1. Introduction and Scope

Treadmill Pro ("the App") is operated by SupafastTech LLC ("we", "us", "our"), a limited liability company registered in the State of Delaware, USA. This Privacy Policy explains what information we collect when you use Treadmill Pro on iOS and Apple Watch, why we collect it, how we use and store it, and what rights you have over it.

By downloading or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the App.

2. Information We Collect and Purposes

2.1 Account Information

When you create an account, we receive the following from your chosen sign-in provider:

Sign in with Apple — a unique Apple user identifier and, if you choose to share it, your email address (which Apple may relay or hide).
Google Sign-In — your Google account ID and email address.
Anonymous sign-in — a randomly generated identifier; no email or name is collected.

We use this information solely to authenticate you and associate your workout history with your account across devices.

2.2 Workout and Fitness Data

When you complete a workout, we record and store: distance, duration, estimated calories burned, average and maximum speed, and pace. This data is stored in our servers and also written to Apple HealthKit (see Section 3) if you grant that permission. We use this data to display your workout history inside the App and to generate progress summaries.

2.3 Treadmill and Equipment Information

We store the treadmill brand and model name you select in the App so the correct Bluetooth control protocol is applied during workouts. This is a user-selected label, not sensor data from the equipment.

2.4 App Settings and Preferences

We store your in-app preferences (such as display units and notification settings) on our servers to restore them when you reinstall the App or switch devices.

2.5 Crash and Error Reports

If the App crashes or encounters an error, we may automatically collect limited diagnostic information: app version number, device model (e.g., "iPhone 15 Pro"), iOS version, and a stack trace. This data contains no personally identifiable information and is used only to diagnose and fix software defects.

2.6 Data We Do NOT Collect

We do not collect precise location data, contacts, photos, microphone audio, or browsing history. We do not use tracking technologies such as advertising identifiers (IDFA) or third-party analytics SDKs.

3. Apple HealthKit Data

With your explicit permission, the App reads and writes data via Apple HealthKit:

Reads — live heart rate from Apple Watch during an active workout session, for on-screen display.
Writes — completed workouts (workout type, duration, distance, active calories, heart rate samples) to your Health database on your device.

HealthKit data is governed by strict Apple guidelines and our own commitments:

HealthKit data is not used for advertising, marketing, or any purpose unrelated to providing app features.
HealthKit data is not shared with any third party, sold, or disclosed to data brokers.
HealthKit data is not uploaded to our servers. Heart rate readings are used transiently on your device during a workout session. Workout summaries written to HealthKit are stored by Apple in your device's encrypted Health database.
If you revoke HealthKit permission in iOS Settings, the App will stop accessing Health data immediately. Previously written workout records remain in your Health database and can be deleted from the iOS Health app at any time.

4. How We Store and Secure Your Data

Account information, workout records, treadmill preferences, and app settings are stored in a self-hosted PostgreSQL database on a dedicated server operated by SupafastTech LLC. Profile avatars, if uploaded, are stored in a private AWS S3 bucket with access-controlled policies. Data in transit is protected by TLS 1.2 or higher. Data at rest is stored on encrypted drives.

Access to our production database is restricted to authorized personnel only and is protected by strong authentication credentials. We apply security patches promptly and monitor for unauthorized access.

No method of electronic storage or transmission is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

5. Third-Party Processors

We work with the following third parties who may process data on our behalf:

Apple (Sign in with Apple / App Store / HealthKit) — provides authentication and payment infrastructure and hosts the HealthKit data store on your device. Apple's Privacy Policy governs Apple's data practices: apple.com/legal/privacy.
Google (Google Sign-In) — provides OAuth authentication if you choose to sign in with Google. Google's Privacy Policy: policies.google.com/privacy.
Amazon Web Services (AWS S3) — stores profile avatars in a private, access-controlled bucket hosted in the EU-West-1 (Ireland) region by default. AWS's Privacy Notice: aws.amazon.com/privacy.
Our dedicated hosting provider — the physical server on which our PostgreSQL database runs is provided by a commercial data center. The provider does not have access to the contents of our database.

We do not use advertising networks, social media tracking pixels, or behavioral analytics platforms.

6. Subscriptions and Payments

Treadmill Pro Pro subscriptions (monthly, annual, and lifetime options) are purchased through Apple StoreKit. All payment processing is handled by Apple. We do not receive or store your credit card number or any other payment instrument details. We receive only a subscription receipt token from Apple to verify your entitlement status.

7. Data Retention

We retain your account and workout data for as long as your account is active, or for up to 90 days after account deletion to allow for error recovery. Crash and error reports are retained for 30 days and then deleted. You may request earlier deletion at any time (see Section 9).

8. International Data Transfers

SupafastTech LLC is based in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, your data may be transferred to and processed in the United States or another country where our servers or sub-processors are located. Where required by applicable law, such transfers are carried out under appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission.

9. Your Rights and How to Exercise Them

Depending on your location, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Rectification — request correction of inaccurate data.
Erasure — request deletion of your account and all associated personal data ("right to be forgotten").
Portability — request your workout data in a structured, machine-readable format.
Objection / Restriction — object to or request restriction of certain processing activities.
Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

In-App Account and Data Deletion

You can delete your account and all associated data directly from within the App: go to Settings → Account → Delete Account. Deletion is permanent. After confirmation, your account identifier, workout history, treadmill preferences, and settings will be queued for deletion from our servers within 30 days.

Email Requests

To exercise any right listed above, or if you experience any difficulty using the in-app deletion feature, email us at treadmill@supafast.tech with the subject line "Privacy Request". We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing the request.

10. GDPR Legal Bases (EEA and UK Users)

If you are located in the EEA or UK, we process your personal data under the following legal bases as applicable:

Performance of a contract — processing necessary to provide the App's core features (account authentication, saving workout history).
Legitimate interests — processing crash reports and app diagnostics to maintain and improve the App, where these interests are not overridden by your rights.
Consent — writing data to Apple HealthKit (you grant or revoke this via the iOS system permissions dialog at any time).

11. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. You therefore have the right to opt out of a sale or share that does not occur.

You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to non-discrimination for exercising your rights. To exercise these rights, contact us at treadmill@supafast.tech.

12. Children's Privacy

Treadmill Pro is not directed to children under the age of 13 (or under 16 for users in the EEA). We do not knowingly collect personal information from children under these ages. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the App, our data practices, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, notify you through the App or by email. We encourage you to review this page periodically.

14. Contact Us

For privacy questions, data requests, or concerns, contact:

Email: treadmill@supafast.tech
Company: SupafastTech LLC

SupafastTech LLC · treadmillpro.app