Privacy Policy

1. Who We Are

Dromotelo ("we", "us", "our") is a running training platform operated by Orangiraffe, LLC, a Texas limited liability company. Our service at dromotelo.com generates personalized, science-based training plans and helps runners track their progress against those plans.

Questions about this policy can be sent to privacy@dromotelo.com.

2. Data We Collect

Account data

When you register, we collect your email address and a password (stored as a one-way cryptographic hash, we never see your plain-text password). Optionally, your display name.

Profile & training data

To personalize your training plan we may ask for: age, gender, weight, height, current fitness level, goal race, and goal time. This data is optional, the more you provide, the more accurate your plan paces become. You can update or delete this data at any time from your account settings.

Activity data

If you upload a FIT file or connect a supported app or device, we import activity metrics: date, distance, duration, average pace, average heart rate, splits, and GPS route. We extract the data we need, store it in structured form, and do not retain the original FIT file after processing.

Connected devices and apps

If you choose to connect a device or service such as Garmin, Strava, Google Health, Polar, or Intervals.icu, we import the activity data, and for sources that provide it, the wellness data listed for that source in Section 11. Access tokens for connected services are stored encrypted, and you can disconnect any service at any time from your account settings, which deletes the stored token. These integrations are not affiliated with or endorsed by their respective providers.

Usage data

We may log basic server-side usage (pages visited, errors) for debugging purposes. For aggregate traffic measurement we use Cloudflare Web Analytics, a privacy-focused, cookieless tool that does not track you across sites or build an advertising profile. We do not run third-party advertising trackers.

3. Why We Collect It

We use your data exclusively to:

• Generate and display your personalized training plan
• Calculate target paces based on your current fitness and goal time
• Compare your completed workouts against planned sessions
• Show your progress over time and adapt remaining plan weeks
• Export workouts to your GPS watch or compatible hardware
• Maintain your account and provide customer support

We do not use your data for advertising, profiling, or any purpose unrelated to your training experience.

4. What We Do Not Do

• We do not sell your personal data to any third party, ever.
• We do not share your data with advertisers or data brokers.
• We do not use your data to train machine learning models sold to others.
• We do not store FIT files beyond the time needed to parse them.
• We do not use data from connected devices or services beyond the purposes described in this policy.

5. Data Sharing

We share data only in the following limited cases:

• Infrastructure providers: Our servers are hosted with a cloud infrastructure provider in the United States. Your data is stored on this server and is not replicated to other providers without notice.
• Payment processors: If you subscribe to a paid plan, payment is handled by a PCI-compliant processor (e.g., Stripe). We never see or store your payment card details.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of our users.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, all personal data (profile, activities, plans, and account credentials) is removed from our active systems within 30 days. Encrypted backup copies may retain the data for up to 14 days after removal from active systems, until those backups are automatically deleted. Aggregate, non-identifiable data (e.g., total number of plans generated) may be retained for service analytics.

7. Your Rights

Regardless of where you live, you can:

• Access, request a copy of the data we hold about you
• Correct, update inaccurate data from your account settings
• Delete, request deletion of your account and all associated data by emailing privacy@dromotelo.com
• Export, request your activity and plan data in a portable format
• Disconnect, revoke access from any connected device or service at any time

EU / UK residents (GDPR): You have additional rights including the right to restrict processing and to lodge a complaint with your local data protection authority. Our legal basis for processing your account and training data is contract performance (delivering the service you signed up for) and legitimate interest (service improvement and security). Health Data (see Section 11) is processed only on the basis of your explicit consent, which you can withdraw at any time by disconnecting the relevant source. We process and store data in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States.

California residents (CCPA): We do not sell personal information. If applicable privacy law grants you additional rights, you may exercise them by contacting us at privacy@dromotelo.com.

Brazil residents (LGPD): You have the rights of access, correction, anonymization, portability, and deletion of your personal data, and may request information about how it is processed. Our data controller is Orangiraffe, LLC.

To exercise any of these rights, email privacy@dromotelo.com. We will respond within 30 days.

8. Security

We take reasonable technical measures to protect your data:

• All traffic is encrypted via HTTPS (TLS)
• Passwords are hashed using bcrypt (never stored in plain text)
• Database access is restricted to the application server only
• API keys and credentials are stored as environment variables, not in code

No system is 100% secure. In the event of a data breach that affects your personal data, we will notify affected users promptly and take immediate remediation steps.

9. Children's Privacy

Dromotelo is not directed at children under 13 (or under 16 for EU residents). We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us at privacy@dromotelo.com and we will delete the account.

10. Changes to This Policy

We may update this policy as the service evolves. If we make material changes, we will notify you by email or by displaying a notice in the app at least 14 days before the change takes effect. Continued use after that date constitutes acceptance of the new policy.

11. Health and Fitness Data

When you connect a source, Dromotelo imports only the wellness fields listed below for that source ("Health Data"). We keep this list synchronized with what each integration actually imports:

• Garmin: weight, body fat percentage, resting heart rate, sleep, step count, heart-rate variability (HRV), blood oxygen (SpO2), respiratory rate, VO2 max
• Google Health: weight, body fat percentage, resting heart rate, sleep, step count, heart-rate variability (HRV), blood oxygen (SpO2), respiratory rate, VO2 max
• Intervals.icu: weight, resting heart rate, heart-rate variability (HRV), sleep
• Strava: activity data only, no Health Data fields at this time
• Polar: activity data only, no Health Data fields at this time

How we use it. We use your Health Data solely to provide the service to you: displaying your metrics, trends, and training analysis in your own account.

What we never do. We do not sell Health Data or share it with advertisers, data brokers, or other third parties for their own purposes. We use service providers, including hosting and security providers, solely to operate and protect the Service.

Storage and security. Health Data is stored in access-controlled systems, scoped to your account, and transmitted over encrypted connections. Provider access tokens are encrypted at rest.

Your controls. We collect Health Data only when you actively choose to connect one of these sources by clicking its Connect button, which is your explicit, opt-in consent. You may withdraw consent at any time by disconnecting the source. This stops future collection but does not delete data already collected. You may separately, permanently delete all of your Health Data from the Health page. When you delete Health Data, it is removed from our active systems immediately. Encrypted backup copies may retain the data for up to 14 days before automatic deletion.

12. Contact

Orangiraffe, LLC
Texas, United States
(Registered agent address on file with the Texas Secretary of State)
privacy@dromotelo.com