Privacy Policy

This policy explains what data Velox (“we”, “us”) collects, why, and how we protect it. For the purposes of UK data-protection law, Velox is the data controller for the personal data described here. We aim to collect only what we need to run the Service. You can reach us about privacy at hello@velox.run.

Account data: your email and a password stored only as a bcrypt hash.

Garmin data: your runs and wellness metrics (pace, heart rate, sleep, HRV and similar), synced with your authorisation. Some of this is health data — a special category under UK GDPR — which we process only to provide the Service to you, on the basis of your explicit consent. We store an encrypted Garmin access token, never your Garmin password.

Billing data: handled by Stripe. We store a Stripe customer/subscription reference and status, not your full card details.

Usage & analytics data: if you accept analytics and advertising cookies, we collect product-usage data (pages visited, actions taken, and optionally session replays of in-app activity) via PostHog, and conversion data (e.g. that a sign-up or subscription followed an ad click) via Google Tag Manager. See Cookies & analytics below.

We process your personal data on these bases:

Contract — to provide the Service and manage your subscription.

Consent — for analytics cookies and for processing your Garmin health data; you can withdraw consent at any time.

Legitimate interests — to secure, maintain and improve the Service, where not overridden by your rights.

Legal obligation — e.g. retaining billing records for tax and accounting.

We use your data to provide analytics and AI coaching, operate your subscription, secure your account, respond to support requests, and send essential account emails (verification and password reset) via our email provider.

When you generate a plan, prediction or analysis, relevant training data is sent to our AI provider (Anthropic) to produce the result. It is used to fulfil your request and is not used to train their models.

We rely on trusted providers to operate Velox, including Neon (database hosting), Stripe (payments), Anthropic (AI), Resend (transactional email), PostHog (product analytics) and Google (advertising conversion measurement, only with your consent). Each processes data only as needed to provide their service.

Some of our providers (including Anthropic, PostHog and Google) are based in or process data in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

We keep your account and Garmin data for as long as your account is active. If you delete your account, we remove your stored data, except limited records we must keep by law (such as billing records for tax purposes). Backups are purged on a rolling basis.

Essential cookieskeep you signed in and secure your session and payments. These are required for the Service to work, so they're always on.

Analytics cookies (via PostHog) help us understand how Velox is used and improve it; this can include session replays of in-app activity.

Advertising cookies (via Google Tag Manager) measure whether our ads lead to sign-ups and subscriptions, so we can spend our advertising budget sensibly.

We only set analytics and advertising cookies after you accept — until then nothing analytics- or advertising-related is stored or collected. You can change your choice at any time:

Cookie settings

Garmin tokens are encrypted at rest with AES-256-GCM, passwords are hashed with bcrypt, and all traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.

Under UK GDPR you have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent at any time. You can export all your data or delete your account at any time from Settings; for other requests, contact hello@velox.run. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16.

We may update this policy from time to time; material changes will be communicated via the Service or by email. The “last updated” date above reflects the latest version.

For any privacy questions or requests, contact us at hello@velox.run.