Run Signal & Maros Tech Privacy Policy

Your Health data is yours. Here's exactly what we collect through the Run Signal app and our website, why, and where it goes.

Effective date: 1 October 2026

This Privacy Policy explains how Maros Tech Pty Ltd ("we", "us", "our"), an Australian company, collects, uses, discloses, and protects information when you use:

• the Run Signal iOS app (the "App"); and
• our website at marostech.com, including its account, subscription, and contact features (the "Website"),

together, the "Services". This Policy forms part of, and should be read alongside, the Run Signal & Maros Tech Terms & Conditions.

If you have questions about this Policy or your data, contact us at contact@marostech.com.

1.Scope

This Policy covers information collected through the App, through the Website, and through the third-party services the Services connect to on your behalf (including Apple Health, Apple's App Store, Google Sign-In, Strava, our web payment providers, and our own backend service that powers AI Coach). It does not cover other apps or websites, even ones linked from the Services.

2.Information We Collect

Health and fitness data (App only, from Apple Health)

When you grant permission, Run Signal reads workout and related data from Apple Health — for example, running and walking workouts, distance, pace, duration, heart rate, heart-rate variability, resting heart rate, VO2max, and route/GPS data associated with a workout. Run Signal requests read-only access and never requests permission to write, modify, or delete anything in Apple Health.

You choose exactly which of these data types to share when the system permission prompt appears, and you can change that choice at any time in iOS Settings. Health data you decline to share is simply unavailable to Run Signal — the App does not know it exists.

Raw route/GPS data and the full detail of your Health data are processed and stored primarily on your device. Sensitive on-device caches (route data, profile details such as date of birth, biological sex, weight, and height) are stored with an elevated level of file-level encryption and are excluded from iCloud/device backups. Health data is not shown on or uploaded to the Website.

Account information

To use the Services you sign in with Google Sign-In or an email address and password. Depending on the option you choose and the permissions you grant during sign-in, this may give us your name and email address, together with a unique account identifier. If you use email and password, your password is handled by our authentication provider (Google Firebase Authentication) and is never visible to us. We use a cloud database (Google Firestore) to store your account record and keep your settings in sync across the App, the Website, and your devices.

Profile information you provide

Information you enter yourself in the App — such as date of birth, biological sex, weight, height, unit preference, and your long-run distance threshold — is stored on your device and synced to your account so it's available if you reinstall the App or sign in elsewhere.

Training summary data (for AI Coach)

To generate AI Coach insights (for example, "This Week," "Recovery," "Training Load," and route-based insights), Run Signal sends a summary of your training to our backend service. This includes things like: your age and biological sex; VO2max, resting heart rate, and training-load estimates; personal bests; weekly/monthly training summaries (volume, consistency, intensity distribution); and summaries of your recent individual runs (distance, pace, duration, heart-rate data). This summary is used to generate your coaching insights and is not used for advertising. We do not knowingly include your precise GPS route coordinates in this summary — route data itself stays on your device.

Connected third-party services (optional)

If you choose to connect Strava, Run Signal imports your Strava activity history to supplement your data. This is entirely optional and only happens if you initiate the connection; you can disconnect it at any time.

Subscription and payment information

Run Signal Premium can be purchased in two ways:

• In the App, through the Apple App Store. Apple processes your payment details directly.
• On the Website, through RevenueCat Web Billing, with payments processed by Stripe. When you check out, Stripe collects your payment card details, and may collect your name, email address, and billing country or postcode, to process the payment and prevent fraud.

In both cases, we never see or store your full card details. We use RevenueCat to manage subscription status (which plan you're on, whether it's in a free trial, active, or cancelled, and where it was purchased) so the right features unlock wherever you sign in. This involves sharing your account identifier (a random ID, not your name) and your purchase/subscription status with RevenueCat and, for web purchases, your email address for receipts and account management.

Messages you send us

If you contact us through the Website's contact form or by email, we receive your name, email address, the topic you select, your message, and your chosen website language. We use this only to respond to you and to improve our support. Contact-form messages are delivered to our inbox by our email delivery provider (Resend).

Website technical data

When you visit the Website, our hosting and security provider (Cloudflare) processes technical information such as your IP address, browser type, requested pages, and timestamps in order to deliver the Website and protect it from abuse. The Website loads fonts from Google Fonts, which means your browser sends a request, including your IP address, to Google.

The Website does not use advertising or analytics cookies. It uses your browser's local storage only for essential features: to keep you signed in, to remember your language choice, and to remember that you dismissed a banner. You can clear this at any time in your browser settings.

Diagnostics and crash reports (App)

We use Firebase Crashlytics to help us find and fix bugs. If Run Signal crashes or encounters an error, technical diagnostic information (device type, OS version, and the crash log itself) is sent to Crashlytics, tied only to your pseudonymous account identifier — never your name or email.

Basic usage analytics (App)

We use Firebase Analytics to understand which screens and features are used, in an aggregated, coarse way (for example, that a particular screen was viewed, or that a particular feature flag applied to a session) — not what you did within a screen or your personal Health data. Run Signal does not use advertising identifiers (IDFA) or any cross-app/cross-site tracking, and does not use any advertising SDK.

3.How We Use Information

We use the information described above to:

• provide Run Signal's core features — tracking, analysing, and displaying your running and walking activity;
• generate the AI Coach insights, training-load, recovery, and related estimates described in the Terms & Conditions;
• create and maintain your account, and keep your settings and profile in sync across the App, the Website, and your devices;
• process payments, manage your subscription and free trial, and recognise your subscription on every platform where you sign in;
• respond to your questions and support requests;
• operate, secure, and protect the Services, including preventing fraud and abuse;
• diagnose and fix bugs and crashes;
• understand, in aggregate, how Run Signal is used so we can improve it; and
• comply with legal obligations and enforce our Terms & Conditions.

We do not use your Health data to serve you advertising, and we do not sell your data to anyone.

4.Who We Share Information With

We do not sell, rent, or share your data with advertisers or data brokers. We do share information with the following categories of service providers, only as needed to run the Services:

Provider	What they receive	Purpose
Apple	App Store purchase data	App distribution; App Store subscription billing
Google (Firebase & Google Sign-In)	Sign-in identity token or email/password credentials; account/profile records; crash logs; coarse App usage events	Sign-in and authentication; account sync (Firestore); crash reporting (Crashlytics); App analytics
Google (Gemini)	Your training summary (see Section 2)	Generating AI Coach insight text
RevenueCat	Account identifier; subscription/purchase status; email address for web purchases	Subscription management across the App and the Website; web checkout
Stripe	Payment card details; name, email address, and billing country/postcode entered at checkout	Processing Website payments; fraud prevention
Cloudflare	IP address and technical request data; contact-form submissions in transit	Website hosting, delivery, and security
Resend	Name, email address, and message from the contact form	Delivering contact-form messages to us
Strava (optional)	Authorisation to read your Strava activity	Importing activity history, only if you connect it

Each of these providers processes information under its own privacy policy and terms, and only has access to what it needs to perform its function for the Services. We may also disclose information where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (in which case we will take reasonable steps to ensure the receiving party honours this Policy).

5.Where Your Data Is Stored and Processed

Most of your detailed Health data (including route/GPS data) is stored locally on your device. Your account record, profile fields, and training summary are stored using Google Firestore and processed by our backend service, which runs on Google Cloud infrastructure. Subscription, payment, website, and support data is processed by the providers listed in Section 4. Because our service providers operate internationally, your information may be processed in countries other than the one you live in, including the United States. Where this occurs, we rely on our providers' own safeguards (including their data-processing and security commitments) for that transfer.

6.Your Choices and Controls

• Health permissions: choose exactly which data types to share when prompted, and review or change this anytime in iOS Settings → Privacy & Security → Health → Run Signal.
• Strava: disconnect it at any time in Run Signal's settings.
• Subscriptions: manage or cancel App Store subscriptions in your Apple ID settings, and Website subscriptions from your account page on the Website.
• Browser storage: sign out, or clear your browser's site data, to remove Website data stored in your browser.
• Account and data deletion: you can delete your account and associated data at any time from within the App's account settings, or by contacting us at contact@marostech.com. We will delete your account record and synced data within a reasonable time, except where we are required to retain certain records by law (for example, transaction records). Deleting your account does not cancel an active subscription — please cancel it first.
• Marketing communications: we do not currently send marketing email; if this changes, any such communication will include an unsubscribe option.

7.Data Retention

We retain your account and training-summary data for as long as your account is active, so Run Signal and AI Coach continue to work correctly. If you delete your account, we delete or anonymise this data within a reasonable time, except where retention is required for legal, tax, or dispute-resolution purposes (for example, subscription and payment transaction records). Support messages are kept for as long as needed to resolve your request and for a reasonable period afterwards. Crash, diagnostic, and website security logs are retained by our providers for a limited period consistent with their own standard retention practices.

8.Data Security

We take reasonable technical and organisational measures to protect your information, including: encrypting sensitive data locally on your device using an elevated level of file protection, excluding sensitive local files from device backups, encrypting data in transit (HTTPS) between the App, the Website, our servers, and our service providers, relying on PCI-DSS-compliant payment processors so we never handle card details, and limiting what each service provider receives to what it needs for its specific function. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

9.Children's Privacy

The Services are not directed at children. Consistent with the Terms & Conditions, you must be at least 16 years old, or the minimum age required in your country to consent to use of a health- and fitness-tracking service without parental consent, whichever is higher, to use the Services. We do not knowingly collect information from anyone younger than this. If you believe a child has provided us with personal information, please contact us so we can delete it.

10.Your Privacy Rights

If you are in Australia, you may have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the right to access and request correction of personal information we hold about you, and to make a complaint about how we've handled your information. You can do this by contacting us at the details in Section 12; if you're not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

Depending on where you live, you may have additional rights under local law (for example, the right to request a copy of your data, to request deletion, or to object to certain processing). Contact us and we will address your request in accordance with applicable law.

11.Changes to This Policy

We may update this Policy when the Services change, when we adopt a new service provider, or when necessary to reflect changes in law. The current version will be made available in the App and on the Website, and the effective date above will be updated. Where required by law, we will provide additional notice or seek your consent for a material change.

12.Contact Us

If you have questions about this Privacy Policy, want to exercise a right described above, or want to request deletion of your account and data, contact us at contact@marostech.com.