Privacy Policy
Overview
PESSAGE ("we," "our," or "the Service") is a running lifestyle platform that curates editorial content, running routes, race calendars, gear, and recovery data for runners. We are committed to protecting your personal information and being transparent about how we collect and use it.
This Privacy Policy applies to all users of the PESSAGE web application accessible at pessage.run, as well as RUTE (rute.run), a running course service operated by the same operator. RUTE does not have its own registration; it can only be used with a pessage.run account. By using the Service, you agree to the practices described herein.
Data We Collect
We collect information only necessary to provide the Service. The categories of personal data we process are as follows:
Social Login Information
Collected from OAuth providers
| Provider | Data Collected |
|---|---|
| Display name, email address, profile photo URL | |
| Kakao | Nickname, email address (if provided), profile photo URL |
| Naver | Name, email address, profile photo URL |
Exercise & Activity Data
Collected via Strava OAuth (user-initiated connection only)
| Category | Data Collected |
|---|---|
| Recent Activities | Activity name, date, distance (km), moving time, pace (min/km) |
| Heart Rate | Average heart rate, maximum heart rate (only when HR monitor is connected to device) |
| Calories | Estimated caloric expenditure per activity |
| Annual Stats | Year-to-date total running distance |
| Athlete Profile | First name, last name, profile photo (from Strava) |
Contributed Courses (RUTE)
Collected only when you upload a GPX file to RUTE to share as a course. If you do not upload, nothing is collected.
| Category | Data Collected |
|---|---|
| Route data | Latitude, longitude, and elevation from the GPX file you upload. Timestamps (when you passed each point) are not stored. |
| Contributor credit | Display name and Instagram handle you enter (both optional) |
| Submission record | Account identifier, submission date, review status, rejection reason |
Uploaded routes are published as public courses that anyone can view and download. If the start or end point is near a location you do not wish to reveal, you can trim those segments before uploading.
Device integrations (Garmin, COROS, Suunto)
When you connect a supported wearable device (Garmin, COROS, or Suunto), PESSAGE may collect the following data via the device's official API:
- Activity data: distance, pace, duration, average heart rate, activity name
- GPS route data (for map display; not stored on our servers)
We do not collect sleep scores, HRV, Body Battery or other health and recovery metrics. For full details see Fitness Device Data.
Automatically Collected Data
- Firebase Authentication tokens and session state
- Standard web server logs (IP address, user agent, page requests) maintained by Vercel infrastructure
Purpose of Use
| Purpose | Description |
|---|---|
| Authentication | To identify you and maintain your logged-in session across the Service |
| Personalization | To display your name and profile photo; to restore your saved articles and gear |
| Recovery Features | To calculate your Ritual Score and display real running metrics on the Recovery Ritual page using Strava and connected device data |
| AI Content | To generate personalized recovery ritual recommendations using your activity data as context (processed via Google Gemini API). Strava data is never used for this (Strava API Policy). |
| Run videos (RUTE TRACE) | To render an animated video of your own run in your browser from its GPS track. Neither the track nor the video is stored on our servers |
| Service Improvement | To understand how the Service is used and to fix technical issues |
Third-Party Sharing
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
Third-party services involved in the Service
| Service | Role |
|---|---|
| Google Firebase | Authentication (Google login), user session management, and cloud database (Firestore) for user preferences, saved content, and device connections |
| Kakao Developers | OAuth authentication for Kakao users |
| Naver Developers | OAuth authentication for Naver users |
| Strava | Exercise data retrieval (only when you explicitly connect your account) |
| Google Gemini API | AI-generated recovery ritual text (activity context sent as prompt input) |
| Sanity.io | Content management system for editorial articles, routes, and gear |
| Vercel | Cloud hosting and serverless function infrastructure |
| Garmin Connect API | Activity & recovery data (only when you explicitly connect your device) |
| COROS API | Activity & recovery data (only when you explicitly connect your device) |
| Suunto API | Activity & recovery data (only when you explicitly connect your device) |
When you use the AI Ritual feature, a text prompt containing your running statistics (distance, pace, heart rate) is sent to Google Gemini API. No personally identifiable information (name, email) is included in these prompts.
Fitness Device Data
What we collect
Only when you connect a device account yourself, we receive the following from the provider (Garmin, Suunto, Strava, COROS):
- Activity records — type, date and time, distance, duration, pace, average heart rate, activity name
- Connection identifiers — the user ID and access tokens issued by the provider
- Activity track (GPS coordinates) — retrieved but not stored (see "How we process and store it" below)
We do not collect sleep scores, heart rate variability (HRV), Body Battery, stress levels or other health and recovery metrics calculated by the provider.
How we collect it
A connection begins only after you authorise it on the provider's own consent screen, reached from the "Sync Your Gear" screen on pessage.run or the MY RUN page on rute.run; both manage the same connection. After that, records arrive through provider webhooks (Garmin, Suunto) or are fetched from the provider's API when you open the page (Suunto, Strava).
How we use it
- Generating weekly and monthly running reports
- Calculating your Ritual Score
- Sending RUTE courses to your device
- RUTE TRACE — rendering a video of your own run in your browser (track and video are never stored on our servers). Strava records are used for this purpose only and never as material for published or shared courses.
How we process and store it
Activity records are stored against your account, up to a maximum of 30 most recent entries per account; older records are automatically removed. GPS coordinates are not stored. When a map needs to be drawn, the track is fetched from the provider's API, rendered, and discarded. Strava activity records are not stored; they are fetched from the Strava API each time you open the page (Strava API Policy). For Strava we keep only the access tokens and your Strava athlete ID.
Transfer to third parties, including AI services
Only when you run the AI curation feature yourself:
| Item | Detail |
|---|---|
| Recipient | Google LLC (Gemini API) |
| Country | United States |
| Data transferred | Weekly aggregate metrics (distance, elevation gain, number of runs, active time, change from the previous week, heart-rate zone distribution) and your Ritual Score value |
| When and how | At the moment you run the feature, over HTTPS |
| Retention | Discarded immediately after the response is generated; not stored |
We do not transfer: sleep score, HRV, Body Battery or other recovery metrics; GPS coordinates; your name, email address or account identifiers; any data received from Strava (not used for AI processing under the Strava API Policy).
We do not sell fitness device data, share it with any other third party, or use it for advertising.
Retention and deletion
- When you disconnect a device in the app or on the RUTE MY RUN page, we immediately ask the provider to revoke our access and delete the stored data and tokens.
- If you revoke access from the provider's side (for example in Garmin Connect), we receive the provider's deregistration notice and delete the stored data.
- Deleting your account disconnects the devices and deletes the data together.
Article 4-3 Collection and Processing of User-Contributed Courses
1. When a user uploads a running course to the RUTE service, we collect the following: route, elevation, and location data contained in the GPX file; and the contributor's display name shown on the service.
2. Submitted courses are published on the service after review. The right to use, edit, and distribute published courses belongs to the company.
3. Published courses are retained for the duration of service provision.
4. When a user deletes their account, personal information such as the contributor's display name is deleted or anonymized. Courses already published may remain published in anonymized form. To request deletion of your published courses, contact hello@pessage.run before deleting your account.
5. You may refuse consent to the collection and use described above, in which case the course upload feature will not be available.
Data Retention
| Data Type | Retention Period |
|---|---|
| Firebase Auth credentials | Until you log out or delete your account |
| Strava tokens & athlete ID | Stored in Firestore; activity data is not stored (displayed on fetch). Deleted when you disconnect Strava or delete your account |
| Device connections (Garmin, COROS, Suunto) | Stored in Firestore; deleted when you disconnect the device or delete your account |
| Saved articles & gear | Stored in Firestore; deleted when you delete your account |
| AI-generated content | Stored in Firestore; deleted when you delete your account |
| Contributed courses (RUTE) | Published courses are retained after account deletion; contributor credit and account identifier are removed. Pre-publication submissions are deleted with the account |
| Server logs | Retained by Vercel infrastructure per their standard log retention policy |
PESSAGE uses Google Firebase Firestore as its cloud database to store user preferences, saved content, device connections, and activity data. All personal data stored in Firestore is deleted when you delete your account.
Exception — published contributed courses: Courses you have uploaded and that have been published are public content used by other runners, so the course itself is retained after account deletion. However, all personally identifiable information — contributor display name, Instagram handle, and account identifier — is removed, severing the link between the course and you. Submissions that have not yet been published (pending review or rejected) are deleted entirely along with the course when you delete your account. If you wish to have a published course removed, please contact us at the address in the Contact section.
Your Rights
You have the following rights regarding your personal information:
- Access — You may request a copy of the personal data we hold about you.
- Correction — You may update your display name directly within the PESSAGE app profile settings.
- Deletion — You may delete your account and all associated Firestore data from the Profile page. You may also revoke OAuth access through Google, Kakao, Naver, or Strava account settings.
- Withdrawal of Consent — You may disconnect Strava or wearable devices at any time via the Profile page. You may revoke Google Firebase authentication via your Google account's connected apps page.
- Portability — Exercise data remains in your Strava account and connected device platforms (Garmin, COROS, Suunto) and can be exported directly from those services.
To exercise any of these rights or for privacy inquiries, please contact us at the address below.
Cookies & Local Storage
PESSAGE uses Firebase Authentication tokens and browser localStorage to maintain your login state. User data (saved content, device connections, activity data) is stored in Firebase Firestore, not in browser storage.
Firebase Authentication may use cookies or local storage as part of its standard authentication flow. You can clear these at any time through your browser settings.
We do not use advertising cookies or third-party tracking scripts.
Children's Privacy
PESSAGE is not directed at children under the age of 14. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.