Privacy Policy

Last updated

This is the privacy policy for Just5K — the website at just5k.com and the iOS app of the same name. We've kept it short on purpose. If something here is unclear, email us and we'll fix the wording.

Who we are

Just5K is a small independent product, run by Petro Dudchenko, an independent developer based in Spain. He is the controller of the personal data described in this policy, which means he decides how it's used and is responsible for it.

  • Name: Petro Dudchenko
  • Address: C/ de Ciril Amorós, L'Eixample, 46004 València, Spain
  • Email: hello@just5k.com

When we say "we" or "us" in this policy, we mean Petro and anyone helping him with Just5K. When we say "you," we mean the person reading this page or using the app.

What we collect on the website

The website at just5k.com is a static blog with a few product pages. We use three analytics tools. Unless you accept cookies (see the next section), all three are set up so they don't store anything in your browser or recognise you on a later visit:

  • Vercel Analytics — counts pageviews and clicks on the site's buttons and links (for example "Download the app" or an article card), so we can see which articles people read and which parts of the site they use. It does not set cookies, does not store IP addresses, and cannot identify you across visits. See Vercel's privacy documentation.
  • Vercel Speed Insights — measures how fast pages load on real devices (Web Vitals). Same privacy properties as Vercel Analytics: anonymous, cookieless, no IP storage.
  • Amplitude — records the same pageviews and clicks in the order they happened during one visit: which page you landed on, what you read next, and whether you tapped "Join the beta". That shows us how people move through the site, which plain counts can't. Your visit gets a random ID that lives only in the open tab: Amplitude sets no cookies and stores nothing in your browser, so the ID is gone when you close or reload the page, and a later visit looks like a new person. We switched off IP address collection, so the events carry no IP address. Each event also says which page it happened on, the site or campaign link that brought you here (for example a search engine or a utm_source tag), your browser's language, and the kind of browser and device you use. See Amplitude's privacy notice.

All three can be disabled per-device by visiting any page with ?noanalytics=1 in the URL once. The opt-out flag is stored in your browser's localStorage and applies until you clear it.

Beyond that, our hosting provider (Vercel) keeps standard server logs — request paths, timestamps, response codes — for operational and security reasons. These logs are retained for a short window and are not joined with anything else.

Cookies, only if you accept them

If you visit from the United States, a small banner asks whether we may use cookies. To work out whether to show it, your browser asks our server once per page load for your country, which our host reads from your connection; we don't keep it. Anyone, wherever they are, can open the banner with Cookie settings at the bottom of every page. Until you tap Accept, nothing changes: the site works as described above.

If you accept, Amplitude does four more things:

  • Remembers your browser. It keeps a random ID in a cookie (AMP_ followed by the start of our project key) and in your browser's storage, so a later visit is linked to your earlier ones and we can see whether people come back.
  • Receives your IP address, which Amplitude uses to estimate your country, region and city.
  • Records your visit with Session Replay: how the pages looked as you scrolled and tapped, so we can see where an article loses people. Text typed into fields is masked, and the site has no forms.
  • Records clicks on its own: every link and button you click, not only the few we track by name.

Your choice is kept in your browser's localStorage (consent) for 12 months; after that the banner asks again. To change your mind, open Cookie settings and tap Decline. Amplitude stops at once, the page reloads, and the site removes Amplitude's cookie and stored data from your browser. What was already sent stays in Amplitude, as described below.

We do not set cookies unless you accept them in that banner, run third-party advertising, embed Facebook or Google tracking pixels, sell or rent any data, or build profiles of individual visitors.

What the iOS app does with your data

The Just5K iOS app has no account. Everything it knows about you stays on your iPhone, and we never receive it. The one exception is optional: if you connect Strava, your finished sessions go from your iPhone to your own Strava account (see Strava below).

What you tell the app

During setup the app asks a few questions. All of them can be skipped.

  • Your name — to greet you in the app.
  • How long you could run right now — to pick the week you start in.
  • Your weight — only to recommend a gentler starting program.
  • Your program and training days — to build your plan and schedule reminders.
  • Why you run — the app stores your answer but doesn't use it for anything today.

Profile photo (optional)

You can add a photo to your profile, either by taking one or by picking one from your photo library.

  • Camera — used only when you choose to take a profile photo. iOS asks for permission the first time.
  • Photo library — the app uses the standard iOS photo picker and receives only the photo you pick. It doesn't ask for access to your library.

The app keeps a small square copy of the photo on your iPhone, without the original and without the details the camera adds, such as where it was taken. It's never uploaded. You can remove it in your profile at any time.

Apple Health (optional)

The app works without Apple Health. If you connect it, iOS shows Apple's standard permission screen, and you can turn each type of data on or off.

What the app reads, and why:

  • Workouts (type, date, duration, and distance and average heart rate when they're recorded): to mark a planned session as done when you record a run or walk in another app, for example on Apple Watch; to show other activities as "logged outside the plan"; and to show how a session went.
  • Sleep: last night's sleep, for the Sleep card on Home, measured against 7 hours. If it was under 6 hours, today's session also gets a short note that extra walk breaks are fine. It never changes or cancels your plan.
  • Steps: today's steps and your daily steps over the last week, for the Steps card on Home, which compares today with your own usual day.
  • Resting heart rate: for the Heart card on Home, which shows how it has changed since you started your first program.
  • Cardio fitness: the readings Apple Watch takes on outdoor walks and runs, shown when you open the Heart card, with how it has changed since you started your first program.
  • Heart rate: during a run in the app's run player, for the review on the summary screen at the end of the session.

With Just5K Plus only, and only if you allow them: the Body card on Home reads four more types, all measured by Apple Watch. The app asks for them separately, from the Body card, not during setup:

  • Heart rate variability
  • Respiratory rate, while you sleep
  • Blood oxygen
  • Sleeping wrist temperature

Each one is shown against your own average over the previous 14 days with data. The app doesn't rate these readings or tell you what they mean for your health.

The app doesn't ask for any other Health data.

What the app writes, and when: only when you finish a session in the app's run player, and only if you allow it (iOS asks when you start your first session):

  • the session, as a running workout, or as a walking workout for walk-only sessions such as the first weeks of Gentle Start;
  • its distance;
  • its route, if location was on during the run.

You can also turn Apple Health off in the app's profile. The app then stops reading from and saving to Health, and your Health data stays as it is.

Nothing the app reads from Apple Health leaves your iPhone, and it isn't sent to us or to Strava. Workouts it saves appear in Apple Health like any other workout, and you can delete them there. Health data is never used for advertising.

Location

During a run, with your permission ("While Using the App"), the app uses GPS to measure distance and pace and to draw your route at the end. It keeps working while your phone is locked, until the run ends. It doesn't use your location at any other time. The route isn't stored by the app: it's shown once on the summary screen and, if you allow it, saved to Apple Health. If you connected Strava, it also goes to your Strava account with the session; when you're offline, the app keeps that session and its route on your iPhone until it's sent. The route map is drawn with Apple Maps, which loads map images from Apple.

Notifications

If you allow notifications, the app schedules reminders on your iPhone: a morning reminder and an evening check-in on your training days, and a short message when a session is completed. No notification server is involved.

Apple Watch

If you tap "Add to Apple Watch", the app schedules that session in the Workout app on your Apple Watch using Apple's WorkoutKit. This happens between your own devices.

Strava (optional)

You can connect your Strava account with the Strava switch in the app's profile. Every session you then finish in the run player goes to your Strava account on its own.

  • Signing in. Strava's own sign-in page opens inside the app. The app asks Strava only for permission to upload activities: it can't read your Strava activities, profile or followers. After you agree, Strava gives the app a one-time code. The app sends that code to a small function on just5k.com, which adds our app's Strava key and exchanges the code for access tokens. The function hands only the tokens back to the app and keeps nothing: no code, no token, no name. The same function renews the tokens every few hours. Our host logs that a request happened (time, path, response code), as it does for any page, but not what was in it.
  • What goes to Strava. For each finished session: when it started, how long it took, the distance, the GPS route if location was on, whether it was a run or a walk, and a name such as "Just5K · Week 3, session 2". It goes straight from your iPhone to Strava and doesn't pass through just5k.com. Who can see it on Strava follows your Strava privacy settings.
  • What stays on your iPhone. The tokens, in the iPhone's Keychain. A session that couldn't be sent yet waits on your iPhone.
  • Disconnecting. Turn off the Strava switch in the profile. The app asks Strava to remove its access and deletes the tokens and any session still waiting. Sessions already on Strava stay there until you delete them in Strava. You can also revoke Just5K on strava.com under Settings, My Apps.

Once a session is on Strava, Strava handles it under its own privacy policy.

What the app does not do

The app has no account and no analytics or advertising tools. It doesn't track you across other apps or websites, and it doesn't sell your data. It shares nothing with anyone, except the sessions you choose to send to Strava.

Deleting your data

Deleting the app deletes everything it stored on your iPhone. Workouts it saved to Apple Health stay there until you delete them in the Health app, and sessions sent to Strava stay there until you delete them in Strava. You can turn off Health access, the camera, location or notifications at any time in iOS Settings.

If we ever add a backend (for example, to sync your plan across devices), we will update this policy before turning it on.

What we do not collect

  • We do not require you to create an account to use the website.
  • There are no forms on the website, and we don't run a newsletter.
  • We do not embed third-party trackers from advertising networks, social platforms, or data brokers.
  • We do not collect your IP address, unless you accept cookies: then Amplitude receives it to estimate where you are.
  • We do not sell or share data with third parties for marketing.

Why we can use this data, and for how long

  • Server logs and anonymous analytics. Our legitimate interest in keeping the site running, secure and useful (Art. 6(1)(f)). Our host deletes the logs automatically at the end of its retention window. Vercel's analytics are anonymous and aggregated. Amplitude's events are tied only to a random ID for one visit, with no IP address, so they don't identify you either; they stay in Amplitude as long as our project there exists.
  • Cookies, if you accept them. Your consent (Art. 6(1)(a), and Article 22.2 of Spain's LSSI for storing them in your browser). You can withdraw it at any time with Cookie settings; that doesn't change what was sent before. The events and your IP address stay in Amplitude as long as our project there exists; Amplitude deletes the session recordings after 30 days.
  • Emails you send us. Our legitimate interest in answering you (Art. 6(1)(f)). We keep the conversation while we deal with your request and for as long as it's useful to follow up.
  • The app. Its data never reaches us, so there is nothing for us to process. If you connect Strava, our function exchanges your sign-in code and renews your tokens because you asked for the connection (Art. 6(1)(b)); it keeps nothing afterwards.

Where data is processed

Vercel (our hosting provider) operates a global content delivery network. The website is served from the edge region closest to you, but data may be processed in any region Vercel operates, including the United States. Vercel relies on the European Commission's Standard Contractual Clauses to cover transfers of personal data outside the European Economic Area; their full list of subprocessors and safeguards is at vercel.com/legal/privacy-notice.

Amplitude (Amplitude, Inc., United States) stores the site's analytics events, and the session recordings of visitors who accepted cookies, in its data center in the United States. For that transfer Amplitude relies on its certification under the EU-U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a fallback (Amplitude security and privacy).

Email goes through two services:

  • ImprovMX forwards mail sent to hello@just5k.com to our inbox. It stores its EU customers' data in France (ImprovMX on GDPR).
  • Gmail (Google) is where our inbox lives, so your emails end up there. Google processes them under its own privacy policy and is certified under the EU-U.S. Data Privacy Framework (Google's data transfer frameworks).

The iOS app processes everything on your iPhone. Its network requests go to Apple, for the map images on the route map, and, only if you connect Strava, to Strava (Strava, Inc., United States) for your sessions and to the token function on just5k.com, which runs on Vercel as described above and stores nothing. If we add a backend that stores data in the future, this section will be updated to describe where that data is stored.

Children

Just5K is not directed at children under 14 — the digital consent age under Spanish data-protection law (LOPDGDD). We do not knowingly collect personal data from minors. If you believe a minor has provided information through our site or app, contact us and we'll delete it.

Your rights

If you are in the European Economic Area, the United Kingdom, California, or another jurisdiction with data-protection rules, you have rights including access, correction, deletion, restriction and portability of any personal data we hold about you. You can also object to what we do on the basis of our legitimate interest.

In practice, today we hold almost nothing about individual users — there are no accounts and no health data on our servers, and the only email addresses we have are from people who wrote to us. Most "right to access" or "right to delete" requests resolve to "we don't have anything to give you, here's the proof." If you still want to exercise a right, email us at the address below and we will respond within 30 days.

You also have the right to complain to a data protection authority: in Spain that's the Agencia Española de Protección de Datos (aepd.es), or the authority where you live or work. We'd be glad of the chance to put things right first, so please write to us too.

How to contact us

Email us at hello@just5k.com. Include enough detail that we can act on the request — for example, the email address you signed up with, if any.

Changes to this policy

When we change what data we collect or how we use it, we will update this page and bump the "Last updated" date at the top. For material changes (like adding a backend that stores user data, or starting an email program), we will surface the change on the homepage before it takes effect.

We keep every earlier version of this page. Email us if you'd like to see one.