through the App Store.
Where a provider processes data outside the European Economic Area, it does so under appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Legal basis
We process your data to provide the service you asked for (performance of a contract, GDPR Art. 6(1)(b)). Heart rate can count as health data. We only hold it when it is part of the activities you choose to bring in from Strava, on the basis of your explicit consent (Art. 9(2)(a)), which you can withdraw at any time by disconnecting Strava or deleting your account.
Usage data is processed on the basis of our legitimate interest in understanding how Teipa is used and keeping it working well (Art. 6(1)(f)). We keep it minimal, never include what you write or any health data in it, never share it, and you can object at any time with the Share usage analytics switch in the app or by writing to us.
How long we keep it
Usage data is kept for 13 months and then deleted automatically.
Everything else: as long as you have an account. If you disconnect Strava, we stop importing and delete your Strava tokens; runs already imported stay in your journal until you delete them or your account. When you delete your account, everything listed above — usage data included — is deleted from our database and storage, and Teipa's access to your Strava account is revoked. We only keep a count that an account was deleted, with nothing that identifies whose. Backups held by our hosting provider roll over within [N] days.
Your choices and rights
- Delete your account: in the app, go to Me and choose Delete account and data. This removes your account and all your data.
- Turn off usage analytics: in the app, go to Me → Settings and switch off Share usage analytics.
- Disconnect Strava: in the app under Me (this deletes the Strava tokens we hold), or from your Strava settings under My Apps.
- Access, correct, export or delete your data, or object to or restrict how we use it: write to privacy@teipa.run. We answer within 30 days.
- If you're in the EU, you can also complain to your data protection authority — in Spain, the Agencia Española de Protección de Datos.
Security
Data travels over encrypted connections (TLS) and is stored with access rules that let each account read only its own rows and files. Strava tokens are only ever used by our servers.
Children
Teipa is not directed at children under 16, and we don't knowingly collect their data.
This website
teipa.run uses no cookies, no analytics and no third-party scripts. Our hosting provider may keep standard server logs (such as IP address and time of request) for security, for a short period.
Changes
If this policy changes in a way that matters, we'll say so in the app before the change takes effect. The date at the top always shows the current version.