Privacy Policy
Effective Date: October 6, 2026
Last Updated: October 6, 2026
1. Who We Are
Mayan Labs LLC, doing business as RunVector ("RunVector," "we," "us," or "our"), provides running training, coaching, analytics, and race prediction tools through our website at runvector.io and related applications (collectively, the "Services").
This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Services. By using RunVector, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
Information You Provide Directly
- Account Information: Email address, name, and password when you create an account
- Profile Information: Age, maximum heart rate, heart rate zones, and training preferences
- Race Information: Target races, goal times, and race history you enter manually
Public Tools and Shared Results
You can use some tools without an account, including race predictions, training-plan generators, and calculators. Depending on the tool, the information you enter may include race distances and times, training volume, heart-rate information, age, gender, body weight, course or weather conditions, and training preferences.
How that information is processed depends on the tool. Some calculators, such as the carb-loading calculator, calculate results in your browser rather than sending the calculation inputs to RunVector. For server-based tools, we receive the information needed to generate the result. We store public prediction inputs and results for analytics, along with request information such as a hashed IP identifier, approximate location, browser information, and referring page. For shareable training plans, we store the information used to create the plan, the generated plan, and related interaction records. General website usage and technical logging may also apply when you use public tools.
Where a tool offers a shareable link, anyone who has that link can view the result until the link expires. Treat it as public and avoid including information you do not want others to see. If you ask us to email a result or link, we also process the email address you provide to deliver it.
Information from Connected Services
When you connect a supported service, the information available to RunVector and the amount of history imported depend on that service, the integration, and the permissions you grant. You may also upload supported activity files containing older activities. Uploaded history may extend beyond the initial sync period.
Depending on the features supported and enabled and the permissions you grant, we may receive the following categories of information from connected services and devices, such as Garmin Connect, to provide training analysis and personalized insights. Not every integration provides every category:
- Profile Data: Name, profile photo, athlete ID, and account identifiers
- Activity Data: Running activities including distance, duration, pace, heart rate, cadence, GPS coordinates, elevation, lap splits, and activity timestamps
- Wellness and Recovery Data: Heart-rate variability (HRV), sleep duration, stages and scores, respiration, blood oxygen, stress metrics, and body-battery summaries, where available from the connected service or device
- Daily Summaries (when supported and enabled): May include steps, calories, and daily heart-rate metrics, including resting heart rate
Data Minimization
We request, collect, and retain information reasonably necessary for the purposes described in this Privacy Policy. The information available to a feature depends on what you choose to provide or connect and the permissions you grant.
Information Collected Automatically
- Usage Data: Pages visited, features used, and interactions with the Services
- Device Information: Browser type, operating system, and device identifiers
- Log Data: IP address, access times, and referring URLs
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, maintain, secure, personalize, and improve our Services
- Generate personalized training analysis and insights
- Calculate race time predictions based on your training data
- Provide public tools, including predictions, training plans, and calculators; generate their results and, where supported, save or share them
- Deliver a result or shareable link when you request it
- Display your running history, statistics, and progress
- Send essential service communications, such as account verification, password, security, support, transactional, and material policy notices
- Send optional product updates and training-plan communications where permitted by law and according to your communication choices
- Respond to your inquiries and provide customer support
- Detect, prevent, and address technical issues or fraudulent activity
- Comply with legal obligations
We may use relevant information, where features are available and you authorize the relationship, to support collaboration between athletes and their coaches.
We do not use your personal information to train general-purpose artificial intelligence models.
We may de-identify and aggregate information so that it is not reasonably linkable to you. We may use that information for analytics, benchmarking, research, and to develop or improve RunVector's own statistical and predictive models. We do not attempt to re-identify it. These uses remain subject to third-party data-source restrictions, your choices and consents, and applicable law.
5. Third-Party Integrations
Garmin Connect Integration
When you connect your Garmin Connect account, we request only the permissions necessary to sync your running activities for training analysis.
Garmin is a connected service, not a service provider processing information only on RunVector's behalf. Your Garmin relationship and Garmin's handling of information are also governed by Garmin's own terms, privacy practices, and platform requirements.
We do not sell Garmin-derived data or use it for advertising or to train general-purpose artificial intelligence models. We may use de-identified and aggregated Garmin-derived information for analytics or to improve RunVector's own statistical and predictive models only where permitted by Garmin's requirements, your applicable permissions and consents, and law.
COROS MCP Integration
If you choose to connect your COROS account to RunVector through MCP, we may access training information and create or update workouts and training plans according to the feature you use and the permissions you grant. COROS's handling of your information remains subject to its own terms and privacy practices.
Assistants, Plugins, and Connected Interfaces
When you choose to use RunVector through a third-party assistant, plugin, or connected interface, that platform may send requests and instructions to RunVector and receive the information or results needed for the requested action. Where supported, this may include an authorized coach acting on an athlete's behalf, within the athlete's permissions. Depending on the feature, the information exchanged may include training, activity, race, calendar, workout, or account information.
A coach's independently chosen browser assistant may receive information it reads or the coach provides; this is separate from a RunVector-provided connector. Permission to access athlete information does not by itself authorize sending it to external AI services. The coach must have authorization covering that processing and respect the athlete's choices. External platforms handle information under their own terms and privacy practices.
Review an external platform's permissions and disconnect or stop using the integration when you no longer want that exchange.
Disconnecting a Connected Service
To disconnect a service, use the connection controls available in RunVector's Settings or the provider's account settings. The available controls depend on the integration. If you need help, contact support@runvector.io.
Disconnecting a service stops future syncing and connected actions through that connection. Previously synced activity data remains in your account for continued analysis until you delete it or delete your account. Connection records and tokens are not automatically deleted when you disconnect.
AI-Powered Analysis
We use Vercel AI Gateway to route relevant training data, requests, and instructions to third-party model providers. Providers and models may vary by feature and request, including for analysis, classification, and generating responses. The information sent depends on the feature and your request. For some features, RunVector stores prompts, generated responses, and usage records as its own records. Provider retention of requests and responses is separate from RunVector's records and is governed by the provider's applicable terms and the configuration in use; it may vary by provider and service.
RunVector does not authorize the AI provider to use this information to train general-purpose artificial intelligence models. If that practice changes, we will provide an additional disclosure and obtain any consent required by applicable law.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal information:
- All data transmitted over HTTPS/TLS 1.3 encryption
- Database hosted on Supabase (US region) with PostgreSQL row-level security policies
- OAuth tokens encrypted at rest using AES-256
- Regular security reviews and updates
- Access to personal data restricted to authorized personnel only
Token Lifecycle
OAuth access tokens are stored securely and refreshed automatically. Disconnecting a service marks its connection inactive and stops further syncing; connection records and tokens are not automatically deleted on disconnection. New tokens are only issued after explicit re-authorization through OAuth.
Security Reporting
If you discover a security vulnerability, please report it to security@runvector.io. We take all security reports seriously and will respond promptly.
While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
8. Data Retention
We retain your information according to the following schedule:
| Data Type | Retention Period |
|---|---|
| Account Data | While account is active |
| Activity Data | While your account is active, unless you delete it earlier |
| Connection Records and OAuth Tokens | Not automatically deleted upon disconnection; account deletion and other applicable choices are described below |
| Routine Operational Logs | Up to seven days, including technical access, error, and activity-sync logs. Specific records may be retained longer when necessary to investigate security incidents or meet legal obligations. |
| Public Prediction Analytics | Stored without an automatic expiry. These records are separate from routine operational logs and predictions saved to your account. |
| Shareable Training Plans | 180 days from creation |
| Shared-Plan Interaction Records | 90 days |
| Email for Requested Link Delivery | For the training-plan link service, processed for one-time delivery; not stored with the plan and not used to enroll you in RunVector marketing |
| RunVector AI Prompts, Generated Responses, and Usage Records | RunVector stores these records for some features. They are separate from model-provider records, whose retention is governed by applicable provider terms and configuration. |
| Database Backups | Rolling seven-day retention window |
We may retain analytics that have been anonymized so they are no longer reasonably linkable to you or your device without a fixed time limit for usage analysis and statistics. We do not attempt to re-identify that information.
An athlete may withdraw coaching authorization. After withdrawal, the coach must stop accessing or managing information under that authorization. Withdrawal does not itself delete historical plans, messages, or copies the coach previously obtained. Any continued retention or use by a coach remains subject to the athlete's authorization, the coach's confidentiality and other obligations under our Terms, and applicable law. RunVector's retention of its records remains governed by this Privacy Policy.
Data Deletion
You can delete your data in the following ways:
- Delete your account: Go to Settings and click "Delete Account" to immediately remove your account and covered data from active systems
- Request via email: Contact privacy@runvector.io to request data deletion
Disconnecting a connected service stops future syncing and connected actions through that connection but does not delete previously imported data. Deleting your account through Settings immediately removes your account and covered data from active systems. Supabase creates daily database backups retained on a rolling seven-day schedule. Snapshots created before deletion may temporarily contain your information until they age out of that window. We may retain limited information longer where required by law or reasonably necessary for security, fraud prevention, or legal claims.
Information created through public tools without an account may be stored separately from your account. Deleting your account does not automatically remove those records. For example, shareable training plans and their interaction records follow the periods listed above. Contact privacy@runvector.io about information you provided through a public tool so we can review your request and determine which records relate to you.
Data Deletion Page: https://runvector.io/privacy/delete-data
9. Your Rights and Choices
Depending on your location, you may have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of your personal data |
| Correction | Request correction of inaccurate or incomplete personal information, including profile or activity information associated with your account |
| Deletion | Request deletion of your data |
| Portability | Request your data in a portable format |
| Restriction | Request that we keep your personal information but limit certain uses of it in circumstances provided by law, for example while we investigate disputed accuracy |
| Objection | Object to certain uses of your personal information where applicable law provides that right, including its use for direct marketing |
These rights apply to personal information associated with you, including profile and activity information. A correction request asks us to review inaccurate or incomplete information; it does not guarantee a particular prediction result or require us to replace accurate information simply because you disagree with it.
Contact us so we can assess a request to limit or object to a particular use of your information. The outcome depends on the purpose of the processing and applicable law. Limiting processing may affect our ability to provide the associated features; these rights do not promise a customized version of the Services or a separate control for every algorithm.
To exercise these rights, contact us at privacy@runvector.io. We will respond within 30 days.
Communication Choices
Essential account, security, transactional, support, and legal communications are necessary to provide and protect the Services. You can manage optional product updates and training-plan communications in Settings or use an unsubscribe link when available. Opting out of optional communications does not stop essential messages.
10. International Data Transfers
Mayan Labs LLC is based in the United States. Our database is hosted on Supabase in the US region. If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using our Services, you consent to this transfer.
11. Children's Privacy
Our Services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us at privacy@runvector.io and we will promptly delete it.
12. California Privacy Rights
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: We do not sell personal information, so this right does not apply
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
To exercise these rights, contact us at privacy@runvector.io.
13. European Privacy Rights
If you are in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR):
Legal Bases for Processing
- Contract: Processing necessary to provide you with our Services
- Consent: Where you have given explicit consent (e.g., authorizing a connected service)
- Legitimate Interests: Improving our Services, preventing fraud
- Legal Obligation: Compliance with applicable laws
Your GDPR Rights
In addition to the rights listed in Section 9, you have the right to:
- Withdraw consent at any time
- Lodge a complaint with your local data protection authority
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we will provide additional notice via email or in-app notification. We encourage you to review this policy periodically.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Mayan Labs LLC, doing business as RunVector
Data Protection Contact: A. Fernandez, Founder
Privacy Inquiries: privacy@runvector.io
Security Issues: security@runvector.io
General Support: support@runvector.io
We will respond to your inquiry within 30 days.