Privacy Policy

1. Who We Are

Dromotelo ("we", "us", "our") is a running training platform operated by Orangiraffe LLC, a Texas limited liability company. Our service at dromotelo.com generates personalized, science-based training plans and helps runners track their progress against those plans.

Questions about this policy can be sent to privacy@dromotelo.com.

2. Data We Collect

Account data

When you register, we collect your email address and a password (stored as a one-way cryptographic hash, we never see your plain-text password). Optionally, your display name.

Profile & training data

To personalize your training plan we may ask for: age, gender, weight, height, current fitness level, goal race, and goal time. This data is optional, the more you provide, the more accurate your plan paces become. You can update or delete this data at any time from your account settings.

Activity data

If you upload a FIT file or connect a supported app or device, we import activity metrics: date, distance, duration, average pace, average heart rate, splits, and GPS route. We extract the data we need, store it in structured form, and do not retain the original FIT file after processing.

Connected devices and apps

If you choose to connect a service, we import your activity data from it and, for sources that provide it, the wellness data listed for that source in Section 11. These are all the services you can connect:

• Garmin Connect, COROS, Strava, Polar and Intervals.icu, from your profile. For Garmin Connect, COROS and Intervals.icu, we can also send your planned workouts to your account there, so they reach your watch.
• Google Health (in beta), from your profile.
• Health Connect (Android) and Apple Health (iPhone), only inside the Dromotelo app on your phone.

Access tokens for connected services are stored encrypted, and you can disconnect any service at any time from your profile, which deletes the stored token. These integrations are not affiliated with or endorsed by their respective providers.

Runs recorded with the Dromotelo apps

If you record a run with the Dromotelo app on your phone, we store the run: its GPS route, time, distance, elevation, pace and splits. Your location is read only while a recording is running. If you use the Dromotelo watch app on a Wear OS watch, it records the same, plus your heart rate during the run, and sends the run to your account. A connected watch holds a key that can only upload runs and read your unit and language settings; you can disconnect it from your profile at any time.

If you create a key for Hodolog in your profile, that app can read, for one hour, the date, time and approximate start location (the area where each started) of your activities, and, for the days it asks about, the route of each of those days' activities with its sport, distance and time. Nothing else: no heart rate, names, notes or other health data. You can revoke the key at any time before it expires.

Usage data

We may log basic server-side usage (pages visited, errors) for debugging purposes. For aggregate traffic measurement we use Cloudflare Web Analytics, a privacy-focused, cookieless tool that does not track you across sites or build an advertising profile. We do not run third-party advertising trackers.

Language

On your first visit we show the site in the language of the country your IP address belongs to. The lookup happens on our own server, using a country database from the Number Resource Organization (nro.net); your address is not sent to anyone for it and is not stored. You can change the language at any time in your profile.

3. Why We Collect It

We use your data exclusively to:

• Generate and display your personalized training plan
• Calculate target paces based on your current fitness and goal time
• Compare your completed workouts against planned sessions
• Show your progress over time and adapt remaining plan weeks
• Export workouts to your GPS watch or compatible hardware
• Maintain your account and provide customer support

We do not use your data for advertising, profiling, or any purpose unrelated to your training experience.

4. What We Do Not Do

• We do not sell your personal data to any third party, ever.
• We do not share your data with advertisers or data brokers.
• We do not use your data to train machine learning models sold to others.
• We do not store FIT files beyond the time needed to parse them.
• We do not use data from connected devices or services beyond the purposes described in this policy.

5. Data Sharing

We share data only in the following limited cases:

• Infrastructure providers: Our servers are hosted with a cloud infrastructure provider in the United States. Your data is stored on this server and is not replicated to other providers without notice.
• Payment processors: If you subscribe to a paid plan, payment is handled by a PCI-compliant processor (e.g., Stripe). We never see or store your payment card details.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of our users.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account yourself, from your profile, all personal data (profile, activities, plans, and account credentials) is removed from our active systems immediately. If you ask us by email instead, we do it within 30 days. Encrypted backup copies may retain the data for up to 30 days after removal from active systems, until those backups are automatically deleted. Aggregate, non-identifiable data (e.g., total number of plans generated) may be retained for service analytics.

7. Your Rights

Regardless of where you live, you can:

• Access, request a copy of the data we hold about you
• Correct, update inaccurate data from your account settings
• Delete, delete your account and all associated data yourself, at the bottom of your profile page, or by emailing privacy@dromotelo.com
• Export, download all your data as a JSON file from your profile page, or request it by email
• Disconnect, revoke access from any connected device or service at any time

EU / UK residents (GDPR): You have additional rights including the right to restrict processing and to lodge a complaint with your local data protection authority. Our legal basis for processing your account and training data is contract performance (delivering the service you signed up for) and legitimate interest (service improvement and security). Health Data (see Section 11) is processed only on the basis of your explicit consent, which you can withdraw at any time by disconnecting the relevant source. We process and store data in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States.

California residents (CCPA): We do not sell personal information. If applicable privacy law grants you additional rights, you may exercise them by contacting us at privacy@dromotelo.com.

Brazil residents (LGPD): You have the rights of access, correction, anonymization, portability, and deletion of your personal data, and may request information about how it is processed. Our data controller is Orangiraffe LLC.

To exercise any of these rights, email privacy@dromotelo.com. We will respond within 30 days.

8. Security

We take reasonable technical measures to protect your data:

• All traffic is encrypted via HTTPS (TLS)
• Passwords are hashed using bcrypt (never stored in plain text)
• Database access is restricted to the application server only
• API keys and credentials are stored as environment variables, not in code

No system is 100% secure. In the event of a data breach that affects your personal data, we will notify affected users promptly and take immediate remediation steps.

9. Children's Privacy

Dromotelo is not directed at children under 13 (or under 16 for EU residents). We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us at privacy@dromotelo.com and we will delete the account.

10. Changes to This Policy

We may update this policy as the service evolves. If we make material changes, we will notify you by email or by displaying a notice in the app at least 14 days before the change takes effect. Continued use after that date constitutes acceptance of the new policy.

11. Health and Fitness Data

When you connect a source, Dromotelo imports only the wellness fields listed below for that source ("Health Data"). We keep this list synchronized with what each integration actually imports:

• Garmin: weight, body fat percentage, resting heart rate, sleep, step count, heart-rate variability (HRV), blood oxygen (SpO2), respiratory rate, VO2 max
• COROS: resting heart rate, heart-rate variability (HRV), sleep, step count, calories
• Health Connect (Android) and Apple Health (iPhone): workouts (type, time, distance, duration, heart rate, elevation, calories, steps and, where you allowed it, the route), weight, body fat percentage, resting heart rate, sleep, step count, heart-rate variability (HRV), blood oxygen (SpO2), respiratory rate, VO2 max. Read only inside the Dromotelo app on your phone, only after you connect it and grant access in the phone's own permission screen, and only to show your training in your account. Dromotelo never writes to them.
• Google Health: weight, body fat percentage, resting heart rate, sleep, step count, heart-rate variability (HRV), blood oxygen (SpO2), respiratory rate, VO2 max
• Intervals.icu: weight, resting heart rate, heart-rate variability (HRV), sleep
• Strava: activity data only, no Health Data fields at this time
• Polar: resting heart rate, heart-rate variability (HRV), respiratory rate, sleep (including the Polar sleep score), step count
• Dromotelo phone and watch apps: the runs you record (see Section 2), with heart rate during the run from the watch app; no daily Health Data fields

How we use it. We use your Health Data solely to provide the service to you: displaying your metrics, trends, and training analysis in your own account.

What we never do. We do not sell Health Data or share it with advertisers, data brokers, or other third parties for their own purposes. We use service providers, including hosting and security providers, solely to operate and protect the Service.

Storage and security. Health Data is stored in access-controlled systems, scoped to your account, and transmitted over encrypted connections. Provider access tokens are encrypted at rest.

Your controls. We collect Health Data only when you actively choose to connect one of these sources by clicking its Connect button, which is your explicit, opt-in consent. You may withdraw consent at any time by disconnecting the source. This stops future collection but does not delete data already collected. You may separately, permanently delete all of your Health Data from the Health page. When you delete Health Data, it is removed from our active systems immediately. Encrypted backup copies may retain the data for up to 30 days before automatic deletion.

12. Contact

Orangiraffe LLC
Texas, United States
(Registered agent address on file with the Texas Secretary of State)
privacy@dromotelo.com