Privacy Policy
Last updated August 5, 2026
What OnBeet does
OnBeet records your runs and the music you listened to during them, then shows how your music relates to your running. This policy explains what data that takes, where it lives, and what control you have.
Data we collect
Account: your email address and the profile you create (name, handle, bio, avatar color or a profile photo). A profile photo is stored privately and used only to display your profile in the app — it is never shared or made public. We keep only your current photo; replacing or removing it deletes the previous image.
Runs: GPS route, distance, pace, elevation, and time — only while you are recording a run.
Heart rate: read from Apple Health during a run, only if you grant Health access. We never write to Health.
Music: the songs that play during your recordings (title, artist, timestamps) from Spotify or Apple Music, plus playlists you choose to import.
Connected apps: when you link Strava, we import the runs and workout laps you authorize.
Similarity matching: to suggest songs that other runners like you run to, we compare aggregated characteristics of your running — typical pace, weekly volume, usual run length, age, maximum heart rate, and energy preference — against other accounts. Your genre preferences are stored with this similarity profile but are not used for matching today. Only anonymous, aggregate results are shown; no other runner’s identity is revealed.
Diagnostics: crash and error reports (via Sentry) so we can fix bugs. These carry your account ID (so we can investigate a problem you report) but never your email, name, location, or listening history — reports are scrubbed before they leave the device.
GPS diagnostics (optional): if you turn on “Help improve OnBeet” in Settings, each recorded run’s raw GPS trace (position, time, GPS accuracy, and speed — no heart rate, no music, no name) is uploaded to our private storage and used only to improve tracking accuracy. This is off by default. Turning it off deletes the traces you have shared, and deleting your account removes them as well.
What we never do
We do not sell your data. We do not share it with advertisers or data brokers. We do not track you across other apps or websites. Your Spotify, Apple, and Strava sign-in tokens are stored server-side only and are never exposed to other users or third parties.
Where your data lives
Your data is stored in our database (Supabase, hosted in the US), protected by row-level security so only your account can read your rows. Share images you create are stored so they can be linked (for example, from a Strava activity description).
Service providers that process data for us: Supabase (database & authentication), Sentry (crash reports), and Resend (transactional email — sign-up confirmations and password resets go through it, which means it processes your email address). None of them may use your data for their own purposes.
Sharing you control
Nothing is posted anywhere without your action. Sharing a run card, adding your soundtrack to a linked Strava activity, or exporting a playlist to Spotify all happen only when you tap them (or explicitly turn on auto-share in Settings, which you can turn off anytime).
Your rights
Export: Profile → Account → “Export my data” downloads a JSON file of everything you’ve created and the data we hold about you — your profile, runs, music history, playlists, ratings and feedback, connected-app info, and more, with a per-section count of what it contains. A few things are deliberately left out: the dense per-second sensor telemetry behind each run (left out to keep the file usable), your connected-app sign-in tokens (never exported), and data held by our separate service providers — the optional raw-GPS diagnostics you have shared and crash reports (Sentry) — which you can request by emailing support@onbeet.app.
Delete: Profile → Account → “Delete account” permanently deletes your account and all your data (runs, music history, playlists, connections, images). This is immediate and cannot be undone.
Disconnect: you can disconnect Spotify, Apple Music, or Strava at any time in Profile; we stop reading from them immediately. When you disconnect Strava, the runs and laps we imported from it are deleted promptly, and in any event within 48 hours of the disconnection.
Retention: we keep your data only while your account exists. Deleting your account removes it immediately; short-lived server backups age out within 30 days. One carve-out: fully anonymous, aggregate statistics (for example, "average pace across all runners") contain nothing traceable to you and may persist after deletion.
Permissions we ask for
Location (including background): to record your route while you run, even with the screen locked. Used only during recording.
Apple Health: to read heart rate during a run (optional).
Apple Music / media: to see what is playing so songs can be pinned to your route (optional).
Camera & photo library: used only when you choose to set a profile photo, solely to take or pick the picture.
Contact
Questions or requests: support@onbeet.app
Data & Permissions
Last updated August 5, 2026
Location
Used only while recording to draw your route and compute distance, pace, and elevation. Background access lets recording continue with the phone locked. Never used for advertising, never shared. If you opt in to “Help improve OnBeet”, raw GPS traces of your runs are also uploaded to our private storage — used only to improve tracking accuracy, never shared, and deletable at any time by turning the setting off.
Music
While you record, we log what plays (song, artist, timing) so your route can be colored by your soundtrack. Importing a playlist reads that playlist’s track list once.
Heart rate
Read from Apple Health during recording, if you allow it, to show live HR and per-song effort. We never write to Health.
Connected apps
Strava: imports the runs you authorize; posting your soundtrack to a Strava activity only happens when you tap it or opt in. Sign-in tokens for all connections are stored server-side only.
Crash reports
Crash diagnostics (Sentry) help us fix bugs. They are tagged with your account ID only — no email, name, location, or listening data — and are never used for tracking or advertising.
Your controls
Export or permanently delete everything in Profile → Account. Disconnect any linked app in Profile at any time.
Contact: support@onbeet.app