Privacy Policy

Last updated: 08/05/2026

1. Who we are

Kepa is a personal running tracker operated by Mattia Gruber, reachable at mattiagruber@gmail.com. This policy explains what data we collect, how we use it, and your rights.

2. Data we collect via Strava

When you connect your Strava account we receive, via the official Strava API:

• Your Strava profile: name, profile picture, country.
• Your running activities (distance, duration, pace, heart rate, GPS streams, splits, gear).
• Activity-level metrics: cadence, elevation, temperature, power, relative effort.
• Private activities are included because you grant the activity:read_all scope.

Strava may also monitor and collect data related to your use of Strava's API Materials through our application. Please refer to the Strava Privacy Policy for details on how Strava processes that data. In the event of any conflict between this policy and the Strava Privacy Policy, the Strava Privacy Policy controls.

3. How we use your data

• To power the app: displaying your runs, computing training metrics (pace, TRIMP, HR zones), and tracking your goals.
• AI coaching summaries: your run statistics (not GPS or personal identifiers) are sent to a third-party AI provider (OpenAI) to generate personalised coaching text shown only to you. This data is used solely for inference — it is not used for model training by us or the AI provider. Please review the Anthropic Privacy Policy / OpenAI Privacy Policy for details.
• Friends & leaderboard: if you choose to add friends, your goal progress percentage is visible to friends you have mutually accepted.

4. Data we do not collect

• We do not collect your email address or Strava password.
• We do not sell, rent, or share your data with advertisers or data brokers.
• We do not use your Strava data for any AI/ML model training.

5. Data storage and security

Your data is stored in an encrypted SQLite database on a server located in Italy. Strava access tokens are encrypted at rest using Fernet symmetric encryption. All communication is over HTTPS.

6. Your rights

• Access: you can view all your data in the app at any time.
• Deletion: go to Connections → Delete account to permanently delete all your data from Kepa and revoke Strava access. You can also revoke access via Strava Settings → My Apps — when you do, Kepa will automatically delete your account within 48 hours.
• Withdraw consent: disconnect Strava via the Connections page to stop future syncing.
• Contact: email mattiagruber@gmail.com for any data request.

7. Garmin attribution

Some activities synced via Strava may originate from Garmin devices. Such data is provided to Kepa through Strava and is attributed accordingly. Garmin is a trademark of Garmin Ltd.

8. Changes to this policy

We will update this page and revise the "Last updated" date when this policy changes. Continued use of the app after a change constitutes acceptance of the updated policy.

← Back to Kepa