Privacy Policy

1. Scope and who controls your data

This Privacy Policy explains how Wera Technologies Inc., a New York corporation operating Wera (“Wera,” “we,” “us,” or “our”), collects, uses, discloses, retains, and deletes personal information through the Wera application, website, and related services. For information Wera receives to operate the Service, Wera is the business or data controller and uses the providers identified below. Their roles differ: some process data for Wera, while wearable platforms and BigDataCloud also have independent purposes described below.

Wera’s separate Consumer Health Data Privacy Policy provides additional disclosures and rights specifically for health and fitness information.

This policy does not control information that Apple, Garmin, or another wearable provider keeps independently in its own product. Their policies govern those records.

2. Information Wera collects

• Account information: email address, account identifier, authentication and session information, and account-setup status. Passwords are handled by Supabase Auth and stored as salted hashes, not readable plaintext.
• Subscriptions and purchases: the store product and plan you select, purchase or transaction identifiers, Google Play purchase tokens, subscription status, trial and renewal dates, cancellation or expiry information, and an account-linked billing identifier. Wera uses these records to verify, restore, and manage membership access and prevent purchase fraud. Payment card details are handled by the store; Wera does not receive your full card number.
• Android launch requests: if you join the Android waitlist, Wera collects your email address to notify you when the Android app is available. No Wera account is required.
• Runner profile and goals: birthdate, sex, preferred units, race distance and date, target time, current fitness and training state, recent and peak weekly distance, training history, available training days, strength preferences, and equipment.
• Health and fitness information you authorize: workouts, activity type, dates and duration, distance, calories, heart-rate summaries and samples, resting heart rate, heart-rate variability, sleep timing and duration, VO₂ max, training load, and source-device metadata. A synced outdoor workout may include route or GPS information supplied by the wearable provider.
• Wera-generated information: training plans, workout schedules, Body Scores and component scores, calculated paces and loads, adaptation decisions, plan history, and sync status.
• Location for weather: Current-device weather uses coordinates rounded to three decimal places (about 110 meters in latitude; longitude precision varies by location). Wera sends those coordinates to Apple WeatherKit for forecasts and directly from your device to BigDataCloud to display a city or locality name. BigDataCloud also receives your IP address and states that it aggregates coordinate/IP pairings to improve its own IP-geolocation data. Separately, Wera uses locations and times from imported outdoor workouts to estimate historical conditions and weather-adjusted running pace. Historical WeatherKit requests round coordinates to four decimal places (about 11 meters in latitude); they are not controlled by your current-device location permission. Imported routes, calculated results, and associated cached weather evidence may be retained with your activity history.
• Feedback and support: the message, category, app area, screenshots or screen recordings you attach, your account email, the part of the app you were using, device/browser user-agent information, and submission time.
• Operational information: limited server, security, and error logs needed to run, diagnose, and protect the Service. Wera’s wearable webhook logging is designed not to include raw health payloads or user identifiers.

3. Where the information comes from

Wera receives information directly from you, from calculations performed by Wera, and from your device’s Apple Health store after you grant system permission. For Garmin, Wera receives data directly from Garmin Connect when you authorize Wera through the Garmin Connect Developer Program, or through Terra for a connection you previously authorized through Terra. Wera does not collect a category of Apple Health information when you do not grant access to that category.

4. How Wera uses information

• create, display, save, and adjust your training plan;
• calculate Body Score, training load, recovery indicators, fitness estimates, and workout guidance;
• import and display activities and sync status;
• receive the Garmin data categories you permit and send your structured workouts or training plans to Garmin Connect when you enable those features;
• provide local forecasts when you enable device location and estimate historical workout conditions from imported route locations and times;
• authenticate you and keep your information associated with the correct account;
• respond to feedback and support requests;
• send the Android launch notice you request when joining the waitlist;
• secure, debug, maintain, and improve the Service; and
• comply with law and respond to valid legal process.

Wera does not use health, fitness, or location information for advertising, targeted marketing, eligibility decisions, or sale to data brokers. Wera does not use HealthKit information for advertising or unrelated data mining.

5. Automated training decisions

Wera automatically uses profile, plan, and wearable information to generate workouts, Body Scores, and plan adaptations. These decisions affect only the training guidance shown in Wera; they do not determine employment, credit, insurance, healthcare access, or another legal or similarly significant right. You can choose not to follow a recommendation and can delete your account at any time.

Wera’s training plans and adaptations are produced by Wera’s own software rules and calculations, not by a generative AI service. The current Progress experience uses calculated results without sending running signals to an external generative AI service. Wera also uses internal pattern matching informed by reviewed workout examples to help classify runs. Wera may also send OpenAI redacted support or feedback text to organize requests into actionable tickets. You may include health or training details in a support message.

Garmin data and external AI

Wera does not send imported Garmin health, fitness, activity, or derived training data from its integrations to external AI for progress explanations. The Progress endpoint does not send data to external AI. Support messages are a separate flow: avoid including wearable exports or sensitive details you do not want processed for support.

6. Service providers and disclosures

Wera discloses information only as needed to operate the Service, on your instruction, to protect rights and safety, or as required by law:

• Supabase: authentication, PostgreSQL database, and private file storage.
• Vercel: application hosting, server execution, network delivery, and short-lived operational logs.
• Terra: Garmin authorization, collection, normalization, transfer, and deletion of connected wearable data. Terra’s End User Privacy Policy describes its role for connected users.
• Garmin Connect: when you choose a direct Garmin connection, Garmin handles your account authorization and consent, sends the health and activity categories you permit to Wera, and receives workouts or training plans you choose to send. Wera keeps the resulting connection credentials on its server to maintain the connection; Garmin controls the data it keeps independently.
• Google Play and Apple App Store: process in-app subscription payments under their own policies. Wera exchanges purchase verification information with the relevant store and receives subscription status updates to keep your membership current. Google receives an obfuscated account identifier for account binding; Wera does not send your training or health records for billing.
• Apple Health: the device source you authorize. Apple Health information is sent directly from your device to Wera, rather than through Terra.
• Apple WeatherKit: rounded current-device coordinates and forecast windows, and rounded imported workout coordinates and times for historical weather estimates.
• BigDataCloud: current-device coordinates rounded to three decimal places and your IP address for city/locality lookup. It also uses aggregated coordinate/IP pairings for its own IP-geolocation improvement; see its privacy policy.
• Resend: delivery of operational emails and feedback notifications to Wera support. A feedback notification includes the message, account email, app screen, and screenshots you choose to submit; do not include information you do not want sent by email.
• OpenAI: organization of redacted support or feedback text into tickets. Email addresses and account identifiers are removed where detected, but this does not guarantee removal of health details or every identifier you include. OpenAI does not generate Wera training plans or decide plan adaptations.

Providers may process information in the United States and other countries where they or their subprocessors operate. Wera requires providers to protect information under their agreements and applicable law. Wera may disclose information in a business transfer, but health information remains subject to this policy and applicable consent requirements.

7. Legal bases where required

Where the GDPR, UK GDPR, or similar law applies, Wera processes account and training information to perform the service you request; processes optional health, wearable, and location information with your consent; processes limited security and operational information for legitimate interests in protecting and maintaining Wera; and processes information when necessary to comply with law. You may withdraw consent, but withdrawal does not make earlier lawful processing unlawful.

8. Storage, security, and access

Wera’s active server data is stored primarily in Supabase. Traffic to Wera and its providers uses encrypted HTTPS/TLS connections, and the hosting providers state that production data is encrypted at rest. Wera uses authentication, database row-level security, private storage, server-only credentials, signed wearable webhooks, and access limitations intended to prevent one runner from reading another runner’s information.

Your current training plan is also stored in app/browser local storage for offline restoration. Temporary onboarding answers may be stored briefly on your device and in protected account metadata while you complete account or wearable authorization. Information stored locally is protected by your device and operating system, so you should use a device passcode and keep your device secure.

No system can guarantee absolute security. If Wera learns of a qualifying breach, it will investigate and provide notices required by applicable law.

9. Retention

• Account, plan, and health information: kept while your account is active so Wera can provide history, calculations, and adaptations, then deleted from active Wera systems when you delete the account.
• Wera subscription records: linked to your account while it is active and removed from active Wera systems when you delete your account. Deleting your Wera account does not cancel a store subscription or delete records independently held by Google or Apple; manage cancellation through the store where you subscribed.
• Temporary onboarding recovery: designed to expire after approximately 30 minutes for wearable returns or two hours for account confirmation.
• Feedback: kept while reasonably needed to investigate and resolve the submission, or until account deletion where it can be linked and removed.
• Android launch requests: kept until the launch notice is sent or you ask Wera to remove your address.
• Operational logs: retained for short periods determined by the hosting plan and longer only when reasonably necessary for security investigation.
• Backups and provider copies: deleted or overwritten on each provider’s protected backup lifecycle. Information may be retained longer only when required by law, necessary for security or fraud prevention, or needed to establish or defend legal claims.

Wera periodically reviews retention and aims to minimize raw health information that is no longer needed for the Service.

10. Your choices and rights

• Change Apple Health and current-device location permission through your device settings. Turning off those permissions stops new device access; it does not delete imported records or stop all processing of information already held by Wera.
• Revoke a Garmin connection through Garmin Connect. For a direct connection, deleting your Wera account also makes Wera request removal of its Garmin registration; for a Terra connection, Wera requests Terra deauthentication and deletion.
• Access and update profile or plan information through the Service.
• Pause health-data collection and processing in Settings → Health-data consent, without deleting your account or existing history. Re-consent is required to resume.
• Delete your Wera account and associated active Wera data in Settings. If deletion fails, health processing remains paused and you can retry.
• Request withdrawal of consent, deletion of particular health or route data, access, correction, portability, restriction, objection, or other rights available where you live by emailing team@wera.run.

California residents may have rights to know, correct, delete, and obtain information about personal information, and to receive equal service when exercising those rights. Wera does not sell personal information or share it for cross-context behavioral advertising. European and UK residents may complain to their local data-protection authority.

11. Account deletion

In Settings, choose “Delete account,” review what will be deleted, then continue to type “DELETE” in all caps and verify your password. Wera will remove your account, profile, plans, Body Scores, adaptations, connected wearable records, health and activity records, consent record, and linked feedback from active Wera database and file-storage systems. Wera will request removal of any direct Garmin registration and call Terra’s deauthentication endpoint for linked Terra wearable identities before completing deletion.

Deletion is permanent. It does not delete records independently controlled by Apple, Garmin, or your wearable provider. Protected backup copies are isolated from normal use and expire under provider schedules unless retention is legally required.

12. Children

Wera is for adults age 18 and older. Wera does not knowingly collect personal information from children. If you believe a child has provided information, contact Wera at team@wera.run so it can be removed.

13. Changes and contact

Wera may update this policy as the Service or law changes. Material changes will be presented in the Service and renewed consent will be requested when required. The current version and effective date appear above.

Wera’s official support contact is team@wera.run. Use this address to ask a privacy question or exercise a privacy right. Wera may need to verify that the request belongs to you before acting on it.