AVERONPrivacy Policy
Averon is a running-shoe rotation coach. This policy explains what the Averon mobile app (iOS and Android) and this website collect, why, on what legal basis, who else handles it, how long we keep it and what you can do about it.
Who is responsible for your data
Averon is a product of Endorphin Studio Ltd, the data controller, a company registered in England and Wales (company number 13352046), registered office Flat 26 6 Waterworks Yard, Croydon, England, CR0 1UL. For any privacy question or request, email support@averon.run.
Who Averon is for
Averon is for people aged 18 and over. The app asks for your date of birth, and if it is under 18 the account is deleted straight away and nothing entered is kept.
What we collect
Your account
- Email address and name.
- Your password, stored only as a one-way hash. If you sign in with Google or Apple, we store the account identifier that service gives us instead.
- Language, units (km or miles), country, when you accepted the terms, and whether you agreed to receive product emails.
Your runner profile
- Date of birth, sex, height and weight.
- Foot details you choose to give: arch, foot roll (pronation), width, and fit and cushioning preferences. Every foot question can be answered "I don't know".
- Training: weekly distance, experience, goals, usual terrain, target race and date, and quality sessions per week.
Health data, only with your consent
- Injury history and any current pain, including where it is.
- Runs imported from Apple Health or Health Connect.
Averon collects these only if you turn on Health data in the app (see "Your consents" below). Without it, Averon does not ask about injuries and does not read your phone's health app.
Your shoes and runs
- The shoes in your closet, their status (active, trial, retired), their role in your rotation and their mileage.
- Runs you log or import: date, distance, duration, pace and activity type.
- How a run felt: comfort score, soreness, and whether you would use the shoe again.
- If you retire a pair, the reason you give and any detail you add (for example, where discomfort started). This is optional, and you can edit or remove it at any time.
Technical data
- Crash and error reports from the app, with a record of the screens and actions just before the problem. These are linked to an internal account number, never your name or email.
- Server and security logs (time, request and IP address).
Averon has no advertising and no advertising trackers, and we do not sell your data.
Why we use your data, and the legal basis
| Purpose | Legal basis |
|---|---|
| Running your account and the service you asked for: sign-in, your profile, shoes and runs, your rotation plan, shoe wear and replacement, and coaching from the runs you log | Contract: we need this data to provide Averon to you |
| Using injury and pain details, and importing runs from Apple Health or Health Connect | Your explicit consent (article 9(2)(a) UK GDPR and EU GDPR), given separately in the app |
| Sending profile and training details to an AI provider to write explanations and coach messages | Your consent, given separately in the app |
| Importing activities from Strava | Your consent, given when you connect Strava |
| Importing activities and available FIT data from Garmin | Your consent, given when you connect Garmin |
| Account emails such as verification codes and password reset | Contract |
| Product update emails | Your consent, given at sign-up; you can unsubscribe at any time |
| Keeping the service secure, crash reports and server logs | Our legitimate interest in running a secure, working service |
Recommendations are made by fixed rules, not by AI. AI is used only to write the plain-language explanation of a recommendation and short coach messages.
Your consents
The app asks for two separate consents, both off until you turn them on. You can change either at any time in Profile › Privacy & data. Each answer is recorded with the date and the version of the wording you saw. If the wording changes, the app asks again.
- Health data: lets Averon use the injury and pain details you choose to share, and import runs from Apple Health or Health Connect. Turning it off deletes the injury and pain details already shared and the runs imported from those apps.
- AI-written explanations: lets Averon send the details described under "AI providers" to an AI provider. Turning it off stops this from the next request; your recommendations do not change, only their wording becomes simpler.
AI providers
Only if you allow AI-written explanations, we send an AI provider (Anthropic, with Google Gemini as a backup) the details it needs: your age, sex, height, weight, running profile, your shoe list and recent runs logged in Averon. Injury details and runs imported from Apple Health or Health Connect are included only if you have also allowed health data. We never send your name or email address.
Strava and Garmin device-sourced data are never sent to an AI provider. See the provider sections below.
Strava
This section applies only if you connect your Strava account. Connecting is optional, and Averon works without it.
What Averon asks Strava for
Permission to read your profile and your activities, including private ones (Strava scopes read and activity:read_all). Averon never posts, edits or deletes anything on Strava.
What we import
For each activity: date, distance, duration, pace and activity type. We also store your Strava athlete ID and the access keys Strava issues, which are encrypted.
How we use it
Imported activities appear only in your own private run diary, where you can attach the shoe you wore. Other users cannot see them. While an activity is stored, its distance counts towards that shoe's mileage.
What we never do with Strava data
- Send it to an AI provider, or use it to train or improve any AI or machine-learning model.
- Include it in statistics or analysis across users, including our internal admin statistics.
- Show it to other users, share it or sell it.
How long we keep it
Imported Strava activities are deleted automatically 7 days after import. The app tells you this before you connect. When an activity is deleted, the distance it added to a shoe is removed too: Averon keeps no lasting mileage total derived from Strava.
Before 6 November 2026, distance from deleted Strava activities stayed in shoe mileage. If you had Strava connected then, the app asks you once to confirm, correct or reset the mileage of each of your pairs. The figure you confirm is stored as your own statement, with the date you gave it, and nothing from the deleted activities is kept.
Disconnecting
- In Averon: Profile › Devices › Strava › Disconnect. Averon withdraws its access at Strava and permanently deletes every activity it imported, together with the distance those activities added to your shoes.
- On Strava: if you remove Averon from your Strava settings (My Apps), Averon deletes your connection, the imported activities and the distance they added as soon as Strava notifies it.
- Deleting your Averon account does the same, then deletes everything else.
Strava handles your data on its own platform under the Strava Privacy Policy.
Garmin Connect
A Garmin connection is a planned optional feature. Averon does not currently collect Garmin data from public users. This section describes how Garmin device-sourced data will be handled when the connection becomes available.
What Averon will ask Garmin for
With your permission, Averon will use the Garmin Activity API to receive your completed running activities and available FIT data after you sync a Garmin device. Averon will not write to or alter your Garmin account.
What we will import
Activity date, duration, distance, pace, activity type, device metadata and running-dynamics fields recorded by your device. We will also store the Garmin account identifier and access credentials needed to maintain the connection; access credentials will be encrypted.
How we will use it
Imported Garmin activities will appear only in your private run diary and private running-dynamics views. If Garmin supplies a shoe or equipment identifier, Averon will ask you to confirm the physical pair in your private closet before keeping the association or applying its distance to that pair. Subject to Garmin's written approval, Averon will use confirmed activity distance to maintain private per-pair mileage and deterministic wear and rotation indicators.
What we will not do with Garmin data
- Sell it, use it for advertising, or expose it to another athlete.
- Send it to Anthropic, Google Gemini, another external AI or machine-learning service, or an embeddings service.
- Use it in cross-user analytics or to train or improve an AI or machine-learning model.
Storage and deletion
Railway will host Averon's API, database and queue/cache used to process Garmin payloads. If a raw FIT file needs temporary storage, that copy will be encrypted and deleted within 24 hours of receipt, including after failed processing. Garmin device-sourced data will be excluded from external analytics, crash-report payloads, AI and machine-learning services, and embeddings services.
Normalized activity data, user-confirmed shoe associations and related private mileage records will be kept only while needed to provide the connected feature and only where Garmin permits that retention. Disconnecting Garmin or deleting your Averon account will revoke the connection and delete Garmin device-sourced data and identifiers held by Averon. Garmin-derived shoe mappings, mileage contributions and wear or rotation indicators will also be deleted or recalculated so independently recorded shoe mileage remains intact, except records we are legally required to retain.
Before releasing the connection to public users, Averon will complete Garmin's review and align retention, attribution and deletion behaviour with Garmin's final written requirements. Garmin handles data on its own platform under the Garmin Privacy Policy.
Apple Health and Health Connect
Only with your health-data consent, and after you allow it in your phone's settings, Averon reads your workouts, distance, steps, active energy and heart rate on your phone, and imports your runs into your diary (date, distance, duration and pace). On iPhone you can also let Averon save runs you log to Apple Health. You can withdraw either permission at any time. Data from Apple Health and Health Connect is never used for advertising and is never sold.
Who else handles your data
We use infrastructure and service providers to run Averon; those providers process data only on our instructions. Connected platforms such as Strava and Garmin operate their own services under their own privacy policies, and Averon exchanges data with them only when you choose to connect.
| Provider | What for |
|---|---|
| Railway | Hosting for the Averon servers and database |
| Anthropic, Google (Gemini) | Writing recommendation explanations and coach messages, only with your consent (see "AI providers") |
| Resend | Sending account emails such as verification codes |
| Sentry | Crash and error reports from the app |
| Google, Apple | Sign-in, only if you choose Google or Apple sign-in |
| Strava | Importing your activities, only if you connect it |
| Garmin | Importing completed running activities and available FIT data, only if you connect it after the feature becomes available |
When you tap a button to buy a shoe, you leave Averon for the partner store's website. The link carries a partner code so the store knows you came from Averon. It contains no personal data. The store's own privacy policy then applies.
International transfers
Some of these providers process data outside the UK and the European Economic Area, including in the United States. Where that happens we rely on appropriate safeguards, such as the UK International Data Transfer Addendum and the EU standard contractual clauses, or an adequacy decision. You can ask for a copy of the safeguards that apply by emailing support@averon.run.
How long we keep your data
- Account, profile, shoes and runs: while your account is open. Deleting your account erases them immediately.
- Health data: until you turn health-data consent off or delete your account, whichever comes first.
- Strava activities: 7 days after import, or immediately when you disconnect, revoke or delete your account. The distance they added to your shoes goes with them.
- Garmin raw FIT files, after the planned connection is released: within 24 hours of receipt, including failed-processing and temporary copies. Other Garmin device-sourced data and identifiers: only while needed for the connected feature and while the connection remains active, subject to Garmin's final written requirements.
- Consent records: while your account is open, deleted with it.
- Crash reports (Sentry): deleted automatically within 90 days.
- Server and security logs (Railway): deleted automatically within 30 days.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. Where we rely on your consent, you can withdraw it at any time; this does not affect processing that happened before.
- Copy of your data: in the app, Profile › Delete account › Download my data first. You get your profile, shoes, runs, retirement reasons and consent records as a file you can save or share. Downloading does not delete anything.
- Change your consents: in the app, Profile › Privacy & data.
- Delete your account: in the app, Profile › Delete account. This permanently deletes your account and everything linked to it. If Strava or Garmin is connected, Averon first withdraws its access from the provider. Deletion is immediate and cannot be undone.
- Correct your data: most details can be changed in the app.
For anything else, email support@averon.run from the address you signed up with.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk), our supervisory authority. If you live in the European Union, you can also contact the data protection authority in your country, for example the Garante per la protezione dei dati personali in Italy.
Security
Data travels over encrypted connections. Passwords are stored only as one-way hashes, and provider access keys are encrypted in our database. Access to production systems is limited to the people who run the service.
Changes to this policy
If we change this policy, we will update the date at the top of this page. For significant changes, we will also tell you in the app, and where a change affects a consent, the app asks you again.