Privacy Policy

Last updated: June 27, 2026

1. Who We Are

FinishArc is a personal marathon training tracker built for runners following the Galloway run-walk-run method. The app is operated by an individual developer. Contact: hello@finisharc.com.

2. What Data We Collect

We collect only what is necessary to provide the app's features:

• Email address: used to create and authenticate your account via a magic sign-in link. We do not use your email for marketing.
• Training logs: run dates, actual miles, time, heart rate, temperature, humidity, and notes you enter.
• Race information: race dates, distances, goal times, and priority levels you add.
• Settings: your magic mile pace, run/walk intervals, schedule preferences, and heart rate threshold.
• Race results: finish times and race outcomes you record.
• Strava tokens (optional): if you connect Strava, we store your Strava access and refresh tokens to enable activity syncing. We do not store your Strava password.

We do not collect your location, contacts, payment information, or any data unrelated to training.

3. How We Use Your Data

• To generate and display your personalized training plan.
• To sync your data across your devices.
• To import your run activities from Strava (if you choose to connect it).
• To generate your calendar feed (if you enable calendar sync).

We do not use your data to train AI models, for advertising, or for any purpose beyond operating FinishArc.

4. How We Store Your Data

Your data is stored in Supabase, a secure cloud database with row-level security enabled. Only your account can read or write your data. The app is hosted on Netlify.

Data is stored in the United States. Supabase and Netlify each maintain their own security and compliance programs.

5. Strava Integration

If you connect your Strava account, FinishArc will:

• Request read-only access to your Strava activities (activity:read_all scope).
• Import your recent runs (distance, duration, heart rate, temperature) into your training log.
• Store your Strava OAuth tokens securely in our database to enable automatic token refresh.

We never post to Strava, modify your Strava activities, or access data beyond your run activities. You can disconnect Strava at any time from Settings, which removes your tokens from our database.

Strava's own privacy policy applies to data held by Strava: strava.com/legal/privacy.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

• Supabase: your data is stored on their infrastructure.
• Netlify: our hosting provider processes requests to serve the app.
• Strava: only if you choose to connect your account.
• Legal requirements: if required by law or to protect the rights of users.

7. Your Rights and Controls

You have full control over your data:

• View your data: everything is visible within the app.
• Delete your data: go to Settings → Danger Zone → "Delete All Data" to permanently remove all your training data and account information.
• Disconnect Strava: go to Settings → Strava Sync → "Disconnect" to revoke access and delete your stored tokens.
• Export your data: contact us at hello@finisharc.com to request a copy of your data.

8. Data Retention

Your data is retained for as long as you have an account. If you delete your account via the Danger Zone, all data is permanently deleted from our database. We do not retain backups of deleted accounts beyond 30 days.

9. Children's Privacy

FinishArc is not directed at children under 13. We do not knowingly collect data from children under 13.

10. Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date above. Continued use of FinishArc after changes constitutes acceptance of the updated policy.

11. Contact

Questions or concerns? Contact us at hello@finisharc.com.