ZoneCoach Privacy Policy

Last updated: July 7, 2026

ZoneCoach ("the app") is an Android application that helps runners plan and analyse heart-rate-zone-based training. This policy explains what data the app handles, where it goes, and what your rights are.

1. Data the app processes

ZoneCoach reads, writes, and stores the following categories of data:

• Health & fitness data via Android Health Connect (read): exercise sessions (all cardio types), heart rate, resting heart rate, distance, total calories burned, weight, height, and VO₂ max records — including historical records if you grant history access. Used to compute training load, recovery/readiness, and zone and fitness analyses.
• Heart-rate data from a Bluetooth LE monitor you pair, streamed live during workouts and stored as part of your session history.
• Location data while a workout is being recorded: used for pace, distance, and the route of the current session. The app does not track location in the background.
• Movement data during workouts (step events from the phone's motion sensors), used to derive cadence and step counts.
• Calendar data (opt-in): with your permission the app reads and writes events in a device calendar you choose, through Android's calendar provider — for planned-workout sync, adding individual sessions, and marking completed sessions. The app never signs in to your Google account.
• AI Coach subscription state: a Google Play purchase token kept on your device, sent to our backend Worker on each AI Coach call so we can validate your subscription or extra-call purchase with Google.
• Tester access data (closed-test programme only, optional): a shared tester code you enter plus a random, app-generated device identifier (a UUID — not an Android hardware ID), sent with AI Coach calls instead of a purchase token.
• Strava account connection (optional): if you choose to link Strava, an OAuth access token and refresh token are stored locally in encrypted storage so the app can upload your completed sessions to your Strava account and, if you enable shoe sync, read your Strava gear list. The tokens do not give us access to your Strava data — they never leave your device after the initial link.
• App settings & training history: zone definitions, max HR, training preferences, shoe list and mileage, workout history, AI conversation/plan state. Stored locally on your device.

2. Where the data is stored and who can see it

• Locally on your device, in app-private storage. Strava tokens are stored using Android EncryptedSharedPreferences (AES-256-GCM/SIV) with a hardware-backed key when available.
• Health Connect: ZoneCoach reads from your local Health Connect store, controlled by Android. If you turn on the optional "Export workouts to Health Connect" setting, the app also writes your finished ZoneCoach sessions back to Health Connect (exercise session, heart rate, distance, calories, steps, speed, and route). You can revoke any Health Connect permission at any time from Android Settings → Apps → Health Connect.
• Device calendar: calendar features work entirely on-device through Android's calendar provider. If the calendar you pick is synced with a Google or other account, that sync happens between your device and that provider under their terms — ZoneCoach only talks to the local calendar.
• ZoneCoach Worker (AI Coach): when you use the AI Coach, your prompt + recent training context are sent to a Cloudflare Worker we operate (zonecoach-worker.hrzonerun-zonecoach.workers.dev). The Worker (a) asks Google whether your purchase token is valid, (b) forwards the request to the AI provider we use server-side using our master API key, and (c) returns the response to your device. Chat responses stream straight through. Training-plan generation runs as a short-lived server-side job (Cloudflare Workflows) so it survives your screen turning off: the request and the generated plan are held by that job until your device fetches the result, after which they age out of Cloudflare's retention automatically. If you use the AI shoe features, the shoe brand/model names you enter are looked up the same way.
• What the Worker stores: a daily-usage counter keyed by a SHA-256 hash of your purchase token (auto-expires after ~25 hours), a redemption record (also a hash) for extra-call purchases kept up to 60 days to prevent double-spending, and — for closed-test testers only — a roster of at most a dozen random device identifiers. The raw purchase token, your Google identity, and your prompts are never stored. Worker logs contain only request sizes, timestamps, and validation results for abuse prevention — no prompt content — and are retained for at most 7 days.
• Server-side AI provider: at present this is OpenAI. The Worker's request to the provider does not include your Google account identity, email, or device identifiers — only the prompt + training context. The provider's privacy terms apply to that call.
• Strava (optional): linking routes the OAuth handshake through our Worker so the Strava client secret stays server-side; your tokens are parked there under a one-time code for at most 5 minutes and deleted the moment your device collects them. Once linked, the app talks to Strava's API (api.strava.com) directly from your device: it uploads finished sessions (GPX with route, heart rate, and cadence, plus a description with the zone/coach summary), can assign the shoe you used to the activity, and — if you enable shoe sync — reads your Strava gear list. Strava's own privacy terms apply to uploaded activities. You can revoke the connection at any time from the app's Settings or from your Strava account settings.

3. Backup, restore & diagnostics

• Automatic backup (opt-in): you can pick a folder via the Android file picker (this may be a cloud-synced folder such as Google Drive — that provider's terms then apply to the file). After every saved session and once daily, the app rewrites a single encrypted backup file (.zcb, AES-256-GCM over compressed JSON) containing your settings, full training history, AI plan and coach state, subscription state, and your Strava connection (tokens and upload history). The encryption key is embedded in the app so that any ZoneCoach install can restore the file — it protects against casual reading, but you should still treat the file as sensitive and keep it in a folder only you control.
• Restore: Settings offers a restore option that reads the same backup file. Restoring a purchase itself is handled by Google Play, not by us.
• Tester diagnostics (closed-test programme only): testers can additionally choose a folder to receive timestamped diagnostic log files (zonecoach-diagnose-*.txt) containing technical app events for debugging. They are written only to the folder the tester picked; the app keeps the newest 30 of its own files and prunes older ones. This feature does not exist outside the tester programme, and the logs never leave the tester's chosen folder unless the tester shares them.

4. Data we do not collect

• No account on our end, no email, name, or contact details collected by us. (Google Play handles purchases; we receive only the purchase token — or, for closed-test testers, a random app-generated device ID.)
• No advertising IDs, no third-party analytics, no crash-reporting SDKs.
• No background location.
• No data sold or shared with third parties for marketing.

5. Permissions and why we ask

• BLUETOOTH_SCAN (declared "never for location"), BLUETOOTH_CONNECT, BLUETOOTH, BLUETOOTH_ADMIN — pair and read your BLE heart-rate monitor.
• ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION — pace, distance, and route during a workout. Foreground only.
• ACTIVITY_RECOGNITION — step events for cadence and step counts during workouts.
• FOREGROUND_SERVICE (types: connectedDevice, location, dataSync) — keep the workout session running reliably while your screen is off.
• POST_NOTIFICATIONS — workout status, zone cues, and training reminders in the notification shade.
• MODIFY_AUDIO_SETTINGS — duck your music briefly when the coach speaks.
• READ_CALENDAR, WRITE_CALENDAR — the opt-in calendar features described above.
• Health Connect read permissions (exercise, heart rate, resting heart rate, distance, total calories, weight, height, VO₂ max, plus history) — see section 1.
• Health Connect write permissions (exercise, heart rate, distance, calories, steps, speed, route) — requested only if you enable the optional export of workouts to Health Connect.
• INTERNET — calls to the ZoneCoach Worker (AI Coach) and to Strava (if you link your account).

6. Your rights and controls

• You can revoke any permission in Android Settings at any time.
• You can delete all ZoneCoach data by uninstalling the app, or by clearing app storage in Android Settings. Backup files you created remain in the folder you chose — delete them there.
• You can disconnect Strava from the app's Settings screen or from your Strava account at strava.com/settings/apps.
• You can turn calendar sync, Health Connect export, and automatic backup off at any time in Settings.
• For Health Connect data, deletion is managed through Health Connect itself.
• Server-side usage counters and tester device records expire automatically (see section 2); there is nothing persistent to delete on our end.
• Subscriptions are managed and cancelled through Google Play.

7. Children

ZoneCoach is intended for users 13 years and older. The app is not designed for or directed at children under 13.

8. Changes to this policy

If this policy changes, the updated version will be published at this URL with a new "Last updated" date.

9. Contact

Questions about this policy: zonecoach.com@gmail.com