Privacy policy

1. Who we are

NextRun (“NextRun”, “we”, “us”) is a web service at next-run.xyz that suggests your next run based on your own Strava activities. This policy explains what personal data we process, why, and what rights you have. It applies to everyone who uses NextRun.

Questions about this policy or your data: notlandedb+nextrun@gmail.com.

2. Data we collect

We only collect what NextRun needs to plan your runs.

From your Strava account (when you connect it):

• Summaries of your recent activities: sport type, start date and time, distance, moving time, average speed, average and maximum heart rate, elevation gain and workout type.
• Per-kilometre splits and laps for runs, used for pace and interval analysis.
• Strava access tokens, which let us read your activities. They are kept only in your browser (see section 6).

We do not store raw GPS routes, second-by-second streams, photos, comments, or the names and descriptions of your activities.

From feedback you send about a planned session (optional):

• The reason you chose, the plan that was shown, and the runs it was based on, with the same fields listed above.
• Your language choice and the time you sent the feedback.

From your use of NextRun:

• Your language choice, if you pick one.
• Standard technical data that our hosting provider records for every web request, such as IP address, browser type, and the time of the request, kept in server logs for security and troubleshooting.

3. How we use your data

• To calculate and show your planned run for today or tomorrow.
• To keep your connection to Strava working and to fetch only new activities.
• To keep the service secure, prevent abuse, and fix problems.

Plans are calculated with fixed, rule-based logic. We do not use your Strava data to train, fine-tune or prompt any artificial intelligence or machine learning model, and we do not send your data to any such model. This follows Strava’s API Agreement.

We do not sell your personal data, use it for advertising, or build advertising profiles about you.

4. Legal basis (EU, EEA and UK users)

Where data protection laws such as the GDPR and UK GDPR apply, we rely on these legal bases:

• Providing the service: processing needed to deliver the planning you asked for when you connected your Strava account.
• Legitimate interests: keeping the service secure, preventing abuse, and debugging problems, balanced against your rights.
• Consent: for any optional features that need it. You can withdraw consent at any time.

5. Cookies and similar technology

NextRun does not use advertising, analytics or tracking cookies. We use only these cookies:

• Sign-in state cookie (nextrun_oauth_state): protects the Strava sign-in against forgery. It lasts 10 minutes and is removed once sign-in completes. Needed for sign-in.
• Language cookie (locale): remembers the language you chose. Lasts one year.

Because these cookies are strictly necessary or only remember your own choice, we do not ask for consent to set them.

6. Security

• NextRun keeps no accounts. Strava tokens and activity data stay in your browser, except the training data included in feedback you choose to send (see section 2), which is stored in our database.
• Your browser calls Strava directly, using your own access token.
• Strava requires refreshing a token to be done with our client secret. That one request passes through our server, which forwards it to Strava and keeps neither token.
• Sign-in uses Strava’s OAuth flow, so we never see or store your Strava password.
• After sign-in, your tokens reach your browser in the address fragment, which browsers do not send to a server, and are removed from the address bar straight away.

No system is completely secure. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires it.

7. Who we share data with

We share data only with the following services, and only as needed to run NextRun:

• Vercel, which hosts the application and keeps server logs.
• Neon, which provides the Postgres database that stores feedback reports.
• Strava, the source of your activity data. Your browser sends requests to Strava using the access you granted. Strava’s own privacy policy applies to data you have on Strava.

These providers may process data outside your country, including in the United States. Where required, they rely on approved transfer safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

We may also disclose data when required by law or to protect the rights and safety of users.

8. Payments

NextRun is currently free to use, and we do not take payments. If paid access is introduced, payments will be handled by Stripe. We will not receive your full card details, and we will update this policy before any payment feature goes live.

9. How long we keep data

• Strava tokens, your cached activities and the plan are kept in your browser until you choose “Log out”, clear your browser’s site data, or disconnect.
• We keep no account, activity or token data on our servers, apart from feedback reports you send. Those are stored in our database.
• Server logs are kept by our hosting provider for a limited period under its own retention rules.

To stop NextRun reading your Strava data altogether, disconnect it in Strava under Settings → My Apps. Strava may keep its own copy of your activities under its privacy policy.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on it.

To use any of these rights, email notlandedb+nextrun@gmail.com and say which right you want to use. Because the data sits in your browser, you can also view and erase it there. We will respond within one month, and may ask you to confirm your identity first. You can also disconnect NextRun at any time in Strava under Settings → My Apps.

If you are in the EU, EEA or UK and believe we have handled your data unlawfully, you have the right to complain to your local data protection authority.

11. Children

NextRun is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as NextRun changes. The “Last updated” date at the top shows when it last changed. For material changes we will tell you before they take effect, for example on the home page.

13. Contact

For privacy questions or requests, email notlandedb+nextrun@gmail.com.