Privacy Policy

This policy explains what data the Due iOS app collects, why, and who it's shared with. Due is made by Red Ducks Studio LLC ("we," "us"), based in Albany, New York.

Signing in

You sign in to Due with Strava — that's the only way in. Due never sees or stores your Strava password. Strava's basic "read" access doesn't share your email with us, so we create an internal account tied only to your Strava athlete ID. When you connect, you choose which Strava permissions to grant.

What we collect

• Your Strava activities (runs). With your permission, Due reads your runs and their details: distance, duration, pace and speed, heart rate, elevation, laps, best efforts, workout type, temperature, and the run's GPS route (latitude/longitude). It loads your history and receives new runs automatically as Strava records them.
• Training plans. The plans you create, import, or edit, along with the workouts and any plan notes.
• Things you add in the app. Saved routes, shoes, and any photos you attach to runs or shoes.
• A device push token. If you enable notifications, so we can tell you when a run has banked toward your week.
• Diagnostics. Crash and error reports, which may include which screen failed and your account identifier, so we can fix problems.

All of the fitness data above comes from Strava. Due does not use Apple Health / HealthKit and does not track your phone's live location itself.

How we use it

To run your plan: grade each week against your mileage, quality, and long-run targets; show your progress, trends, and race estimates; draw your route maps; and sync new runs automatically. Diagnostics are used only to keep the app working.

Where your data is stored

We keep two kinds of data differently. The numbers we compute — your weekly mileage, quality and long-run totals, your training plans, and the stats that drive your dashboard — are stored durably in Due's own database (Supabase, on Google Cloud), so they sync and your season history stays current. The raw run data from Strava — the full activity, and the heart-rate and GPS-route detail — is treated as a short-lived cache: Due keeps it only about 7 days, then deletes it. If you open an older run's full detail, Due re-fetches it from Strava on the spot rather than holding onto it. Access is restricted to your own account, and your phone keeps only your sign-in session locally.

Writing back to Strava

If you grant the optional "write" permission, Due can add a short plan-progress note to a run's description on Strava. This is optional and you can decline it.

Who we share it with

We don't sell your data or share it for anyone else's marketing. We use a small set of service providers to run the app, and data flows to them only to provide their part of the service:

• Strava — the source of your runs; we read your activities and, with permission, write run descriptions. Disconnecting revokes this. Note that when Due talks to the Strava API, Strava itself collects usage data about those requests for its own business purposes, including improving the Strava platform — see Strava's privacy policy.
• Supabase — our database, authentication, and photo storage.
• Google Cloud — hosts and runs the Due service that ingests and processes your data.
• Mapbox — we send your run's GPS coordinates to render the map of your route.
• Open-Meteo — we send a run's start location and date to look up the weather for that run.
• Expo & Apple — to deliver push notifications (your device token and the notification text).
• Sentry — crash and error reports, which may include the screen involved and your account id.

We do not use advertising or analytics SDKs. We do not use your Strava data to train or operate AI.

Location data

Because Due maps your runs, it handles the GPS route of each run. That route comes from Strava (not your phone's live location), is stored with your activity, and is sent to Mapbox to draw the map. Each run's start point is also sent to Open-Meteo to look up the weather.

Your choices & controls

• Choose your Strava permissions when you connect.
• Disconnect Strava at any time — in Due or from your Strava settings. This stops syncing and deletes the runs Due pulled from Strava.
• Delete your account from inside the app. This revokes Strava access and permanently deletes your activities, routes, plans, photos, and account across our systems. You can also email us to do it.

Your rights

We process your data to provide Due to you (performance of a contract), and we connect to Strava only with your consent, which you can withdraw at any time by disconnecting. If you are in the EU, UK, or a jurisdiction with similar data-protection laws (including the GDPR and UK GDPR), you have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, and restrict or object to processing. Account deletion in the app exercises the erasure right immediately and completely; for anything else, email us at [email protected] and we'll respond promptly. You also have the right to complain to your local data-protection authority.

Data retention

Raw Strava run data is kept only about 7 days, then automatically deleted (older detail is re-fetched from Strava on demand). The metrics we compute and your plans are kept while your account is active. When you disconnect Strava, the Strava-sourced runs are deleted; when you delete your account, everything is removed.

Payments

Due does not currently process payments or collect any payment or card information. If paid features are added in the future, payment will be handled by Apple through the App Store, and Apple — not Due — would process your payment details.

Children

Due is not directed to children and we do not knowingly collect data from anyone under 13.

Security & location of processing

Access to your data is restricted to your own account through database access controls. Data is processed and stored in the United States. No method of storage or transmission is perfectly secure, but we work to protect your information.

Changes

If we update this policy, we'll change the effective date above. Significant changes will be noted in the app or on this page.

Contact

Red Ducks Studio LLC
Albany, New York, USA
[email protected]