Privacy
Last updated 14 October 2026
Teipa is a journal for the months before a race. To work, it keeps your account, the runs you bring in from Strava, and what you write about them. That's all. No ads, no tracking across other apps, and nothing is sold.
Who is responsible
Teipa is operated by [Legal entity name], [postal address] (“Teipa”, “we”). For anything about your data, write to privacy@teipa.run.
What we store
| Data | Where it comes from | Why |
|---|---|---|
| Email address and password (stored only as a secure hash), your name, and an optional profile photo | You, when you create an account | To sign you in and keep your journal yours |
| Strava connection: access and refresh tokens and your Strava athlete ID | Strava, when you connect your account | To import your activities. Tokens are kept on our servers, never shown to anyone |
| Activities: title, description, sport type, date and time, duration, distance, pace, heart rate, elevation, calories, laps and splits, and the route map | Strava, for the activities on your Strava account (including ones marked private there) | To show your runs, place them in a prep, and calculate weekly totals, milestones and posters |
| Preps: race name, distance, date, goal time, cover photo | You | To build the countdown and your prep |
| What you write: how each run went (mood, effort, energy, body, conditions, notes), weekly reflections, the three lines when you close a prep, and photos you attach to a workout | You | To keep the story of your prep |
Route maps show where you ran, which can reveal places such as your home. They are visible only to you inside Teipa, and on a poster only if you choose to export and share it.
Posters are rendered on your iPhone. Nothing is published anywhere unless you share the image yourself.
What we don't do
- We don't sell or rent your data, and we don't share it with advertisers or data brokers.
- We don't use third-party analytics or advertising SDKs, and we don't track you across other apps or websites.
- We never post to Strava or change anything on your Strava account. Teipa only reads.
- We don't use your data to train machine-learning models.
Who processes it for us
- Supabase hosts our database, sign-in and file storage. Your data is stored on their infrastructure in [region, e.g. EU (Frankfurt)].
- Strava is where your activities come from. Your use of Strava is covered by Strava's privacy policy.
- Apple distributes the app through the App Store.
Where a provider processes data outside the European Economic Area, it does so under appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Legal basis
We process your data to provide the service you asked for (performance of a contract, GDPR Art. 6(1)(b)). Heart rate can count as health data. We only hold it when it is part of the activities you choose to bring in from Strava, on the basis of your explicit consent (Art. 9(2)(a)), which you can withdraw at any time by disconnecting Strava or deleting your account.
How long we keep it
As long as you have an account. If you disconnect Strava, we stop importing and delete your Strava tokens; runs already imported stay in your journal until you delete them or your account. When you delete your account, everything listed above is deleted from our database and storage, and Teipa's access to your Strava account is revoked. Backups held by our hosting provider roll over within [N] days.
Your choices and rights
- Delete your account: in the app, go to Me and choose Delete account and data. This removes your account and all your data.
- Disconnect Strava: in the app under Me (this deletes the Strava tokens we hold), or from your Strava settings under My Apps.
- Access, correct, export or delete your data, or object to or restrict how we use it: write to privacy@teipa.run. We answer within 30 days.
- If you're in the EU, you can also complain to your data protection authority — in Spain, the Agencia Española de Protección de Datos.
Security
Data travels over encrypted connections (TLS) and is stored with access rules that let each account read only its own rows and files. Strava tokens are only ever used by our servers.
Children
Teipa is not directed at children under 16, and we don't knowingly collect their data.
This website
teipa.run uses no cookies, no analytics and no third-party scripts. Our hosting provider may keep standard server logs (such as IP address and time of request) for security, for a short period.
Changes
If this policy changes in a way that matters, we'll say so in the app before the change takes effect. The date at the top always shows the current version.