Privacy Policy
Policy version 2026-10-18 · Last updated: October 18, 2026
This policy explains what personal data Blaze Running collects, why, who it is shared with, how long it is kept, and the rights you have over it. Blaze Running is a paid running app that builds and adapts a training plan for you with the help of an AI coach called Blaze. Blaze is an AI system, not a human coach.
If you live in the United States, also read our Consumer Health Data Privacy Policy, which covers the US state health-data laws (such as Washington's My Health My Data Act).
Who is responsible for your data
The data controller is Gabriel Furnieles García, Calle Hermanos Velasco López 37, 28250 Torrelodones, Madrid, Spain. You can contact us about anything in this policy at gabifurnielesgarcia@gmail.com. We have not appointed a Data Protection Officer; the contact email above handles all privacy requests.
What we collect
Account information
- Your name and email address, received from Google when you sign in with Google.
- A technical account ID, your time zone, and when you created your account and finished onboarding.
Running profile and goals (from onboarding and your goals)
- Your target race or distance, target time and date, and any intermediate goal.
- Your running level, current weekly distance, longest recent run, and personal-best times.
- Your schedule: how many days a week you train, which days, your long-run day, and when your plan starts.
- Plan warnings you chose to acknowledge.
Health data (special category, Art. 9 GDPR)
We only collect these with your explicit consent, which is asked for separately and is never pre-ticked:
- Injury history: how often you get injured (hardly ever, in the past, or frequently).
- Recovery: how long ago you recovered from your last injury.
- Limitations note: anything you choose to write about injuries or physical limitations.
- Heart rate: average and maximum heart rate you enter on an activity log.
- Health details you write yourself in activity-log notes or in chat with the coach (for example, describing pain or an injury).
Giving this consent is a condition of using Blaze Running, because the coach cannot plan your training safely without it. If you decline, you can't use the app. If you later withdraw it, the app is paused until you allow it again or delete your account. Withdrawing doesn't cancel a subscription: cancel it in Google Play.
Training data
- Your training plans, plan change proposals and goal-change requests, and whether you accepted them.
- Activities you log by hand: type (run, intervals, strides, strength), date, distance, duration, pace, maximum speed, elevation gain and loss, interval series, strength body parts, a "talk test" effort rating, and optional free-text notes.
- End-of-plan statistics computed from your logs.
Messages with the AI coach
Your conversation with Blaze is stored so the coach has context in later sessions.
Usage and security data
- A weekly count of how many AI tokens your account used, to enforce usage limits.
- Before you sign in, the onboarding goal check is rate-limited per device network address. We store only a one-way hash of your IP address, never the address itself, and it is deleted automatically after about an hour.
- Standard server logs kept by our hosting provider for security and troubleshooting.
- App integrity checks (Firebase App Check), to block requests that don't come from our genuine app or website. In the Android app, Google Play Integrity checks the app and device. On the account-deletion web page, Google reCAPTCHA assesses your browser and may store information on your device; Google's Privacy Policy and Terms apply. Our servers receive only a pass or fail token.
Purchases
Payments are handled by Google Play (or the Apple App Store) and managed through RevenueCat. We receive your subscription status linked to your account ID. We never see or store your card details.
We don't collect data from fitness trackers or health platforms (such as Android Health Connect). If that changes, this policy will be updated before it ships. We don't collect check-in questionnaires, your location, contacts, or your date of birth.
Why we use it and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, build and adapt your training plan, show your history, run the AI coach | Account information, running profile and goals, training data, coach messages | Performance of our contract with you (Art. 6(1)(b)) |
| Use your health information to fit your plan and the coach's advice to your injury history and limitations | Health data listed above | Your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)), which you can withdraw at any time |
| Enforce AI usage limits and prevent abuse of the service | Weekly token counts, hashed IP address, server logs | Our legitimate interest in keeping the service secure and affordable (Art. 6(1)(f)) |
| Sell and manage your subscription, keep purchase records | Account ID, subscription status | Performance of our contract (Art. 6(1)(b)) and legal obligations such as tax records (Art. 6(1)(c)) |
| Answer your privacy requests and support emails | Your email and what you tell us | Legal obligation (Art. 6(1)(c)) and contract (Art. 6(1)(b)) |
We don't use your data for advertising, we don't sell it, and we don't build profiles of you across other apps.
How the AI coach uses your data
To generate your plan, review your logged activities and answer you in chat, Blaze Running sends the relevant part of your data to an AI model: your goals, running level and schedule, recent activity logs (with their notes only if you consented), your conversation with the coach and, only if you consented, your health information. Your name and email address are not included.
The AI suggests the plan and changes to it. Every AI-proposed change passes automatic checks (for example, limits on how fast training load can increase), and changes to an existing plan are shown to you as proposals that you accept or reject. The AI does not make decisions with legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Blaze gives general fitness guidance, not medical advice, and will tell you to see a doctor about pain or injury.
Who receives your data
We use these service providers (processors), who handle data only on our instructions and under data processing terms:
- Google Firebase (Google Ireland Ltd. / Google LLC): sign-in, database, cloud functions, website hosting and app integrity checks (App Check, with Play Integrity and reCAPTCHA). Our cloud functions and our database both run in the EU (Belgium, europe-west1).
- Google Gemini API (Google LLC), used through Firebase/Genkit: the AI model behind plan generation and the coach. We use the paid tier, under which Google does not use your prompts or the responses to train or improve its models.
- RevenueCat, Inc.: subscription management.
Google Play and the Apple App Store process your payment as independent controllers under their own privacy policies. We may also disclose data where required by law.
International transfers
Google LLC and RevenueCat, Inc. are based in the United States, and AI requests may be processed outside the EU. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Account, profile, goals, plans, activity logs, coach messages and health data: kept while your account exists, with no automatic expiry, and deleted when you delete your account. If you withdraw health-data consent, your injury, recovery, limitations and heart-rate data are deleted at that point.
- Weekly AI usage counts: kept while your account exists and deleted with it.
- Hashed IP rate-limit counters: deleted automatically about an hour after the counting window ends.
- Data sent to the AI model: not stored by us outside your account. Under the paid-tier terms, Google may keep requests for a limited period only to detect abuse and comply with law, and does not use them for training.
- Purchase records: kept by RevenueCat and the app stores for as long as needed for billing, refunds and tax law.
- Server logs: kept for our hosting provider's standard log retention period.
Deleting your account
You can delete your account and all associated data at any time:
- In the app: Profile → Danger zone → Delete Account.
- From the web, without the app installed: blazerunning.app/delete-account.
Deletion permanently removes your profile, goals, plans, activity logs, coach messages, health data and usage counts, and cannot be undone. Deleting your account does not cancel an app-store subscription; cancel it in Google Play or the App Store.
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- rectify data that is wrong (most of it you can edit in the app);
- erase your data (see "Deleting your account");
- restrict how we process it;
- data portability: receive the data you gave us in a machine-readable format (JSON or CSV);
- object to processing based on our legitimate interest;
- withdraw your consent to health-data processing at any time, in the app's Profile screen or by email. Withdrawing doesn't affect processing done before. Because Blaze Running needs this consent to work, the app is then paused until you allow it again or delete your account.
To exercise any right, email gabifurnielesgarcia@gmail.com from the address linked to your account. We answer within one month. It's free.
You also have the right to lodge a complaint with a data protection supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you can also contact the authority in the EU/EEA country where you live or work.
Security
Data is stored on Google's Firebase infrastructure and encrypted in transit and at rest. Database access rules allow only your own signed-in account to read your data; internal records such as usage counts can be read by you but only changed by our servers.
Minimum age
Blaze Running is only for people aged 16 or older. You confirm your age before your plan is built. We don't knowingly collect data from anyone under 16; if you believe a younger person has used the app, contact us and we will delete their data.
Is providing data required?
Your Google account, goal, training availability and health-data consent are needed to build a plan; without them we can't provide the service. Answering the injury questions, entering heart rate and writing free-text notes stay optional.
Changes to this policy
When this policy changes we update the version and date above. If a change affects what you consented to, we'll ask for your consent again in the app. The in-app link always points to the current version.
Contact
Questions about this policy or your data: gabifurnielesgarcia@gmail.com.