FluxRun Privacy Policy

1. Overview

This Privacy Policy describes how Veloptix, Inc. ("Veloptix", "we", "us", or "our") collects, uses, and shares information in connection with the FluxRun mobile application ("App") and related services (collectively, the "Service").

By downloading or using FluxRun, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the App.

This policy applies to all users of FluxRun on iOS. It is intended to comply with applicable privacy laws, including the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and Apple's App Store privacy guidelines.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, and password (or authentication token if you sign in with Apple ID or Google).
• Profile data: Age, biological sex, height, weight, and running goals — used to calculate calorie estimates, training zones, and performance benchmarks.
• User-generated content: Run titles, notes, route names, and any content you post in clubs or comments.

2.2 Information Collected Automatically

• GPS location data: Precise location coordinates collected during active recording sessions only. Location is not tracked in the background when you are not recording a run.
• Workout metrics: Pace, distance, duration, elevation, cadence, heart rate, and calorie data captured during runs.
• Device information: Device model, operating system version, app version, and unique device identifiers for crash reporting and performance monitoring.
• Usage analytics: Feature interactions, session duration, and crash logs used to improve the App. This data is aggregated and not linked to your identity.

2.3 Health Data

With your explicit permission, FluxRun may read from and write to Apple Health (HealthKit). This data is governed by Apple's HealthKit terms and our health data practices described in Section 5.

2.4 Information from Third Parties

• If you connect third-party accounts (e.g., Apple ID, Google), we receive basic profile information such as your name and email.
• If you connect a Bluetooth heart rate monitor, we process the real-time heart rate data it broadcasts.

3. How We Use Your Data

We use the information we collect to:

• Provide, operate, and maintain the FluxRun App and its features.
• Track, record, and display your run data and performance history.
• Generate AI coaching insights and personalized training recommendations.
• Sync your workout data to Apple Health when authorized.
• Send transactional emails (account verification, password reset). We do not send marketing emails without your explicit opt-in.
• Detect, investigate, and prevent fraudulent activity and security breaches.
• Analyze aggregated, anonymized usage trends to improve the App.
• Comply with legal obligations.

4. Data Sharing

We do not sell your personal data. We may share data only in the following limited circumstances:

4.1 Service Providers

We use trusted third-party service providers to help operate the App. These providers are contractually bound to process data only on our behalf and in accordance with our instructions:

• Firebase (Google): Cloud database, authentication, and analytics infrastructure.
• Crashlytics (Google): Crash reporting and performance monitoring.
• Apple: App delivery, in-app purchases, Sign in with Apple, HealthKit integration.

4.2 Legal Requirements

We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable law, a court order, or governmental regulation; to protect the rights, property, or safety of Veloptix, our users, or the public.

4.3 Business Transfers

If Veloptix is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with third parties when you explicitly request or consent to such sharing (for example, sharing a run to social media).

5. Health & Location Data

5.1 Location Data

FluxRun requires location access to track your runs. Location is collected:

• Only while you are actively recording a run — we do not track your location in the background between workouts.
• With "Always" permission, the App can detect when you approach a known segment and prompt you to start tracking.

You can revoke location permissions at any time in Settings → Privacy & Security → Location Services → FluxRun. Revoking location access will prevent GPS tracking functionality.

5.2 Apple Health (HealthKit) Data

FluxRun can read and write HealthKit data when you grant permission. Specifically:

• Writes to Health: Workouts, active energy burned, distance, heart rate samples.
• Reads from Health: Resting heart rate, VO₂ max, body weight (to improve calorie accuracy).

You can manage HealthKit permissions at any time in the iPhone Health app → Sharing → Apps → FluxRun.

5.3 Bluetooth & Heart Rate Monitors

If you connect a Bluetooth heart rate monitor, the App receives real-time heart rate data directly from the device during your run. This data is processed on-device and stored as part of your workout record. It is not shared with the monitor manufacturer or any third party.

6. Data Storage & Security

Your data is stored securely using Google Firebase infrastructure hosted in the United States. Firebase complies with industry-standard security certifications including ISO 27001 and SOC 2.

We implement the following security measures:

• All data is encrypted in transit using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256.
• Access to user data is restricted to authorized personnel only on a need-to-know basis.
• Authentication tokens are stored securely in the iOS Keychain.
• Regular security reviews and vulnerability assessments.

While we take strong precautions, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us at aleem.rz@gmail.com.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you the Service. Specifically:

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Run & workout data: Retained while your account is active. Deleted within 30 days of account deletion.
• Crash logs and analytics: Retained for up to 12 months in aggregated or anonymized form.
• Legal compliance records: May be retained longer where required by applicable law.

You may request deletion of specific data or your entire account at any time — see Section 8.

8. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

8.1 Access & Portability

You may request a copy of all personal data we hold about you. Export your run data at any time from Profile → Settings → Data Export in the App (GPX and CSV formats).

8.2 Correction

You may update or correct your account information at any time from your Profile settings within the App.

8.3 Deletion

You may delete your account and all associated data:

• In-app: Profile → Settings → Account → Delete Account.
• By email: Send a deletion request to aleem.rz@gmail.com from the email address associated with your account.

Upon deletion, your personal data will be permanently removed from our systems within 30 days, except where retention is required by law.

8.4 Opt-Out of Communications

You may opt out of non-essential communications by contacting us at aleem.rz@gmail.com or by unsubscribing from any email we send.

8.5 California Residents (CCPA)

California residents have the right to know what personal information we collect, to request deletion, to opt out of sale (we do not sell personal data), and to non-discrimination for exercising these rights. To exercise your rights, contact us at aleem.rz@gmail.com.

8.6 European Residents (GDPR)

If you are located in the European Economic Area (EEA), you have the right to access, rectify, erase, restrict processing of, and port your personal data, as well as the right to object to processing and to lodge a complaint with a supervisory authority. Our legal bases for processing include performance of a contract (providing the Service), legitimate interests, and your consent where required.

9. Children's Privacy

FluxRun is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages.

If you believe a child has provided us with personal information without parental consent, please contact us at aleem.rz@gmail.com and we will delete such information promptly.

10. Third-Party Services

FluxRun integrates with the following third-party services. Each has its own privacy policy:

• Google Firebase — database, authentication, analytics: firebase.google.com/support/privacy
• Google Crashlytics — crash reporting: firebase.google.com/support/privacy
• Apple HealthKit — health data platform: apple.com/legal/privacy
• Apple In-App Purchases — subscription management: apple.com/legal/privacy

The App may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via in-app notification or email for material changes.
• Where required by law, obtain your consent before applying significant changes to how we use your personal data.

Your continued use of FluxRun after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or wish to report a privacy concern, please contact us: