Privacy Policy

1. Introduction

Supwell ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application.

2. Information We Collect

We collect information that you provide directly to us and information automatically collected when you use the Service.

• Account Information: Name, username, email address, password, date of birth, and profile biography.
• Physical & Health Data: Height, weight, shoe size, and running-related data (cadence, foot strike, experience level).
• Workout Data: Activity logs, running routes, times, distances, and heart rate data synced from third-party services (e.g., Apple Health, Garmin, Coros).
• Marketplace Data: Listings, photos of items, and communication with other users regarding transactions.
• Communications: Messages sent to other users and comments on posts.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Supwell platform.
• Analyze your running data to provide insights and track progress.
• Facilitate the Marketplace features, including displaying your listings to other users.
• Personalize your experience and content.
• Communicate with you about updates, security alerts, and support.
• Monitor and prevent fraud, abuse, and security issues.

Reported Content: When a member reports a message or comment, the Supwell team may review it together with the nearby messages or comments in that conversation or thread in order to decide on the report.

4. Sharing Your Information

Public Profile: Your username, profile photo, bio, shared workout summaries, and who you follow and who follows you may be visible to other users of the platform based on your privacy settings.

Marketplace Transactions: If you list items or engage with a seller, necessary information to facilitate the transaction (such as username and messaging capability) will be shared with the other party. We are not involved in the actual exchange of goods or payments.

Third-Party Integrations: If you choose to connect your account with a third-party service (Garmin, COROS, Apple Health, or Zepp/Amazfit), you authorize us to receive your activity data from that service to provide the features described in Section 3.

Service Providers: Supwell runs on Microsoft Azure, which hosts our servers, database, file storage, and logs. Data synced from connected services such as Garmin is stored and processed there. Microsoft processes it only on our behalf, under its own data protection terms. We do not send data from connected services to any other third party.

We Do Not Sell Your Data: We do not sell your personal information, including fitness and activity data synced from Garmin or any other connected service, and we do not share it with third parties for their own marketing or advertising.

Legal Requirements: We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to comply with legal obligations or protect the safety of users.

5. Data Security

We use administrative, technical, and physical security measures to help protect your personal information. While we strive to protect your personal information, no method of transmission over the Internet is 100% secure, and we cannot guarantee its absolute security.

6. Children's Privacy

Our Service is strictly for users aged 18 and older. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us so that we may delete it.

7. Your Rights

Depending on your location, you may have rights regarding your personal data, including the right to access, correct, delete, or export the personal information we hold about you. You can manage most of your data directly within your account settings. To request a copy of your data, email support@supwell.com from your account email address and we will send it to you in a portable format within 30 days.

Withdrawing consent for connected services: You can stop sharing data from a connected service at any time by disconnecting it on the Devices page in the app. Disconnecting Garmin also ends Supwell's access on Garmin's side. You can also remove Supwell from the connected apps in your Garmin Connect account. Activity data already synced stays in your Supwell account until you delete it or delete your account (see Section 9).

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account Information (name, username, email, profile data, physical/health data): retained for the lifetime of your account.
• Workout Data and Activity Logs: retained for the lifetime of your account so you can view your historical progress.
• Marketplace Listings and Messages: retained for the lifetime of your account, or until you delete the listing or conversation.
• Posts, Comments, and Other User-Generated Content: retained for the lifetime of your account, or until you delete the individual content.
• After Account Deletion: personal data is permanently deleted from our active production systems within 30 days. Encrypted backup copies are purged on a rolling basis within 90 days.
• Legal Holds: we may retain a limited subset of information for longer when required to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

9. Data Deletion

You can request deletion of your account and associated personal data at any time using either of the following methods:

• In-App: open the Supwell app, go to Settings, and select Delete Account. Your account and personal data will be removed according to the retention schedule in Section 8.
• By Email: send a deletion request from your account email address to support@supwell.com with the subject line "Account Deletion Request." We will verify your identity and process the deletion within 30 days.

You may also delete individual content (posts, comments, listings, messages) directly within the app at any time without deleting your full account.

Some information may persist after deletion as described in Section 8 (encrypted backups and legal-hold data), but it will not be used for any purpose other than those required by law.

10. Artificial Intelligence

Supwell uses AI-powered tools internally to assist with software development and customer support operations. These tools help our team build and maintain the app and respond to support requests.

• The Supwell app does not use AI to make automated decisions about you or your account.
• Your personal data and fitness data (including data synced from Apple Health, Garmin, or Coros) are not used to train AI models.
• Fitness data from connected services is processed only by our own systems to provide app features such as run tracking, mileage statistics, and leaderboards, as described in Section 3.
• When AI-assisted tools are used in support operations, they operate under our direction and access only the information needed to resolve your request.

If we introduce AI-powered features that process your data differently, we will update this section and notify you as described in Section 12.

11. Garmin Data

This section covers the data Supwell receives when you connect your Garmin Connect™ account. It applies on top of the rest of this policy.

• How it is collected: Only when you choose to connect Garmin Connect on the Devices page and approve access on Garmin's sign-in page. We never see your Garmin password. Garmin then sends your new activities to Supwell's own servers through the Garmin Connect Activity API.
• What we receive: For each activity you record: the activity name and type, start time, duration, distance, pace and speed, laps and splits, heart rate, cadence, steps, calories, elevation gain, the starting location, and the name of the Garmin device that recorded it, where your device records them. We also keep the full activity record Garmin sends, including its moment-by-moment samples. We also store the Garmin user ID and access tokens that link your Garmin account to Supwell.
• How it is used: To show your runs in your running log and on your calendar, add up your weekly and monthly mileage and your shoe mileage, check off training plan sessions, count toward events and leaderboards you take part in, and build your weekly recap email. Runs you choose to share, and shared workout summaries on your profile, are visible to other members as described in Section 4, and they are labeled with the Garmin device that recorded them.
• How it is processed and stored: Garmin data is processed and stored only by Supwell's own systems, which run on Microsoft Azure (see Section 4). It travels over encrypted connections and is delivered only to endpoints that Supwell owns and controls.
• Third parties and AI: We do not sell Garmin data or share it with any third party, and we do not send it to any third-party AI or data processing service. The only service provider that handles it is Microsoft Azure, which hosts our systems on our behalf. Garmin data is not used to train AI models.
• Disconnecting and deletion: You can disconnect Garmin at any time on the Devices page. That stops new data and ends Supwell's access on Garmin's side. Activities already synced stay in your account until you delete them or delete your account, as described in Sections 8 and 9.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.