Privacy

Privacy Policy

Effective September 21, 2026

RUHN™ keeps your data on your device and, while Signal Memory is on (it is on by default), in your own private iCloud, so your progress survives a reinstall or a new phone. RUHN™ has no accounts and runs no analytics. Some features contact Apple or OpenStreetMap to work, for weather, maps, route planning, and naming the places you run. Those requests carry the location the feature uses, and RUHN™ adds no name or callsign to them (Section 4). One optional feature, Signal Uplink, is off unless you turn it on; when on, it sends a derived summary of a finished run so D.I.A.N.A. can compose an extended read (details below). Your iCloud copy sits in a private database in your own iCloud account. RUHN™ and other people cannot read it; Apple stores it under its iCloud terms.

1 · Information we collect

Health and Fitness Data

RUHN™ integrates with Apple HealthKit to access the following data:

Run and walk sessions (read and write), your completed running and walking missions, saved to Apple Health as sessions.
Heart rate (read only), used for effort tier classification when your heart rate reaches RUHN™ through Apple Health, for example from Apple Watch. RUHN™ never writes heart rate to Apple Health.
Resting heart rate (read), used for heart rate reserve zones and for the daily readiness read in the Protocol tab.
Walking and running distance (read), used after a run to reconcile distance when another device, such as Apple Watch, also recorded it.
Heart rate variability and sleep (read), used only for the daily readiness read in the Protocol tab.
Date of birth (read), used to work out your age for heart rate zone thresholds (Tanaka formula: 208 minus 0.7 times age) and for your age graded performance. RUHN™ keeps the age, never the date itself.

With your permission, RUHN™ also reads step and distance estimates from your iPhone's motion sensors (Motion and Fitness) during treadmill sessions, to help estimate your pace.

All HealthKit data access requires your explicit permission through standard iOS authorization prompts. RUHN™ never writes to or reads from HealthKit without your consent.

Location Data

RUHN™ uses CoreLocation to collect GPS coordinates during outdoor runs. Location is used for live pace calculation, route tracking, route planning, turn by turn navigation, looking up the street name where an outdoor run started, and, when weather is shown, retrieving current conditions for your area.

Location access is requested as "When In Use." During active outdoor missions, RUHN™ uses background location updates so pace tracking continues when the screen is locked. Continuous location tracking runs only during a mission or a calibration run you start in Settings. At rest, RUHN™ reads your position when HQ refreshes weather, while the route planner is open, and, in developer tools, when you add a run club.

Bluetooth Heart Rate Data

RUHN™ can connect to standard Bluetooth Low Energy (BLE) heart rate monitors via the Heart Rate Service (0x180D). This is used for live heart rate display and effort tier classification during missions, and for treadmill sessions where GPS is unavailable.

The BLE peripheral identifier for your connected device is stored in the iOS Keychain for automatic reconnection.

User Profile Data

Callsign, a nickname you choose (3 to 16 characters). It is not an account username. It is stored on your device, kept in your private iCloud while Signal Memory is on, and printed on the cards you choose to share. It is never sent to Signal Uplink or to the weather, map, or route planning services.
Sex (optional), used for performance calculations adjusted for age. Stored locally.

Mission and Training Data

Pace and tier data, session logs, route data, training plan data, rank and signal data, D.I.A.N.A. transcript data, and training science metrics (VDOT, cardiac drift, acute to chronic workload ratio, heart rate recovery, aerobic decoupling, signal efficiency) are all computed and stored on your device. This also includes the effort ratings you give after a run, the mileage of any shoes you track, and a record of the places where your outdoor runs start. After an outdoor run that started somewhere new, RUHN™ sends its start location to Apple to look up a street name for that place.

Signal Memory (iCloud Sync, On by Default)

Signal Memory keeps your progression and history in your own private iCloud so it survives a reinstall or a move to a new phone. That includes your rank, signal, imprints, personal records, baseline, training plan and effort ratings, callsign, age, resting heart rate, tracked shoes, saved routes, session logs, the places you have run, the GPS route of each outdoor run, and the heart rate readings of every run that recorded heart rate. It is on by default and can be turned off any time in Settings. The data is stored in a private database inside your own iCloud account. RUHN™ and other people cannot read it; Apple stores it under its iCloud terms. Syncing runs only at rest between missions, never during a mission.

Signal Uplink (Optional, Off by Default)

Signal Uplink is an optional feature, off unless you turn it on in Settings. When it is on, after a mission ends RUHN™ sends a short summary of that run to RUHN™'s relay and to Anthropic (the company behind the Claude AI model) so D.I.A.N.A. can compose an extended written analysis. The summary contains only:

The mission name, its duration in minutes, and whether distance was recorded.
Your effort tier breakdown, meaning the percentage of the run spent at low, mid, high, and peak effort.
Heart data expressed only as a percentage of your estimated maximum, whether the run came close to that maximum, and category labels for recovery, cardiac drift, and aerobic decoupling. Never your raw heart rate and never your maximum heart rate.
A category label for training load, worked out from your effort tiers.
Whether the run was on a treadmill or outdoors and at a steady effort, and which of these items were available.
A comparison with your last few runs: how many were compared, whether load and recovery were above or below your average, and whether this run was your hardest, your longest, or had your fastest recovery. The comparison uses category labels, never the underlying numbers.

What is never sent: your location or route, your raw heart rate or pace recordings, your maximum heart rate, the date or time of your run, your callsign, or any identifier that names you. Nothing is sent while a mission is in progress, only at rest afterward, and only if you have turned Signal Uplink on. The summary is sent shortly after the run ends, so the time it arrives and your device's network address are visible to Cloudflare, which hosts the relay.

Calls to the relay are verified with Apple's App Attest, which uses Apple's servers, so the relay only answers the genuine RUHN™ app. To do that, the relay keeps a random verification key created for your install, plus a daily count of how often it was used. The key is not linked to your name, your Apple Account, or the contents of your runs. The relay deletes the key automatically 180 days after you last use Signal Uplink and deletes each daily count after two days. The relay's own code never logs the contents of your runs. Cloudflare, which hosts the relay, keeps logs of calls to it for up to 7 days. Your standard analysis from D.I.A.N.A., computed on your device, is always available immediately, whether or not Signal Uplink is on. You can turn it off at any time in Settings, and nothing further is sent.

Kinematic Data (Optional)

When you enable kinematic logging, RUHN™ records accelerometer and gyroscope data at 100Hz. This is optional and stored locally.

Emergency Contact Data (Optional)

If you add emergency contacts (up to two), RUHN™ stores their names and phone numbers only in the iOS Keychain on this iPhone; they are not synced to iCloud. They are used for the CALL button during runs and, if you turn on Text on Deploy, to prepare a text to them when you start a story mission. You review and send that text yourself in Messages. It states only that you are starting a run and its planned length, never your location. Some installs that set up an earlier emergency feature, with up to three contacts, may also be offered texts to those contacts when a run starts and when it ends; the start text can include an Apple Maps link to your position. You review and send each of those yourself in Messages.

2 · How we use your information

All data collected by RUHN™ is used for a single purpose: to power your experience in the app. Pace and heart rate drive effort tier classification. Location enables pace calculation and route tracking. Training data generates and adapts your training plan. Rank and signal data track your progression.

RUHN™ does not use your data for advertising, analytics, profiling, or any purpose beyond the features described above.

3 · Data storage and security

Your data is stored locally on your device. If Signal Memory is enabled (the default), your progression and run history are also synced to your own private iCloud through Apple's CloudKit private database so they survive a reinstall or a new phone. RUHN™ maintains no user accounts and keeps no shared cloud database of your data. The one server RUHN™ operates is the optional Signal Uplink relay described above; it is used only when you turn Signal Uplink on, holds no run content, and is otherwise never involved. RUHN™ cannot access the data held in your iCloud.

Sensitive data files use iOS file protection. They are encrypted at rest and stay inaccessible until the first time you unlock your device after it restarts. Your progression is included in your normal iCloud and device backups so it can be restored. Certain caches and optional raw sensor logs are marked isExcludedFromBackup and are kept out of backups.

Emergency contacts and BLE peripheral identifiers are stored in the iOS Keychain with encryption at the hardware level.

No RUHN™ server stores your runs or your history. The optional Signal Uplink relay holds only a verification key for each install and request counts, never the contents of your runs, and is used only when you turn the feature on. Your iCloud copy is in your own iCloud account; RUHN™ cannot read it, and Apple stores it under its iCloud terms.

4 · Third party services

Apple HealthKit

RUHN™ reads and writes health data through Apple HealthKit, governed by Apple's HealthKit policies and the permissions you grant on your device. Data RUHN™ reads from Apple Health is never sold and never used for advertising. It is shared with a third party only if you turn on Signal Uplink: heart data from a finished run, which may come from Apple Health, is then sent only as the percentages and labels described in Section 1.

Apple MapKit

RUHN™ uses Apple MapKit to show maps and to snap the routes you draw to roads. Apple receives the pins you place when a route snaps, and the map area being shown: the area around you in the route planner and on the map page during a run, the area of a finished run when you view it, and, in developer tools, the run club map. After an outdoor run that started somewhere new, RUHN™ also sends its start location to Apple to look up a street name, as it does, in developer tools, for a run club you add. RUHN™ includes no name, callsign, or account in these requests.

Apple MusicKit (Optional)

If you choose Apple Music, RUHN™ asks for your permission and then controls playback through the Music app. When you browse music in Settings, RUHN™ shows your library playlists and recently played songs and can search the Apple Music catalog so you can pick what plays. This information stays between your device and Apple. RUHN™ does not send it anywhere else.

Apple iCloud (Signal Memory)

If Signal Memory is enabled, RUHN™ stores your progression and run history in your own private iCloud using Apple's CloudKit, governed by Apple's iCloud terms and privacy policy. The data lives in a private database in your own iCloud account. RUHN™, as the developer, cannot read it, other people cannot reach it, and Apple stores it under its iCloud terms. RUHN™ never shares it. You can turn Signal Memory off any time in Settings.

Apple WeatherKit

RUHN™ uses Apple WeatherKit to show current conditions on HQ and on run summaries. To do that, it sends Apple a location: your current position when HQ refreshes weather (or, without a position fix, where your latest outdoor run ended), and the place where an outdoor run ended when its summary opens. Apple states that WeatherKit uses location only to provide forecasts and does not associate it with personally identifiable information. Weather data is provided by Apple Weather.

OpenStreetMap Overpass API

RUHN™ queries the OpenStreetMap Overpass API for traffic signal locations during route planning. The request contains a map area of a few miles around your approximate position, rounded to about 1.1 km before it leaves your device. No name, callsign, or account is sent. This happens automatically when you open the route planner, at most about once a week for the same area. Like any web call, it also shows your network address to the Overpass service, which is run by FOSSGIS.

Signal Uplink Relay and Anthropic (Optional)

If you turn on Signal Uplink, the derived run summary described in Section 1 is sent to RUHN™'s relay (hosted on Cloudflare) and to Anthropic, the provider of the Claude AI model, to compose D.I.A.N.A.'s extended analysis. Only the summary is sent, never your location, raw sensor recordings, your name, or your callsign. Under Anthropic's commercial API terms, inputs are not used to train its models. Anthropic deletes these inputs and outputs within 30 days, unless they are flagged under its usage policy, in which case it may keep them longer. This happens only when the feature is turned on and only at rest after a mission.

Apple App Store

RUHN™ checks with the App Store which purchases you own when it launches and when you return to it, and any purchase you make is completed by Apple. RUHN™ never receives your payment details.

No Other Third Party Services

RUHN™ does not include any third party SDKs, analytics services, crash reporting tools, advertising networks, or tracking frameworks.

5 · Data sharing

RUHN™ does not sell your data or share it for advertising or analytics. Apart from the optional Signal Uplink feature, the only information that reaches a third party is what a feature sends in order to work, listed below.

No data is sold.
No data is shared with advertisers.
No data is shared with analytics providers.
The only data that leaves your device is: what you export or share yourself using the share sheet; calls and texts you choose to send to your emergency contacts; while Signal Memory is on, your progression and run history synced to your private iCloud; if you turn on Signal Uplink, an App Attest check with Apple and a derived summary of a finished run sent to RUHN™'s relay and Anthropic to compose D.I.A.N.A.'s analysis, as described above; and, to make features work, the requests described in Section 4: a location to Apple WeatherKit for weather, map areas and route pins to Apple MapKit, the start location of an outdoor run that started in a new place to Apple to name it, a map area around your approximate position to the OpenStreetMap Overpass API when you plan a route, Apple Music requests if you use it, and App Store requests. None of the weather, map, place naming, or route planning requests include your name, callsign, or account. Your callsign leaves your device only in your private iCloud while Signal Memory is on, and in what you choose to share or export.
A Signal Dispatch card you share can show your callsign, rank, the date, the weather, distance, time, pace, your main effort level, and the shape of your route, including where it started and ended.

6 · Data retention and deletion

All data is stored on your device and under your control. In Settings, Danger Zone offers Replay Onboarding, which keeps your data, and Reset Everything, which clears Gate Zero, your callsign, rank, signal, and mission history on this iPhone. It does not delete session logs, run routes, saved routes, your training plan, or the places you have run. It also does not delete the copy in your private iCloud: while Signal Memory is on, RUHN™ can restore your progress from it, for example the next time RUHN™ opens. To start over on this iPhone, turn Signal Memory off first, then reset. You can remove emergency contacts in Settings, Safety, Emergency Contact. Deleting a session log in History removes that log from this iPhone and, if iCloud is reachable at that moment, from your private iCloud; the run's route file, which can include heart rate readings, and its entry in your history are kept. Turning Signal Memory off stops syncing, but it does not delete what is already saved in your private iCloud. The relay's verification key expires as described in Section 1, and Anthropic deletes its copy as described in Section 4. For questions about your data or its deletion, email [email protected].

7 · Children's privacy

RUHN™ is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Date of birth is read from Apple Health to work out your age for heart rate zones and age graded performance. RUHN™ stores the age, never the date, and keeps it in your private iCloud while Signal Memory is on.

8 · Network activity during missions

RUHN™ sends nothing of its own during an active mission: no sync, no Signal Uplink, no route planning, and no weather. All voice audio is rendered in advance and bundled with the app. During a mission, the map page loads Apple map imagery for the area around you, Apple Music streams if you chose it, a call you place with the CALL button goes through your carrier, and if you turned on Text on Deploy, Messages sends the text you approve at the start of a story mission. On installs that set up the earlier emergency feature, Messages also sends the texts you approve when a run starts and ends. Everything else happens at rest, before or after a mission.

9 · Changes to this policy

We may update this privacy policy from time to time. Changes will be reflected by an updated effective date at the top of this document.

10 · Contact

If you have questions about this privacy policy or RUHN™'s data practices:

Email: [email protected]
Website: ruhn.app