Who We Are

Pheidi is an independent training-plan service operated by John Farrell, publisher of the Pheidi app on Google Play and the App Store and of the websites pheidi.training and app.pheidi.training. The developer is the data controller for the personal data described here. This policy covers the Pheidi web app, the Pheidi Android app, the Pheidi iOS app, and the marketing site. Contact details are in Section 14.

1. Information We Collect

When you use Pheidi, we collect the following information to provide and improve our service:

  • Account information: Email address and display name when you create an account, plus the authentication tokens issued to your signed-in devices.
  • Training data: Race times, running experience, schedule preferences, injury notes, time zone, and goal race information you provide during onboarding and plan creation, along with the plans and completed workouts generated from them.
  • Usage data: How you interact with the app, including pages visited, features used, and workout completions.
  • How you found us: When you create an account on the web, we record where the visit that led to it started: the website that sent you (a name like google.com, never the full address), the first page you saw on pheidi.training, and the campaign tags on the link you followed. If you sign up in the mobile app, we record only that. We use it only to learn which pages and sources lead people to sign up. See Section 10.
  • Device information: Browser type, operating system, app version, and screen size, for compatibility and performance purposes.
  • Diagnostics and app analytics (mobile apps): The mobile apps send crash reports, error diagnostics, and app-interaction events to our error-monitoring provider. These carry a random per-install identifier, never your name, email, or account. See Section 10, including how to switch this off.
  • Push notification identifiers (mobile apps): If you enable push notifications, we store the notification handle your device's operating system issues (FCM on Android, APNs on iOS) so we can deliver training reminders.
  • Connected accounts (Intervals.icu): If you connect Intervals.icu, we store one encrypted access token and a table that maps each of your planned sessions to the calendar event we wrote for it. We write your upcoming planned workouts (title, date, distance, duration, and the workout steps) to your Intervals.icu calendar; we only ever change or remove events we created. If you also turn on completion sync, we read activity summaries (date, distance, moving time, average heart rate) to mark your plan's runs done; we never download GPS streams or files, and we never upload, edit, or delete activities. Intervals.icu may send us webhook notices that carry only ids and timestamps. Intervals.icu is a separate service with its own privacy policy and acts as an independent controller of the data you hold there. Disconnecting revokes our access at Intervals.icu and deletes the token and mapping table immediately; removing our upcoming workouts from your Intervals.icu calendar is a separate choice you make at that moment, never automatic. Intervals.icu data is never used in AI features.
  • Uploaded activity files: If you import a .fit file exported from a watch, we read only its summary values (duration, distance, heart rate) to log the workout. Position data inside the file is never read and never stored.
  • Health, fitness, and location data (mobile apps only): If you use the Pheidi Android or iOS app and grant permission, we access workout, distance, and heart-rate data through Google Health Connect or Apple HealthKit, and, for in-app run tracking, your device's GPS location. See Section 3 for details. The web app does not access this data.

2. How We Use Your Information

We use your information to:

  • Generate and personalize your training plan based on your fitness level, schedule, and goals.
  • Adjust your plan when you miss workouts, change your schedule, or update your race goals.
  • Send you training-related notifications and plan updates (if you opt in).
  • Diagnose crashes and errors, and improve the app's training algorithms and user experience.
  • Respond to support requests.

3. Health, Fitness, and Location Data (Mobile Apps)

The Pheidi mobile app can optionally read running workouts from your device's health store and use your device's location services. Anything described here is off by default, requires your explicit permission at the operating-system level, and can be revoked at any time. None of it is available in, or used by, the web app or marketing site.

Health and fitness data

If you switch on Settings → Health Connect (Android) or Settings → Apple Health (iOS) and grant the operating-system permission, Pheidi reads running workouts from your device's health store to mark your planned runs done. It asks for read access to three things only: exercise sessions (workouts), distance, and heart rate. It never writes anything into your health store.

What happens with that data:

  • When you open the app, it reads your runs from the last 7 days and sends a summary of each to our server: start time, distance, duration, and average heart rate. No route, GPS points, or individual heart-rate samples are read or sent.
  • A run that matches a planned workout on the same day, at about the planned distance, marks that workout done with those numbers, the same as if you had logged it. A run you already logged or skipped is never changed.
  • A run that does not match a planned workout is not stored. Nothing is kept about it on our server.
  • Numbers that came from your health store are not shown to the optional AI assistant (Section 5), and not shown to anyone viewing a plan you have shared. They see that the workout is done, but not its distance, time, or heart rate.

This is separate from other fitness data you give Pheidi directly: workouts you log yourself, upload as a .fit file, record with in-app run tracking, or sync from Intervals.icu (Sections 1 and 8). Your heart-rate zones and resting/maximum heart rate, if you enter them, are part of your profile.

Health and fitness data is used only to track your training. It is never sold, never shared with third parties, never used for advertising, and never transferred to anyone other than the hosting providers that store it on our behalf. It is never used to train, fine-tune, or evaluate any AI or machine-learning model. You can switch the sync off in Settings, and revoke Pheidi's access at any time in your device's Health Connect or Apple Health settings; signing out also switches it off. Our use of Health Connect data follows the Health Connect Permissions policy, including its Limited Use requirements, and requests only the permissions the feature needs. Apple HealthKit data is handled under the same rules.

Location data

The mobile app includes in-app run tracking. If you grant the location permission, the app uses your device's GPS location to measure the distance, pace, and duration of a run only while you have actively started a run in the app. The permission is requested the first time you tap Start, never at launch, and the app never requests background-location access.

While a run is in progress, tracking continues if your screen locks or you switch apps. On Android this runs as a foreground service, which shows a persistent notification for as long as the run is recording, so it is always visible when location is in use. Tracking stops the moment you finish or discard the run.

We do not store your route. GPS coordinates exist only in your device's memory during the run, in a local crash-recovery buffer on your device, and in the request that sends the run to our server to compute its totals. They are never written to our database and never written to our logs. What we keep is the resulting summary: start time, duration, moving time, distance, and pace. The consequence is deliberate — Pheidi has no route maps, no route thumbnails, and no GPX export. Location data is never sold, never shared with third parties, and never used for advertising or AI training.

The web app and marketing site do not access GPS or device location.

Google Play Data Safety

These integrations correspond to the following declarations on the Google Play Data Safety form. In every case the data is encrypted in transit, is not shared with third parties, and can be deleted on request (Section 9):

  • Location (precise): collected with permission during an active tracked run; optional; used for app functionality. No route or coordinate data is retained.
  • Personal info (name, email address): collected; required to have an account; used for app functionality and account management.
  • App activity (app interactions): collected; used for app functionality and analytics; can be switched off in Settings.
  • App info and performance (crash logs, diagnostics): collected; used for app functionality and analytics; can be switched off in Settings.
  • Device or other IDs: a random per-install identifier and a push notification handle; used for app functionality and analytics.
  • Health and fitness (fitness info): collected; used for app functionality. This covers workout distance, duration, pace and heart rate that you log, upload, record, sync from Intervals.icu, or (if you switch it on) read from Google Health Connect or Apple Health to mark planned runs done (Section 3).
  • Data deletion: you can delete your account and all associated data yourself from Settings inside the app, and our web deletion page covers the case where the app is no longer installed.

None of this data is collected for advertising, and we do not sell or share personal data as those terms are used in US state privacy laws.

4. Information We Do Not Collect

  • We do not collect payment information (Pheidi is free).
  • We do not use advertising cookies, advertising identifiers, or ad networks, and we do not sell, rent, or trade your personal data.
  • Apart from the run-tracking location access described in Section 3, we do not access your device's location. Apart from the optional, read-only workout sync described in Section 3, we do not access your device's health store (Google Health Connect or Apple Health), and we never write to it.
  • We do not access your contacts, photos, microphone, camera, call logs, SMS messages, or the list of apps installed on your device.

5. Artificial Intelligence and Your Data

We never use your data to train AI. Your training data, your synced activities, and any health data you connect are used only to generate and adjust your own training plan. We do not use them, or any data derived from them, to train, fine-tune, evaluate, or otherwise improve any artificial-intelligence or machine-learning model, and we never sell or provide your data to a third party for that purpose.

Your plan is produced by transparent, rule-based logic grounded in published sports-science research and established coaching methodology, not by an AI model deciding your training. Where Pheidi offers an optional AI assistant that can read your plan at your request, your data is used only to answer you in the moment; it is not retained for model training. Health, fitness, and location data is never sent to AI features.

6. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share data with:

  • Service providers: Cloud hosting and database (Microsoft Azure), transactional email and SMS delivery (Azure Communication Services, Postmark), error monitoring and diagnostics (Azure Application Insights), and push notification delivery (Google FCM, Apple APNs). These providers only access data necessary to perform their functions.
  • Legal requirements: If required by law, regulation, or legal process.

The service providers above act only as data processors with limited, contractual access to perform these functions on our behalf; they are not independent third parties and may not use your data for their own purposes. We never sell, rent, trade, or share your health, fitness, or location data for advertising, and that data never leaves the hosting and storage providers that hold it for us.

7. Data Storage and Security

Your data is stored securely in Microsoft Azure using industry-standard encryption in transit (TLS) and at rest. Access tokens on mobile devices are held in the operating system's encrypted secure storage, and the Android app disables cloud backup and device-to-device transfer of its local data. We follow security best practices to protect your information.

8. Data Retention

  • Account, profile, training plans, and workout history: retained while your account is active; deleted when you delete your account.
  • Fitness data (workout distance, duration, pace, heart rate, heart-rate zones): retained with your workout history while your account is active; deleted when you delete your account. A run read from Google Health Connect or Apple Health is kept only if it marks a planned workout done, as part of that workout; runs that match nothing are not retained (Section 3).
  • Location: GPS coordinates are never retained. Run summaries are retained like other workout history.
  • Intervals.icu token, event mappings, activity summaries, and webhook notices: deleted immediately when you disconnect Intervals.icu or delete your account. We also ask Intervals.icu to revoke our access at that moment; if that request fails (for example, Intervals.icu is down), an encrypted copy of the token is kept only so we can retry, and is deleted as soon as the revocation succeeds or after 7 days at most.
  • Push notification handles: deleted when you disable notifications, sign out, or delete your account.
  • Crash logs and diagnostics: retained by our error-monitoring provider for up to 90 days, then deleted automatically.

9. Your Rights, and Deleting Your Account

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your account and all associated data.
  • Export your training data.
  • Disconnect Intervals.icu from Settings, which revokes our access and deletes the stored token and mappings. You can also revoke it from your Intervals.icu settings under Apps.

Account deletion

In the app. Settings has a Delete account section at the bottom. It asks you to confirm twice, and then deletes immediately — there is no waiting period, no confirmation email, and no way to undo it. This is the fastest route and the one to use if you can still sign in.

If you have already uninstalled. Our account deletion page explains the email route: write to support@pheidi.training from the address on the account. Requests are actioned within 30 days.

Either route removes your profile, training plans, workout history, run summaries, synced activity data (and revokes our Intervals.icu access — a failed Intervals.icu revocation is retried from an encrypted copy of the token for at most 7 days, then discarded), push notification handles, your authentication tokens, and any AI assistant connections you authorized.

One exception: bug reports. Feedback and bug reports you submitted are unlinked from your account rather than deleted, because a bug report describes a fault in Pheidi that may still need fixing. We remove the link to your account, so the report is no longer associated with you and never appears in anyone's account again. We do not edit the text you wrote: if you included your name, email address or anything else identifying in the report itself, that text stays. Tell us and we will delete a specific report outright.

Anonymous aggregated statistics that cannot identify you, and records we are legally required to keep, may also be retained.

To exercise any other right, contact us at the email below.

10. Cookies, Analytics, and Diagnostics

Marketing website

We use Google Analytics 4 (GA4) to understand how visitors use our marketing site. GA4 uses cookies to collect aggregated, pseudonymous usage data such as pages visited, session duration, and referral source.

If you are in the EU, EEA, or Switzerland, we apply Google's Consent Mode v2 with a region-scoped default-deny: no analytics cookies are set until you accept. A first-visit banner asks for your choice. We do not use advertising cookies anywhere.

Changing your choice: Your preference is saved in your browser's local storage under the key pheidi_consent_v1. To revoke or change your consent, clear this site's cookies and stored data (via your browser's site data tools), which removes both that key and the Google Analytics cookies, and the banner will reappear on your next visit. Choosing Decline also removes the Google Analytics cookies. You can also opt out of GA at any time using your browser's cookie settings or a browser extension like Google Analytics Opt-out.

Web app signups

Signup source: When you arrive at app.pheidi.training without being signed in, we set a first-party cookie, Pheidi-Attribution, that holds where the visit came from (the referring site's name, the first page you saw, and any campaign tags on the link). It is not shared with Google or anyone else. If you create an account in that same browser within 30 days, it is copied onto the new account the first time you sign in there, and the cookie is deleted; otherwise it expires. It is only ever copied onto an account created in the last day, so signing in to an existing account never relabels it, and if you finish signing up on a different device (for example by opening the sign-in email on your phone), nothing is copied. On pheidi.training, the first page of your visit is kept in your browser's session storage so it can travel with you to the app, and only where Google Analytics is allowed to run for you: if you declined analytics, or live where it stays off until you accept, it is not kept.

Signup event: When you create an account on the web and Google Analytics is already running for you on pheidi.training, our server tells Google Analytics that a signup happened, using the same pseudonymous Google Analytics identifier your browser already has. Nothing that identifies you is sent: no email address, no name, no account number. If Google Analytics is not running for you, nothing is sent.

Mobile apps

The Android and iOS apps do not use Google Analytics and contain no advertising SDK. They send crash reports, error diagnostics, and a small set of app-interaction events to Azure Application Insights so we can find and fix problems. These records carry a random identifier generated on your device at install time, the app version, and the device platform — never your email, name, or account identifier. Event values are filtered before sending, so free text you type, such as an injury note, is never included.

Opting out: open Settings → Privacy in the mobile app and turn analytics off. Nothing further is sent from that device.

11. Third-Party Links

Our articles and site may contain links to external websites and research papers. We are not responsible for the privacy practices of those sites.

12. Children's Privacy

Pheidi is not directed to children under 13, and the app is not designed for or targeted at children. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. If you believe a child has provided us with data, contact us at the address below.

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our site or sending an email. The "Last updated" date at the top of this page indicates when this policy was last revised.

14. Contact Us

If you have questions about this privacy policy or your data, contact the developer at:

Email: support@pheidi.training

Account deletion requests: pheidi.training/delete-account/